Open-source super AI assistant & Agent Harness. Plans tasks, runs tools and skills, self-evolves with memory and knowledge. Multi-model, multi-channel. Lightweight, extensible, one-line install. (formerly chatgpt-on-wechat)
This report presents the forensic synthetic code analysis of zhayujie/CowAgent, a Python project with 45,967 GitHub stars. SynthScan v2.0 examined 115,180 lines of code across 407 source files, recording 2370 pattern matches distributed across 18 syntactic categories. The overall adjusted score of 29.3 places this repository in the Moderate AI signal band.
The scanner applied 160+ deterministic lexical heuristics, multi-line block detectors, abstract syntax tree depth profilers, and a cross-file Jaccard similarity matrix to construct a statistically normalised synthetic code estimate. All matches are individually weighted by severity coefficient and contextual multiplier before summation, and the resulting headline score is temporally discounted to account for the repository's development history relative to the commercial emergence of large language model coding tooling (November 2022 onward).
This chart maps the temporal evolution of the adjusted synthetic code score across successive scan runs. An upward trajectory indicates ongoing incorporation of AI-generated code or expanding LLM-assisted scaffolding; a stable or declining trajectory may reflect active human refactoring, code removal, or the adoption of stricter authorship policies. The dashed secondary line (right axis) independently tracks total raw pattern hit count, which can diverge from the normalised score when codebase size changes significantly between scans.
Classifies detected patterns by their diagnostic confidence and structural impact. CRITICAL patterns (coefficient 10) represent definitive synthetic signatures — hallucinated imports, explicit LLM attribution metadata — virtually never produced by human authors. HIGH (5) indicates strong structural tells such as cross-file repetition or cross-linguistic idioms. MEDIUM (2) covers recognisable conversational padding and AI-specific vocabulary. LOW (1) captures subtle indicators like tautological comments and generic boilerplate that require density to carry independent signal.
This horizontal bar chart decomposes the repository's raw synthetic code score by top-level directory, allowing you to pinpoint precisely which modules or components carry the highest AI authorship density. Directories with disproportionately high scores relative to their size warrant targeted manual review: concentrated AI signatures often trace back to mass-generated configuration layers, auto-ported test suites, LLM-scaffolded boilerplate classes, or entire subsystems authored under heavy copilot assistance. Use this view to prioritise your human code-review effort.
The scanner identified 2370 distinct pattern matches across 18 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a statistically significant AI authorship indicator. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the diagnostic confidence level (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — comment-context matches receive a ×1.5 weight because LLMs systematically over-annotate. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier as dense clusters constitute far stronger evidence of synthetic authorship than isolated hits.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | run.sh | 4 | # ============================ | COMMENT |
| MEDIUM | run.sh | 6 | # ============================ | COMMENT |
| MEDIUM⚡ | run.sh | 31 | # ============================ | COMMENT |
| MEDIUM⚡ | run.sh | 33 | # ============================ | COMMENT |
| MEDIUM⚡ | plugins/cow_cli/cow_cli.py | 344 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM⚡ | plugins/cow_cli/cow_cli.py | 346 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | plugins/cow_cli/cow_cli.py | 299 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | plugins/cow_cli/cow_cli.py | 301 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | plugins/cow_cli/cow_cli.py | 410 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | plugins/cow_cli/cow_cli.py | 414 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | plugins/cow_cli/cow_cli.py | 445 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | plugins/cow_cli/cow_cli.py | 447 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | plugins/cow_cli/cow_cli.py | 494 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | plugins/cow_cli/cow_cli.py | 496 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | plugins/cow_cli/cow_cli.py | 531 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | plugins/cow_cli/cow_cli.py | 533 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | plugins/cow_cli/cow_cli.py | 599 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | plugins/cow_cli/cow_cli.py | 601 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | plugins/cow_cli/cow_cli.py | 767 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | plugins/cow_cli/cow_cli.py | 769 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | plugins/cow_cli/cow_cli.py | 820 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | plugins/cow_cli/cow_cli.py | 822 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | plugins/cow_cli/cow_cli.py | 1222 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | plugins/cow_cli/cow_cli.py | 1224 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | plugins/cow_cli/cow_cli.py | 1614 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | plugins/cow_cli/cow_cli.py | 1616 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | plugins/cow_cli/cow_cli.py | 1748 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | plugins/cow_cli/cow_cli.py | 1750 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | tests/test_security_ssrf_path_traversal.py | 23 | # ============================================================================= | COMMENT |
| MEDIUM | tests/test_security_ssrf_path_traversal.py | 25 | # ============================================================================= | COMMENT |
| MEDIUM⚡ | tests/test_security_ssrf_path_traversal.py | 138 | # ============================================================================= | COMMENT |
| MEDIUM⚡ | tests/test_security_ssrf_path_traversal.py | 140 | # ============================================================================= | COMMENT |
| MEDIUM | tests/test_robustness_fixes.py | 20 | # ============================================================================= | COMMENT |
| MEDIUM | tests/test_robustness_fixes.py | 22 | # ============================================================================= | COMMENT |
| MEDIUM⚡ | tests/test_robustness_fixes.py | 67 | # ============================================================================= | COMMENT |
| MEDIUM⚡ | tests/test_robustness_fixes.py | 69 | # ============================================================================= | COMMENT |
| MEDIUM⚡ | tests/test_mcp_tool_retrieval.py | 66 | # -------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_mcp_tool_retrieval.py | 68 | # -------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_mcp_tool_retrieval.py | 107 | # -------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_mcp_tool_retrieval.py | 109 | # -------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_mcp_tool_retrieval.py | 125 | # -------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_mcp_tool_retrieval.py | 127 | # -------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_mcp_tool_retrieval.py | 167 | # -------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_mcp_tool_retrieval.py | 169 | # -------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_evolution.py | 93 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_evolution.py | 95 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_evolution.py | 28 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_evolution.py | 30 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_evolution.py | 179 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_evolution.py | 181 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_evolution.py | 554 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_evolution.py | 556 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_evolution.py | 680 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_evolution.py | 682 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | agent/tools/tool_manager.py | 624 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | agent/tools/tool_manager.py | 631 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | agent/tools/web_search/web_search.py | 153 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | agent/tools/web_search/web_search.py | 155 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | agent/tools/web_search/web_search.py | 193 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | agent/tools/web_search/web_search.py | 195 | # ------------------------------------------------------------------ | COMMENT |
| 271 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | config.py | 312 | except Exception as e: | CODE |
| LOW | config.py | 334 | except Exception as e: | CODE |
| LOW | config.py | 345 | except Exception as e: | CODE |
| LOW | config.py | 383 | except Exception as e: | CODE |
| LOW | config.py | 442 | except Exception: | CODE |
| LOW | config.py | 580 | except Exception: | CODE |
| MEDIUM | config.py | 327 | def load_user_datas(self): | CODE |
| MEDIUM | config.py | 338 | def save_user_datas(self): | CODE |
| MEDIUM | config.py | 374 | def drag_sensitive(config): | CODE |
| LOW | app.py | 108 | except Exception: | CODE |
| LOW | app.py | 133 | except Exception as e: | CODE |
| LOW | app.py | 165 | except Exception as e: | CODE |
| LOW | app.py | 193 | except Exception as e: | CODE |
| LOW | app.py | 277 | except Exception as e: | CODE |
| LOW | app.py | 304 | except Exception as e: | CODE |
| LOW | app.py | 314 | except Exception as e: | CODE |
| LOW | app.py | 343 | except Exception as e: | CODE |
| LOW | app.py | 347 | except Exception as e: | CODE |
| LOW | app.py | 402 | except Exception as e: | CODE |
| LOW | plugins/plugin.py | 43 | except Exception as e: | CODE |
| LOW | plugins/plugin_manager.py | 111 | except Exception as e: | CODE |
| LOW | plugins/plugin_manager.py | 139 | except Exception as e: | CODE |
| LOW | plugins/plugin_manager.py | 176 | except Exception as e: | CODE |
| LOW | plugins/plugin_manager.py | 300 | except Exception as e: | CODE |
| LOW⚡ | plugins/plugin_manager.py | 322 | except Exception as e: | CODE |
| LOW⚡ | plugins/plugin_manager.py | 332 | except Exception as e: | CODE |
| LOW⚡ | plugins/plugin_manager.py | 341 | except Exception as e: | CODE |
| LOW | plugins/plugin_manager.py | 367 | except Exception as e: | CODE |
| LOW | plugins/plugin_manager.py | 391 | except Exception as e: | CODE |
| LOW | plugins/role/role.py | 78 | except Exception as e: | CODE |
| LOW | plugins/role/role.py | 103 | except Exception as e: | CODE |
| LOW | plugins/linkai/linkai.py | 296 | except Exception as e: | CODE |
| LOW | plugins/linkai/midjourney.py | 293 | except Exception as e: | CODE |
| LOW | plugins/linkai/midjourney.py | 437 | except Exception as e: | CODE |
| LOW | plugins/linkai/utils.py | 49 | except Exception as e: | CODE |
| MEDIUM | plugins/cow_cli/cow_cli.py | 1285 | def _run(): | CODE |
| MEDIUM | plugins/cow_cli/cow_cli.py | 1460 | def _run(): | CODE |
| LOW⚡ | plugins/cow_cli/cow_cli.py | 338 | except Exception as e: | CODE |
| LOW | plugins/cow_cli/cow_cli.py | 99 | except Exception as e: | CODE |
| LOW | plugins/cow_cli/cow_cli.py | 430 | except Exception: | CODE |
| LOW | plugins/cow_cli/cow_cli.py | 515 | except Exception as e: | CODE |
| LOW | plugins/cow_cli/cow_cli.py | 702 | except Exception as e: | CODE |
| LOW | plugins/cow_cli/cow_cli.py | 723 | except Exception as e: | CODE |
| LOW | plugins/cow_cli/cow_cli.py | 784 | except Exception as e: | CODE |
| LOW | plugins/cow_cli/cow_cli.py | 875 | except Exception as e: | CODE |
| LOW | plugins/cow_cli/cow_cli.py | 956 | except Exception as e: | CODE |
| LOW | plugins/cow_cli/cow_cli.py | 1001 | except Exception as e: | CODE |
| LOW | plugins/cow_cli/cow_cli.py | 1049 | except Exception as e: | CODE |
| LOW | plugins/cow_cli/cow_cli.py | 1102 | except Exception: | CODE |
| LOW | plugins/cow_cli/cow_cli.py | 1207 | except Exception as e: | CODE |
| LOW | plugins/cow_cli/cow_cli.py | 1272 | except Exception as e: | CODE |
| LOW | plugins/cow_cli/cow_cli.py | 1292 | except Exception as e: | CODE |
| LOW | plugins/cow_cli/cow_cli.py | 1309 | except Exception as e: | CODE |
| LOW | plugins/cow_cli/cow_cli.py | 1437 | except Exception as e: | CODE |
| LOW | plugins/cow_cli/cow_cli.py | 1479 | except Exception as e: | CODE |
| LOW | plugins/cow_cli/cow_cli.py | 1497 | except Exception as e: | CODE |
| LOW | plugins/cow_cli/cow_cli.py | 1525 | except Exception as e: | CODE |
| LOW | plugins/cow_cli/cow_cli.py | 1534 | except Exception: | CODE |
| LOW | plugins/cow_cli/cow_cli.py | 1550 | except Exception: | CODE |
| LOW | plugins/cow_cli/cow_cli.py | 1645 | except Exception as e: | CODE |
| 836 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | config.py | 359 | def _mask_sensitive_recursive(obj): | CODE |
| LOW | config.py | 623 | def _sync_skill_config_to_env(skill_section) -> int: | CODE |
| LOW | config.py | 702 | def get_weixin_credentials_path(): | CODE |
| LOW | plugins/plugin_manager.py | 213 | def _apply_desktop_plugin_denylist(self): | CODE |
| LOW | plugins/cow_cli/cow_cli.py | 732 | def _resolve_bot_type_for_model(model_name: str) -> str: | CODE |
| LOW | plugins/cow_cli/cow_cli.py | 1314 | def _resolve_active_embedding(): | CODE |
| LOW | plugins/cow_cli/cow_cli.py | 1600 | def _create_standalone_flush_manager(): | CODE |
| LOW | bridge/agent_bridge.py | 21 | def add_openai_compatible_support(bot_instance): | CODE |
| LOW | bridge/agent_bridge.py | 395 | def sync_session_messages_from_store(self, session_id: str) -> int: | CODE |
| LOW | bridge/agent_bridge.py | 799 | def _pre_persist_user_message( | CODE |
| LOW | bridge/agent_bridge.py | 884 | def remember_scheduled_output( | CODE |
| LOW | bridge/agent_bridge.py | 1016 | def _prune_scheduled_in_memory(cls, agent, keep_last_n: int) -> None: | CODE |
| LOW | bridge/agent_bridge.py | 1156 | def _refresh_conditional_tools(agent): | CODE |
| LOW⚡ | bridge/agent_initializer.py | 453 | def _initialize_skill_manager(self, workspace_root: str, session_id: Optional[str] = None): | CODE |
| LOW | bridge/agent_initializer.py | 129 | def _restore_conversation_history(self, agent, session_id: str) -> None: | CODE |
| LOW | bridge/agent_initializer.py | 178 | def _filter_text_only_messages(messages: list) -> list: | CODE |
| LOW | bridge/agent_event_handler.py | 83 | def _handle_tool_execution_start(self, data): | CODE |
| LOW | bridge/agent_event_handler.py | 86 | def _handle_tool_execution_end(self, data): | CODE |
| LOW | tests/test_custom_provider.py | 70 | def test_legacy_fallback_when_no_providers(self): | CODE |
| LOW | tests/test_custom_provider.py | 87 | def test_provider_selected_by_id(self): | CODE |
| LOW | tests/test_custom_provider.py | 102 | def test_id_not_found_falls_back_to_legacy(self): | CODE |
| LOW | tests/test_custom_provider.py | 117 | def test_provider_without_model_returns_none_model(self): | CODE |
| LOW | tests/test_custom_provider.py | 131 | def test_malformed_entries_filtered_and_fallback(self): | CODE |
| LOW | tests/test_custom_provider.py | 147 | def test_get_custom_providers_filters_invalid(self): | CODE |
| LOW | tests/test_custom_provider.py | 160 | def test_custom_providers_not_a_list_falls_back(self): | CODE |
| LOW⚡ | tests/test_custom_provider.py | 192 | def test_default_config_has_custom_providers(self): | CODE |
| LOW⚡ | tests/test_custom_provider.py | 197 | def test_default_config_no_custom_active_provider(self): | CODE |
| LOW⚡ | tests/test_custom_provider.py | 206 | def test_nested_api_key_masked(self): | CODE |
| LOW | tests/test_custom_provider.py | 225 | def test_string_config_masked(self): | CODE |
| LOW | tests/test_invariant_bash.py | 11 | def test_credential_file_access_is_blocked(command): | CODE |
| LOW | tests/test_invariant_bash.py | 22 | def test_legitimate_cow_directory_access_is_not_blocked(command): | CODE |
| LOW | tests/test_security_ssrf_path_traversal.py | 52 | def test_loopback_localhost_blocked(self): | CODE |
| LOW⚡ | tests/test_security_ssrf_path_traversal.py | 117 | def test_no_hostname_rejected(self): | CODE |
| LOW⚡ | tests/test_security_ssrf_path_traversal.py | 123 | def test_non_http_scheme_rejected(self): | CODE |
| LOW⚡ | tests/test_security_ssrf_path_traversal.py | 129 | def test_dns_failure_rejected(self): | CODE |
| LOW⚡ | tests/test_security_ssrf_path_traversal.py | 163 | def test_dotdot_traversal_blocked(self): | CODE |
| LOW⚡ | tests/test_security_ssrf_path_traversal.py | 169 | def test_nested_dotdot_blocked(self): | CODE |
| LOW⚡ | tests/test_security_ssrf_path_traversal.py | 175 | def test_absolute_path_blocked(self): | CODE |
| LOW⚡ | tests/test_security_ssrf_path_traversal.py | 181 | def test_backslash_path_blocked(self): | CODE |
| LOW | tests/test_security_ssrf_path_traversal.py | 192 | def test_whitespace_only_blocked(self): | CODE |
| LOW⚡ | tests/test_qianfan_provider.py | 365 | def test_web_console_registers_qianfan_provider(self): | CODE |
| LOW⚡ | tests/test_qianfan_provider.py | 374 | def test_web_console_allows_qianfan_config_edits(self): | CODE |
| LOW⚡ | tests/test_qianfan_provider.py | 380 | def test_session_plugins_allow_qianfan(self): | CODE |
| LOW⚡ | tests/test_qianfan_provider.py | 581 | def test_model_indexes_link_qianfan(self): | CODE |
| LOW⚡ | tests/test_qianfan_provider.py | 590 | def test_readme_documents_native_qianfan_provider(self): | CODE |
| LOW⚡ | tests/test_qianfan_provider.py | 597 | def test_vision_docs_document_qianfan_provider(self): | CODE |
| LOW | tests/test_qianfan_provider.py | 11 | def test_qianfan_provider_constant_defined(self): | CODE |
| LOW | tests/test_qianfan_provider.py | 16 | def test_ernie_constants_are_in_model_list(self): | CODE |
| LOW | tests/test_qianfan_provider.py | 46 | def test_qianfan_config_keys_are_available(self): | CODE |
| LOW | tests/test_qianfan_provider.py | 52 | def test_agent_bridge_routes_ernie_models_to_qianfan(self): | CODE |
| LOW | tests/test_qianfan_provider.py | 74 | def test_cow_cli_routes_ernie_models_to_qianfan(self): | CODE |
| LOW | tests/test_qianfan_provider.py | 142 | def test_bot_factory_returns_qianfan_bot(self): | CODE |
| LOW | tests/test_qianfan_provider.py | 154 | def test_default_model_uses_ernie_when_model_is_provider_alias(self): | CODE |
| LOW | tests/test_qianfan_provider.py | 164 | def test_reply_text_posts_openai_compatible_payload(self): | CODE |
| LOW | tests/test_qianfan_provider.py | 214 | def test_reply_text_returns_raw_message_for_non_json_error(self): | CODE |
| LOW | tests/test_qianfan_provider.py | 235 | def test_qianfan_bot_supports_vision_for_multimodal_models(self): | CODE |
| LOW | tests/test_qianfan_provider.py | 248 | def test_qianfan_bot_does_not_advertise_vision_for_text_only_models(self): | CODE |
| LOW | tests/test_qianfan_provider.py | 261 | def test_call_vision_posts_openai_compatible_multimodal_payload(self): | CODE |
| LOW | tests/test_qianfan_provider.py | 310 | def test_call_vision_allows_explicit_model_override(self): | CODE |
| LOW | tests/test_qianfan_provider.py | 337 | def test_call_vision_returns_error_dict_for_api_error(self): | CODE |
| 286 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | config.py | 389 | CODE | |
| LOW | config.py | 585 | CODE | |
| LOW | app.py | 237 | CODE | |
| LOW | app.py | 318 | CODE | |
| LOW | app.py | 65 | CODE | |
| LOW | app.py | 137 | CODE | |
| LOW | plugins/plugin_manager.py | 114 | CODE | |
| LOW | plugins/plugin_manager.py | 167 | CODE | |
| LOW | plugins/plugin_manager.py | 238 | CODE | |
| LOW | plugins/plugin_manager.py | 295 | CODE | |
| LOW | plugins/role/role.py | 44 | CODE | |
| LOW | plugins/role/role.py | 85 | CODE | |
| LOW | plugins/role/role.py | 106 | CODE | |
| LOW | plugins/role/role.py | 127 | CODE | |
| LOW | plugins/linkai/midjourney.py | 81 | CODE | |
| LOW | plugins/linkai/midjourney.py | 106 | CODE | |
| LOW | plugins/linkai/midjourney.py | 270 | CODE | |
| LOW | plugins/linkai/utils.py | 33 | CODE | |
| LOW | plugins/dungeon/dungeon.py | 64 | CODE | |
| LOW | plugins/cow_cli/cow_cli.py | 824 | CODE | |
| LOW | plugins/cow_cli/cow_cli.py | 878 | CODE | |
| LOW | plugins/cow_cli/cow_cli.py | 1226 | CODE | |
| LOW | plugins/godcmd/godcmd.py | 214 | CODE | |
| LOW | plugins/banwords/banwords.py | 24 | CODE | |
| LOW | plugins/banwords/lib/WordsSearch.py | 78 | CODE | |
| LOW | plugins/banwords/lib/WordsSearch.py | 186 | CODE | |
| LOW | plugins/banwords/lib/WordsSearch.py | 229 | CODE | |
| LOW | plugins/keyword/keyword.py | 47 | CODE | |
| LOW | plugins/tool/tool.py | 49 | CODE | |
| LOW | bridge/agent_bridge.py | 139 | CODE | |
| LOW | bridge/agent_bridge.py | 199 | CODE | |
| LOW | bridge/agent_bridge.py | 306 | CODE | |
| LOW | bridge/agent_bridge.py | 437 | CODE | |
| LOW | bridge/agent_bridge.py | 729 | CODE | |
| LOW | bridge/agent_bridge.py | 1016 | CODE | |
| LOW | bridge/agent_bridge.py | 1026 | CODE | |
| LOW | bridge/agent_initializer.py | 129 | CODE | |
| LOW | bridge/agent_initializer.py | 178 | CODE | |
| LOW | bridge/agent_initializer.py | 333 | CODE | |
| LOW | bridge/agent_initializer.py | 407 | CODE | |
| LOW | bridge/agent_initializer.py | 513 | CODE | |
| LOW | bridge/agent_initializer.py | 609 | CODE | |
| LOW | bridge/agent_event_handler.py | 35 | CODE | |
| LOW | bridge/bridge.py | 134 | CODE | |
| LOW | tests/test_models_handler.py | 32 | CODE | |
| LOW | tests/test_models_handler.py | 57 | CODE | |
| LOW | tests/test_evolution.py | 557 | CODE | |
| LOW | tests/test_evolution.py | 718 | CODE | |
| LOW | agent/tools/tool_manager.py | 106 | CODE | |
| LOW | agent/tools/tool_manager.py | 183 | CODE | |
| LOW | agent/tools/tool_manager.py | 244 | CODE | |
| LOW | agent/tools/tool_manager.py | 460 | CODE | |
| LOW | agent/tools/web_fetch/web_fetch.py | 198 | CODE | |
| LOW | agent/tools/web_fetch/web_fetch.py | 267 | CODE | |
| LOW | agent/tools/web_fetch/web_fetch.py | 346 | CODE | |
| LOW | agent/tools/web_search/web_search.py | 431 | CODE | |
| LOW | agent/tools/read/read.py | 260 | CODE | |
| LOW | agent/tools/read/read.py | 444 | CODE | |
| LOW | agent/tools/scheduler/task_store.py | 59 | CODE | |
| LOW | agent/tools/scheduler/integration.py | 21 | CODE | |
| 253 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | config.py | 4 | CODE | |
| LOW | app.py | 12 | CODE | |
| LOW | plugins/__init__.py | 1 | CODE | |
| LOW | plugins/__init__.py | 2 | CODE | |
| LOW | plugins/plugin.py | 3 | CODE | |
| LOW | plugins/plugin_manager.py | 12 | CODE | |
| LOW | plugins/plugin_manager.py | 14 | CODE | |
| LOW | plugins/role/__init__.py | 1 | CODE | |
| LOW | plugins/role/role.py | 13 | CODE | |
| LOW | plugins/linkai/__init__.py | 1 | CODE | |
| LOW | plugins/linkai/linkai.py | 4 | CODE | |
| LOW | plugins/linkai/linkai.py | 12 | CODE | |
| LOW | plugins/dungeon/dungeon.py | 11 | CODE | |
| LOW | plugins/dungeon/__init__.py | 1 | CODE | |
| LOW | plugins/finish/__init__.py | 1 | CODE | |
| LOW | plugins/finish/finish.py | 8 | CODE | |
| LOW | plugins/cow_cli/__init__.py | 1 | CODE | |
| LOW | plugins/godcmd/godcmd.py | 10 | CODE | |
| LOW | plugins/godcmd/godcmd.py | 17 | CODE | |
| LOW | plugins/godcmd/__init__.py | 1 | CODE | |
| LOW | plugins/hello/hello.py | 8 | CODE | |
| LOW | plugins/hello/__init__.py | 1 | CODE | |
| LOW | plugins/banwords/banwords.py | 10 | CODE | |
| LOW | plugins/banwords/__init__.py | 1 | CODE | |
| LOW | plugins/keyword/__init__.py | 1 | CODE | |
| LOW | plugins/keyword/keyword.py | 10 | CODE | |
| LOW | plugins/tool/tool.py | 10 | CODE | |
| LOW | plugins/tool/tool.py | 11 | CODE | |
| LOW | tests/test_robustness_fixes.py | 13 | CODE | |
| LOW | tests/test_robustness_fixes.py | 77 | CODE | |
| LOW | tests/test_evolution.py | 559 | CODE | |
| LOW | tests/test_evolution.py | 662 | CODE | |
| LOW | tests/test_minimax_provider.py | 10 | CODE | |
| LOW | tests/test_minimax_provider.py | 12 | CODE | |
| LOW | tests/test_minimax_provider.py | 75 | CODE | |
| LOW | tests/test_knowledge_service.py | 3 | CODE | |
| LOW | agent/tools/tool_manager.py | 5 | CODE | |
| LOW | agent/tools/tool_manager.py | 5 | CODE | |
| LOW | agent/tools/tool_manager.py | 5 | CODE | |
| LOW | agent/tools/__init__.py | 2 | CODE | |
| LOW | agent/tools/__init__.py | 3 | CODE | |
| LOW | agent/tools/__init__.py | 6 | CODE | |
| LOW | agent/tools/__init__.py | 7 | CODE | |
| LOW | agent/tools/__init__.py | 8 | CODE | |
| LOW | agent/tools/__init__.py | 9 | CODE | |
| LOW | agent/tools/__init__.py | 10 | CODE | |
| LOW | agent/tools/__init__.py | 11 | CODE | |
| LOW | agent/tools/__init__.py | 14 | CODE | |
| LOW | agent/tools/__init__.py | 15 | CODE | |
| LOW | agent/tools/__init__.py | 18 | CODE | |
| LOW | agent/tools/base_tool.py | 4 | CODE | |
| LOW | agent/tools/write/write.py | 8 | CODE | |
| LOW | agent/tools/write/__init__.py | 1 | CODE | |
| LOW | agent/tools/web_search/__init__.py | 1 | CODE | |
| LOW | agent/tools/memory/__init__.py | 7 | CODE | |
| LOW | agent/tools/memory/__init__.py | 8 | CODE | |
| LOW | agent/tools/memory/memory_search.py | 7 | CODE | |
| LOW | agent/tools/memory/memory_search.py | 7 | CODE | |
| LOW | agent/tools/read/__init__.py | 1 | CODE | |
| LOW | agent/tools/scheduler/task_store.py | 10 | CODE | |
| 178 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH⚡ | agent/tools/browser/browser_service.py | 123 | return t ? t : null; | CODE |
| HIGH⚡ | agent/tools/browser/browser_service.py | 125 | if (node.nodeType !== Node.ELEMENT_NODE) return null; | CODE |
| HIGH⚡ | agent/tools/browser/browser_service.py | 127 | if (SKIP.has(tag)) return null; | CODE |
| HIGH⚡ | agent/tools/browser/browser_service.py | 128 | if (!visible(node)) return null; | CODE |
| HIGH⚡ | agent/tools/browser/browser_service.py | 133 | if (r !== null) { | CODE |
| HIGH⚡ | agent/tools/browser/browser_service.py | 134 | if (typeof r === "string") children.push(r); | CODE |
| HIGH⚡ | agent/tools/browser/browser_service.py | 135 | else children.push(r); | CODE |
| HIGH⚡ | agent/tools/browser/browser_service.py | 144 | if (children.length === 0) return null; | CODE |
| HIGH⚡ | agent/tools/browser/browser_service.py | 150 | if (nativeInteractive || implicitInteractive) { | CODE |
| HIGH⚡ | agent/tools/browser/browser_service.py | 160 | if (!directText && children.length === 0) { | CODE |
| HIGH⚡ | agent/tools/browser/browser_service.py | 176 | obj.name = node.name || undefined; | CODE |
| HIGH⚡ | agent/tools/browser/browser_service.py | 176 | obj.name = node.name || undefined; | CODE |
| HIGH⚡ | agent/tools/browser/browser_service.py | 177 | obj.value = node.value || undefined; | CODE |
| HIGH⚡ | agent/tools/browser/browser_service.py | 177 | obj.value = node.value || undefined; | CODE |
| HIGH⚡ | agent/tools/browser/browser_service.py | 178 | obj.placeholder = node.placeholder || undefined; | CODE |
| HIGH⚡ | agent/tools/browser/browser_service.py | 178 | obj.placeholder = node.placeholder || undefined; | CODE |
| HIGH | agent/tools/browser/browser_service.py | 71 | if (role && CLICKABLE_ROLES.has(role)) return true; | CODE |
| HIGH | agent/tools/browser/browser_service.py | 98 | if (ariaLabel && ariaLabel.trim()) return true; | CODE |
| HIGH | agent/tools/browser/browser_service.py | 100 | if (title && title.trim()) return true; | CODE |
| HIGH | agent/tools/browser/browser_service.py | 200 | if (children.length === 1 && typeof children[0] === "string") { | CODE |
| HIGH | agent/tools/browser/browser_service.py | 761 | const el = window.__cowRefMap && window.__cowRefMap[{ref}]; | CODE |
| HIGH | agent/tools/browser/browser_service.py | 789 | const el = window.__cowRefMap && window.__cowRefMap[{ref}]; | CODE |
| HIGH | agent/tools/browser/browser_service.py | 818 | const el = window.__cowRefMap && window.__cowRefMap[{ref}]; | CODE |
| HIGH | agent/tools/browser/browser_service.py | 819 | if (!el || el.tagName.toLowerCase() !== "select") | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | agent/tools/write/write.py | 0 | resolve path to absolute path :param path: relative or absolute path :return: absolute path | STRING |
| HIGH | agent/tools/read/read.py | 0 | resolve path to absolute path :param path: relative or absolute path :return: absolute path | STRING |
| HIGH | agent/tools/edit/edit.py | 0 | resolve path to absolute path :param path: relative or absolute path :return: absolute path | STRING |
| HIGH | models/openai_compatible_bot.py | 0 | convert tools from claude format to dashscope format claude format: {name, description, input_schema} dashscope format: | STRING |
| HIGH | models/zhipuai/zhipuai_bot.py | 0 | convert tools from claude format to dashscope format claude format: {name, description, input_schema} dashscope format: | STRING |
| HIGH | models/dashscope/dashscope_bot.py | 0 | convert tools from claude format to dashscope format claude format: {name, description, input_schema} dashscope format: | STRING |
| HIGH | models/moonshot/moonshot_bot.py | 0 | convert tools from claude format to openai format. claude: {name, description, input_schema} openai: {type: "function", | STRING |
| HIGH | models/doubao/doubao_bot.py | 0 | convert tools from claude format to openai format. claude: {name, description, input_schema} openai: {type: "function", | STRING |
| HIGH | models/deepseek/deepseek_bot.py | 0 | convert tools from claude format to openai format. claude: {name, description, input_schema} openai: {type: "function", | STRING |
| HIGH | models/baidu/baidu_wenxin_session.py | 0 | returns the number of tokens used by a list of messages. | STRING |
| HIGH | models/minimax/minimax_session.py | 0 | returns the number of tokens used by a list of messages. | STRING |
| HIGH | models/chatgpt/chat_gpt_session.py | 0 | returns the number of tokens used by a list of messages. | STRING |
| HIGH | models/linkai/link_ai_bot.py | 0 | get api configuration for openai-compatible base class | STRING |
| HIGH | models/chatgpt/chat_gpt_bot.py | 0 | get api configuration for openai-compatible base class | STRING |
| HIGH | models/openai/open_ai_bot.py | 0 | get api configuration for openai-compatible base class | STRING |
| HIGH | channel/discord/discord_channel.py | 0 | fast-path: /cancel calls cancel_session directly without going through agent. | STRING |
| HIGH | channel/telegram/telegram_channel.py | 0 | fast-path: /cancel calls cancel_session directly without going through agent. | STRING |
| HIGH | channel/slack/slack_channel.py | 0 | fast-path: /cancel calls cancel_session directly without going through agent. | STRING |
| HIGH | channel/discord/discord_channel.py | 0 | split long text preferring line breaks to keep markdown structure intact. | STRING |
| HIGH | channel/telegram/telegram_channel.py | 0 | split long text preferring line breaks to keep markdown structure intact. | STRING |
| HIGH | channel/slack/slack_channel.py | 0 | split long text preferring line breaks to keep markdown structure intact. | STRING |
| HIGH | channel/discord/discord_message.py | 0 | local download directory, aligned with other channels (agent_workspace/tmp). | STRING |
| HIGH | channel/telegram/telegram_message.py | 0 | local download directory, aligned with other channels (agent_workspace/tmp). | STRING |
| HIGH | channel/slack/slack_message.py | 0 | local download directory, aligned with other channels (agent_workspace/tmp). | STRING |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | run.sh | 25 | # Check if using Bash | COMMENT |
| LOW | run.sh | 1034 | # Check if service is running | COMMENT |
| LOW | run.sh | 1039 | # Check if cow CLI is available | COMMENT |
| LOW | bridge/agent_bridge.py | 379 | # Check if agent exists for this session | COMMENT |
| LOW | bridge/agent_bridge.py | 610 | # Check if there are files to send (from send/read tool) | COMMENT |
| LOW | agent/tools/tool_manager.py | 116 | # Check if __all__ is defined | COMMENT |
| LOW | agent/tools/write/write.py | 62 | # Write file | COMMENT |
| LOW | agent/tools/read/read.py | 96 | # Check if file exists | COMMENT |
| LOW⚡ | agent/tools/read/read.py | 107 | # Check if readable | COMMENT |
| LOW⚡ | agent/tools/read/read.py | 115 | # Check if image - return metadata for sending | COMMENT |
| LOW⚡ | agent/tools/read/read.py | 119 | # Check if video/audio/binary/archive - return metadata only | COMMENT |
| LOW⚡ | agent/tools/read/read.py | 127 | # Check if PDF | COMMENT |
| LOW⚡ | agent/tools/read/read.py | 131 | # Check if Office document (.docx, .xlsx, .pptx, etc.) | COMMENT |
| LOW | agent/tools/read/read.py | 286 | # Read file (utf-8-sig strips BOM automatically on Windows) | COMMENT |
| LOW | agent/tools/scheduler/scheduler_tool.py | 340 | # Check if it's relative time (e.g., "+5s", "+10m", "+1h", "+1d") | COMMENT |
| LOW | agent/tools/utils/truncate.py | 100 | # Check if no truncation is needed | COMMENT |
| LOW | agent/tools/utils/truncate.py | 116 | # Check if first line alone exceeds byte limit | COMMENT |
| LOW | agent/tools/utils/truncate.py | 195 | # Check if no truncation is needed | COMMENT |
| LOW | agent/tools/bash/bash.py | 200 | # Check if we need to save full output to temp file | STRING |
| LOW⚡ | agent/tools/edit/edit.py | 69 | # Check if file exists | COMMENT |
| LOW⚡ | agent/tools/edit/edit.py | 73 | # Check if readable/writable | COMMENT |
| LOW⚡ | agent/tools/edit/edit.py | 78 | # Read file | COMMENT |
| LOW | agent/tools/edit/edit.py | 143 | # Write file | COMMENT |
| LOW | agent/tools/send/send.py | 65 | # Check if file exists | COMMENT |
| LOW | agent/tools/send/send.py | 69 | # Check if readable | COMMENT |
| LOW | agent/memory/chunker.py | 85 | # Check if adding this line would exceed limit | COMMENT |
| LOW | agent/protocol/agent_stream.py | 521 | # Check if this is a file to send | COMMENT |
| LOW | agent/protocol/agent_stream.py | 915 | # Check if this is a context overflow error (keyword-based, works for all models) | COMMENT |
| LOW | agent/protocol/agent_stream.py | 993 | # Check if error is context overflow (non-retryable, needs session reset) | COMMENT |
| LOW | agent/protocol/agent_stream.py | 1005 | # Check if error is message format error (incomplete tool_use/tool_result pairs) | COMMENT |
| LOW | agent/protocol/agent_stream.py | 1061 | # Check if error is rate limit (429) | COMMENT |
| LOW | agent/protocol/agent_stream.py | 1064 | # Check if error is retryable (timeout, connection, server busy, etc.) | COMMENT |
| LOW | agent/prompt/workspace.py | 45 | # Check if this is a brand new workspace (AGENT.md not yet created). | COMMENT |
| LOW | agent/skills/config.py | 201 | # Check if value is truthy | COMMENT |
| LOW | models/openai_compatible_bot.py | 264 | # Check if already in OpenAI format | COMMENT |
| LOW | models/openai_compatible_bot.py | 328 | # Check if this is a tool result message (user role with tool_result blocks) | COMMENT |
| LOW | models/openai_compatible_bot.py | 362 | # Check if this is an assistant message with tool_use blocks | COMMENT |
| LOW | models/zhipuai/zhipuai_bot.py | 396 | # Check if already in ZhipuAI/OpenAI format | COMMENT |
| LOW | models/zhipuai/zhipuai_bot.py | 435 | # Check if this is a tool result message (user role with tool_result blocks) | COMMENT |
| LOW | models/zhipuai/zhipuai_bot.py | 446 | # Check if this is an assistant message with tool_use blocks | COMMENT |
| LOW | models/dashscope/dashscope_bot.py | 533 | # Check if already in DashScope/OpenAI format | COMMENT |
| LOW | models/dashscope/dashscope_bot.py | 603 | # Check if this is a tool result message (user role with tool_result blocks) | COMMENT |
| LOW | models/dashscope/dashscope_bot.py | 614 | # Check if this is an assistant message with tool_use blocks | COMMENT |
| LOW | models/chatgpt/chat_gpt_bot.py | 180 | # Check if file exists | COMMENT |
| LOW | channel/channel.py | 75 | # Check if agent mode is enabled | COMMENT |
| LOW | channel/dingtalk/dingtalk_channel.py | 730 | # Check if msg exists (for scheduled tasks, msg might be None) | COMMENT |
| LOW⚡ | channel/feishu/feishu_channel.py | 1410 | # Check if it's a local file path (file:// protocol) | COMMENT |
| LOW | channel/feishu/feishu_channel.py | 689 | # Check if we can reply to an existing message (need msg_id) | COMMENT |
| LOW | channel/feishu/feishu_channel.py | 1161 | # Check if it's a local file path (file:// protocol) | COMMENT |
| LOW | channel/web/web_channel.py | 1989 | # Check if password was cleared: if there was a password before clearing, | COMMENT |
| LOW | channel/wecom_bot/wecom_bot_channel.py | 453 | # Check if this is a response to a pending request | COMMENT |
| LOW | skills/skill-creator/scripts/init_skill.py | 208 | # Check if directory already exists | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | bridge/agent_bridge.py | 35 | # Create a temporary mixin class that combines the bot with OpenAI compatibility | COMMENT |
| MEDIUM⚡ | tests/test_security_ssrf_path_traversal.py | 147 | # Create a minimal SkillManager mock with custom_dir set. | COMMENT |
| MEDIUM | agent/tools/tool_manager.py | 146 | # Create a temporary instance to get the name | COMMENT |
| MEDIUM | agent/tools/tool_manager.py | 217 | # Create a temporary instance to get the name | COMMENT |
| MEDIUM | agent/tools/tool_manager.py | 718 | # Create a new instance | COMMENT |
| MEDIUM | agent/tools/tool_manager.py | 742 | # Create a temporary instance to get schema | COMMENT |
| MEDIUM | agent/tools/scheduler/integration.py | 218 | # Create a unique session_id for this scheduled task to avoid polluting user's conversation | COMMENT |
| MEDIUM | agent/tools/bash/bash.py | 178 | # Create a mock result with helpful error message | STRING |
| MEDIUM | agent/memory/summarizer.py | 817 | # Create main MEMORY.md in workspace root (always needed for bootstrap) | COMMENT |
| MEDIUM | agent/chat/service.py | 177 | # Create a copy of messages for this execution | COMMENT |
| MEDIUM | agent/protocol/agent.py | 430 | # Create a copy of messages for this execution to avoid concurrent modification | COMMENT |
| MEDIUM⚡ | agent/prompt/workspace.py | 60 | # Create the memory subdirectory | COMMENT |
| MEDIUM⚡ | agent/prompt/workspace.py | 63 | # Create the skills subdirectory (for workspace-level skills installed by agent) | COMMENT |
| MEDIUM⚡ | agent/prompt/workspace.py | 67 | # Create the websites subdirectory (for web pages / sites generated by agent) | COMMENT |
| MEDIUM | channel/web/web_channel.py | 3233 | # Creating a new provider — api_base is mandatory. | COMMENT |
| MEDIUM | channel/wechatmp/passive_reply.py | 18 | # This class is instantiated once per query | COMMENT |
| MEDIUM | channel/wechatmp/active_reply.py | 16 | # This class is instantiated once per query | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | bridge/bridge.py | 121 | return v != "" and v not in ("YOUR API KEY", "YOUR_API_KEY") | CODE |
| HIGH | agent/memory/embedding/provider.py | 219 | if not self.api_key or self.api_key in ["", "YOUR API KEY", "YOUR_API_KEY"]: | CODE |
| HIGH | agent/memory/embedding/provider.py | 337 | if not self.api_key or self.api_key in ["", "YOUR API KEY", "YOUR_API_KEY"]: | CODE |
| HIGH⚡ | agent/memory/embedding/factory.py | 45 | if openai_api_key and openai_api_key not in ["", "YOUR API KEY", "YOUR_API_KEY"]: | CODE |
| HIGH⚡ | agent/memory/embedding/factory.py | 61 | if linkai_api_key and linkai_api_key not in ["", "YOUR API KEY", "YOUR_API_KEY"]: | CODE |
| HIGH | agent/memory/embedding/factory.py | 170 | if value in ["", "YOUR API KEY", "YOUR_API_KEY"]: | CODE |
| HIGH | channel/web/web_channel.py | 650 | if val and val not in ("YOUR API KEY", "YOUR_API_KEY"): | CODE |
| HIGH | channel/web/web_channel.py | 2442 | return bool(value) and value not in ("", "YOUR API KEY", "YOUR_API_KEY") | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | run.sh | 1260 | # Step 0: choose the install/UI language. Everything after this is localized. | COMMENT |
| LOW | agent/tools/vision/vision.py | 237 | # Step 1: preferred provider — explicit `tools.vision.provider` | COMMENT |
| LOW | agent/tools/vision/vision.py | 248 | # Step 2: auto-discovery chain as fallback | COMMENT |
| LOW | agent/memory/storage.py | 658 | # Step 1: Standard FTS5 (unicode61) — pure ASCII queries only. | STRING |
| LOW⚡ | agent/memory/storage.py | 673 | # Step 2: Trigram FTS5 — CJK/mixed queries, plus fallback when unicode61 | STRING |
| LOW⚡ | agent/memory/storage.py | 683 | # Step 3: LIKE fallback — last resort (FTS5 unavailable, or CJK tokens | STRING |
| LOW⚡ | agent/protocol/agent_stream.py | 197 | # Step 2: append a stable "interrupted" marker so the LLM sees a | COMMENT |
| LOW⚡ | agent/protocol/agent_stream.py | 1631 | # Step 0: Truncate large tool results in historical turns (30K -> 10K) | COMMENT |
| LOW⚡ | agent/protocol/agent_stream.py | 1634 | # Step 1: 识别完整轮次 | COMMENT |
| LOW⚡ | agent/protocol/agent_stream.py | 1640 | # Step 2: 轮次限制 - 超出时移除前一半,保留后一半 | COMMENT |
| LOW⚡ | agent/protocol/agent_stream.py | 1667 | # Step 3: Token 限制 - 保留完整轮次 | COMMENT |
| LOW | agent/protocol/agent_stream.py | 165 | # Step 1: close any orphaned tool_use in the trailing assistant | COMMENT |
| LOW | agent/protocol/agent_stream.py | 1484 | # Step 1: Aggressively truncate ALL tool results to 5K chars | COMMENT |
| LOW | agent/protocol/agent_stream.py | 1517 | # Step 2: Truncate overly long user text messages (e.g. pasted content) | COMMENT |
| LOW | agent/protocol/agent_stream.py | 1542 | # Step 3: Keep only the last 5 complete turns | COMMENT |
| LOW⚡ | channel/web/static/js/console.js | 1210 | // Step 1: replace markdown-it anchor tags whose href points to a video file. | COMMENT |
| LOW⚡ | channel/web/static/js/console.js | 1215 | // Step 2: replace any remaining bare video URLs in text nodes (not inside HTML tags). | COMMENT |
| LOW⚡ | channel/web/static/js/console.js | 1233 | // Step 1: anchor whose href points to an image file -> replace with <img> preview. | COMMENT |
| LOW⚡ | channel/web/static/js/console.js | 1238 | // Step 2: bare image URLs left in text nodes (rare — markdown-it's linkify usually catches them). | COMMENT |
| LOW | skills/skill-creator/SKILL.md | 135 | ### Step 1: Understanding the Skill with Concrete Examples | COMMENT |
| LOW | skills/skill-creator/SKILL.md | 152 | ### Step 2: Planning the Reusable Skill Contents | COMMENT |
| LOW | skills/skill-creator/SKILL.md | 185 | ### Step 3: Initialize the Skill | COMMENT |
| LOW | skills/skill-creator/SKILL.md | 220 | ### Step 4: Edit the Skill | COMMENT |
| LOW | skills/skill-creator/SKILL.md | 370 | ### Step 5: Validate (Optional) | COMMENT |
| LOW | skills/skill-creator/SKILL.md | 392 | ### Step 6: Iterate | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | config.py | 110 | "qwen_node_id": "", # id used by workflow-orchestration models; keep it an empty string if qwen_node_id is unused | CODE |
| MEDIUM | bridge/agent_bridge.py | 173 | # reasoning trace, but still benefit from the higher answer | COMMENT |
| MEDIUM | bridge/agent_bridge.py | 235 | # reasoning trace, but still benefit from the higher answer | COMMENT |
| MEDIUM⚡ | tests/test_evolution.py | 94 | # Test scaffolding | COMMENT |
| MEDIUM | agent/tools/mcp/tool_retrieval.py | 116 | # embedding model; ranking across dims is meaningless. | COMMENT |
| MEDIUM⚡ | agent/memory/embedding/provider.py | 68 | # default_model : default embedding model name | COMMENT |
| MEDIUM | agent/memory/embedding/factory.py | 20 | # Track whether the embedding model log has been printed in this process, | COMMENT |
| MEDIUM⚡ | agent/protocol/agent_stream.py | 1668 | # Get context window from agent (based on model) | COMMENT |
| MEDIUM | agent/protocol/agent.py | 222 | # Reserve ~10% of context window, with min 10K and max 200K | COMMENT |
| MEDIUM | agent/prompt/workspace.py | 158 | # Truncate MEMORY.md to protect context window (frozen snapshot) | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | run.sh | 1260 | # Step 0: choose the install/UI language. Everything after this is localized. | COMMENT |
| LOW | agent/tools/vision/vision.py | 237 | # Step 1: preferred provider — explicit `tools.vision.provider` | COMMENT |
| LOW | agent/tools/vision/vision.py | 248 | # Step 2: auto-discovery chain as fallback | COMMENT |
| LOW | agent/memory/storage.py | 658 | # Step 1: Standard FTS5 (unicode61) — pure ASCII queries only. | STRING |
| LOW⚡ | agent/memory/storage.py | 673 | # Step 2: Trigram FTS5 — CJK/mixed queries, plus fallback when unicode61 | STRING |
| LOW⚡ | agent/memory/storage.py | 683 | # Step 3: LIKE fallback — last resort (FTS5 unavailable, or CJK tokens | STRING |
| LOW⚡ | agent/protocol/agent_stream.py | 197 | # Step 2: append a stable "interrupted" marker so the LLM sees a | COMMENT |
| LOW⚡ | agent/protocol/agent_stream.py | 1631 | # Step 0: Truncate large tool results in historical turns (30K -> 10K) | COMMENT |
| LOW⚡ | agent/protocol/agent_stream.py | 1634 | # Step 1: 识别完整轮次 | COMMENT |
| LOW⚡ | agent/protocol/agent_stream.py | 1640 | # Step 2: 轮次限制 - 超出时移除前一半,保留后一半 | COMMENT |
| LOW⚡ | agent/protocol/agent_stream.py | 1667 | # Step 3: Token 限制 - 保留完整轮次 | COMMENT |
| LOW | agent/protocol/agent_stream.py | 165 | # Step 1: close any orphaned tool_use in the trailing assistant | COMMENT |
| LOW | agent/protocol/agent_stream.py | 1484 | # Step 1: Aggressively truncate ALL tool results to 5K chars | COMMENT |
| LOW | agent/protocol/agent_stream.py | 1517 | # Step 2: Truncate overly long user text messages (e.g. pasted content) | COMMENT |
| LOW | agent/protocol/agent_stream.py | 1542 | # Step 3: Keep only the last 5 complete turns | COMMENT |
| LOW⚡ | channel/web/static/js/console.js | 1210 | // Step 1: replace markdown-it anchor tags whose href points to a video file. | COMMENT |
| LOW⚡ | channel/web/static/js/console.js | 1215 | // Step 2: replace any remaining bare video URLs in text nodes (not inside HTML tags). | COMMENT |
| LOW⚡ | channel/web/static/js/console.js | 1233 | // Step 1: anchor whose href points to an image file -> replace with <img> preview. | COMMENT |
| LOW⚡ | channel/web/static/js/console.js | 1238 | // Step 2: bare image URLs left in text nodes (rare — markdown-it's linkify usually catches them). | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | plugins/banwords/lib/WordsSearch.py | 10 | __all__ = ['WordsSearch'] | CODE |
| LOW | agent/tools/__init__.py | 130 | __all__ = [ | CODE |
| LOW | agent/tools/write/__init__.py | 3 | __all__ = ['Write'] | CODE |
| LOW | agent/tools/web_search/__init__.py | 3 | __all__ = ["WebSearch"] | CODE |
| LOW | agent/tools/memory/__init__.py | 10 | __all__ = ['MemorySearchTool', 'MemoryGetTool'] | CODE |
| LOW | agent/tools/read/__init__.py | 3 | __all__ = ['Read'] | CODE |
| LOW | agent/tools/scheduler/__init__.py | 7 | __all__ = ["SchedulerTool"] | CODE |
| LOW | agent/tools/evolution_undo/__init__.py | 3 | __all__ = ["EvolutionUndoTool"] | CODE |
| LOW | agent/tools/utils/__init__.py | 29 | __all__ = [ | CODE |
| LOW | agent/tools/mcp/__init__.py | 4 | __all__ = ["McpClient", "McpClientRegistry", "McpTool"] | CODE |
| LOW | agent/tools/mcp/mcp_client.py | 30 | def set_reload_callback(fn) -> None: | CODE |
| LOW | agent/tools/bash/__init__.py | 3 | __all__ = ['Bash'] | CODE |
| LOW | agent/tools/edit/__init__.py | 3 | __all__ = ['Edit'] | CODE |
| LOW | agent/tools/browser/__init__.py | 3 | __all__ = ["BrowserTool"] | CODE |
| LOW | agent/tools/env_config/__init__.py | 3 | __all__ = ['EnvConfig'] | CODE |
| LOW | agent/tools/ls/__init__.py | 3 | __all__ = ['Ls'] | CODE |
| LOW | agent/tools/send/__init__.py | 3 | __all__ = ['Send'] | CODE |
| LOW | agent/memory/__init__.py | 14 | __all__ = [ | CODE |
| LOW | agent/memory/embedding/__init__.py | 30 | __all__ = [ | CODE |
| LOW | agent/chat/__init__.py | 3 | __all__ = ["ChatService"] | CODE |
| LOW | agent/protocol/task.py | 88 | def update_status(self, status: TaskStatus) -> None: | CODE |
| LOW | agent/protocol/__init__.py | 12 | __all__ = [ | CODE |
| LOW | agent/prompt/__init__.py | 8 | __all__ = [ | CODE |
| LOW | agent/evolution/__init__.py | 16 | __all__ = [ | CODE |
| LOW | agent/skills/__init__.py | 21 | __all__ = [ | CODE |
| LOW | models/openai/openai_compat.py | 148 | __all__ = [ | CODE |
| LOW | channel/file_cache.py | 8 | logger = logging.getLogger(__name__) | CODE |
| LOW⚡ | channel/weixin/weixin_channel.py | 209 | def _update_context_token(self, user_id: str, token: str) -> None: | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | docker/entrypoint.sh | 1 | #!/bin/bash | COMMENT |
| LOW | plugins/tool/README.md | 121 | ###### 发送短信 | COMMENT |
| LOW | desktop/electron-builder.win.js | 101 | async function customSign(configuration) { | COMMENT |
| LOW | desktop/src/renderer/src/store/onboardingStore.ts | 1 | import { create } from 'zustand' | COMMENT |
| LOW | agent/tools/mcp/mcp_client.py | 101 | # OAuth state (streamable-http only). Lazily created when the server | COMMENT |
| LOW | agent/memory/embedding/provider.py | 61 | # | COMMENT |
| LOW | agent/chat/service.py | 221 | # Sync executor messages back to agent (thread-safe). | COMMENT |
| LOW | agent/protocol/agent_stream.py | 821 | except Exception: | COMMENT |
| LOW | agent/protocol/agent_stream.py | 1701 | # Token limit exceeded — tiered strategy based on turn count: | COMMENT |
| LOW | models/openai/open_ai_bot.py | 161 | # which calls /chat/completions via our shared HTTP client. The previous | COMMENT |
| LOW | models/openai/openai_http_client.py | 341 | # error-shape that `_handle_stream_response` previously emitted. | COMMENT |
| LOW | channel/web/web_channel.py | 2361 | "qianfan": [const.ERNIE_45_TURBO_VL], | COMMENT |
| LOW | channel/web/web_channel.py | 2381 | const.KIMI_K2_6, | COMMENT |
| LOW | channel/web/web_channel.py | 2641 | # Pick a model that the vision runtime can actually dispatch to | COMMENT |
| LOW | channel/web/static/js/console.js | 5221 | overlay.classList.remove('hidden'); | COMMENT |
| LOW | channel/web/static/js/console.js | 6061 | // (see renderCapabilityBody) so the save button stays close to the | COMMENT |
| LOW | channel/web/static/js/console.js | 6141 | } | COMMENT |
| LOW | channel/web/static/js/console.js | 6541 | statusEl.classList.add('opacity-0'); | COMMENT |
| LOW | channel/web/static/js/console.js | 9341 | // to a specific user-session on that channel. Changing the channel to weixin | COMMENT |
| LOW | voice/xunfei/xunfei_tts.py | 1 | # -*- coding:utf-8 -*- | COMMENT |
| LOW | voice/xunfei/xunfei_asr.py | 1 | # -*- coding:utf-8 -*- | COMMENT |
| LOW | voice/xunfei/xunfei_voice.py | 1 | ##################################################################### | COMMENT |
| LOW | voice/xunfei/xunfei_voice.py | 61 | # 识别本地文件 | COMMENT |
| LOW | .github/workflows/release.yml | 1 | name: Release Desktop | COMMENT |
| LOW | .github/workflows/release.yml | 161 | # Pick the signing cert for THIS platform only. The mac and win secrets | COMMENT |
| LOW | .github/workflows/release.yml | 181 | ;; | COMMENT |
| LOW | .github/workflows/release.yml | 321 | run: | | COMMENT |
| LOW | .github/workflows/publish-desktop.yml | 1 | name: Publish Desktop | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | agent/memory/embedding/provider.py | 181 | CODE | |
| LOW | agent/protocol/agent.py | 14 | CODE | |
| LOW | agent/prompt/builder.py | 78 | CODE | |
| LOW | agent/skills/loader.py | 45 | CODE | |
| LOW | models/xunfei/xunfei_spark_bot.py | 269 | CODE | |
| LOW | models/xunfei/xunfei_spark_bot.py | 183 | CODE | |
| LOW | models/openai/openai_http_client.py | 116 | CODE | |
| LOW | voice/ali/ali_api.py | 184 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | agent/memory/manager.py | 215 | # No embeddings, just use None | COMMENT |
| MEDIUM | agent/memory/manager.py | 313 | # on any sibling helpers — keeps it robust against partial reloads | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | agent/tools/browser/browser_service.py | 265 | for attr in ("type", "name", "href", "alt", "role", "ariaLabel", "placeholder", "value"): | CODE |