Open-source personal AI assistant & Agent Harness. Plans tasks, runs tools and skills, self-evolves with memory and knowledge. Multi-agent, multi-model, multi-channel. Lightweight, extensible, one-line install.
This report summarizes scanner evidence for zhayujie/CowAgent, a Python project with 47,322 GitHub stars. SynthScan examined 262,600 lines of code across 1072 source files, recording 6454 pattern matches distributed across 20 syntactic categories. The legacy adjusted pattern signal is 33.9 (High pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Can maintainers explain intent, assumptions, and trade-offs? 3869 finding(s).
Are imports declared and package/API names verified? 459 finding(s).
Are wrappers, guards, and repeated structures necessary? 5377 finding(s).
Which changes need focused human review? 6454 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 6454 distinct pattern matches across 20 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | config.py | 478 | def _quarantine_corrupted_config(config_path): | CODE |
| LOW | config.py | 443 | def _mask_sensitive_recursive(obj): | CODE |
| LOW | config.py | 798 | def _sync_skill_config_to_env(skill_section) -> int: | CODE |
| LOW | config.py | 828 | def sync_image_generation_custom_provider_env( | CODE |
| LOW | config.py | 946 | def get_weixin_credentials_path(instance_id: str = ""): | CODE |
| LOW⚡ | app.py | 748 | def _scaffold_subagent_assets(): | CODE |
| LOW | app.py | 59 | def _resolve_startup_channels(raw_channel): | CODE |
| LOW | app.py | 672 | def _warn_if_legacy_workspace_data_exists(): | CODE |
| LOW | plugins/plugin_manager.py | 283 | def _apply_desktop_plugin_denylist(self): | CODE |
| LOW | plugins/cow_cli/cow_cli.py | 891 | def _resolve_bot_type_for_model(model_name: str) -> str: | CODE |
| LOW | plugins/cow_cli/cow_cli.py | 1529 | def _resolve_active_embedding(): | CODE |
| LOW | plugins/cow_cli/cow_cli.py | 1827 | def _create_standalone_flush_manager(): | CODE |
| LOW | bridge/agent_bridge.py | 31 | def add_openai_compatible_support(bot_instance): | CODE |
| LOW | bridge/agent_bridge.py | 394 | def _normalized_reasoning_effort(self): | CODE |
| LOW | bridge/agent_bridge.py | 1121 | def _strip_speaker_prefix_from_messages(self, messages: list) -> list: | CODE |
| LOW | bridge/agent_bridge.py | 1414 | def clear_all_model_fallbacks(self) -> int: | CODE |
| LOW | bridge/agent_bridge.py | 1443 | def sync_session_messages_from_store( | CODE |
| LOW | bridge/agent_bridge.py | 2055 | def _pre_persist_user_message( | CODE |
| LOW | bridge/agent_bridge.py | 2173 | def remember_scheduled_output( | CODE |
| LOW | bridge/agent_bridge.py | 2307 | def _prune_scheduled_in_memory(cls, agent, keep_last_n: int) -> None: | CODE |
| LOW | bridge/agent_bridge.py | 2471 | def _refresh_conditional_tools(agent): | CODE |
| LOW⚡ | bridge/agent_initializer.py | 1118 | def _initialize_skill_manager(self, workspace_root: str, session_id: Optional[str] = None): | CODE |
| LOW | bridge/agent_initializer.py | 248 | def _restore_conversation_history( | CODE |
| LOW | bridge/agent_initializer.py | 672 | def _filter_text_only_messages(messages: list) -> list: | CODE |
| LOW | bridge/agent_event_handler.py | 83 | def _handle_tool_execution_start(self, data): | CODE |
| LOW | bridge/agent_event_handler.py | 86 | def _handle_tool_execution_end(self, data): | CODE |
| LOW | tests/test_image_generation_custom_provider.py | 43 | def test_sync_selected_custom_image_provider_to_env(monkeypatch): | CODE |
| LOW | tests/test_image_generation_custom_provider.py | 63 | def test_build_providers_uses_explicit_custom_provider(monkeypatch): | CODE |
| LOW | tests/test_image_generation_custom_provider.py | 91 | def test_build_providers_keeps_pinned_model_on_aggregator(monkeypatch): | CODE |
| LOW | tests/test_image_generation_custom_provider.py | 102 | def test_build_providers_drops_model_aggregator_does_not_serve(monkeypatch): | CODE |
| LOW | tests/test_image_generation_custom_provider.py | 112 | def test_build_providers_does_not_fallback_for_missing_custom_provider( | CODE |
| LOW | tests/test_atomic_private_staging.py | 29 | def test_a_private_target_is_staged_privately(tmp_path): | CODE |
| LOW | tests/test_atomic_private_staging.py | 37 | def test_a_new_file_keeps_the_umask_default(tmp_path): | CODE |
| LOW | tests/test_dingtalk_image_caption_once.py | 14 | def test_image_is_sent_without_its_caption_after_the_caption_bubble(): | CODE |
| LOW | tests/test_chunker_budget.py | 13 | def test_chunks_fit_budget_and_keep_source_line_ranges(text): | CODE |
| LOW | tests/test_chunker_budget.py | 27 | def test_overlap_keeps_the_tail_when_it_fits(): | CODE |
| LOW | tests/test_chunker_budget.py | 35 | def test_long_line_fragments_and_neighbor_lines_fit_budget(): | CODE |
| LOW | tests/test_agent_stream_reasoning_field.py | 27 | def _validate_and_fix_messages(self): | CODE |
| LOW | tests/test_agent_stream_reasoning_field.py | 30 | def _catalog_max_output_tokens(self): | CODE |
| LOW | tests/test_agent_stream_reasoning_field.py | 55 | def test_reasoning_field_is_routed_to_the_thinking_channel(): | CODE |
| LOW | tests/test_agent_stream_reasoning_field.py | 79 | def test_reasoning_content_still_wins_over_reasoning(): | CODE |
| LOW | tests/test_agent_stream_reasoning_field.py | 97 | def test_thinking_field_is_also_accepted(): | CODE |
| LOW | tests/test_agent_stream_reasoning_field.py | 112 | def test_list_shaped_reasoning_does_not_crash(): | CODE |
| LOW | tests/test_agent_stream_reasoning_field.py | 130 | def test_non_string_reasoning_is_ignored(): | CODE |
| LOW | tests/test_time_check.py | 16 | def test_default_end_of_day_stop_time_allows_messages(self): | CODE |
| LOW⚡ | tests/test_shared_history_alias.py | 78 | def test_default_agent_is_named_by_alias(svc, monkeypatch, authors, expected): | CODE |
| LOW⚡ | tests/test_shared_history_alias.py | 82 | def test_unreadable_roster_keeps_stored_author(svc, monkeypatch): | CODE |
| LOW⚡ | tests/test_shared_history_alias.py | 92 | def test_single_agent_install_is_unchanged(monkeypatch): | CODE |
| LOW⚡ | tests/test_shared_history_alias.py | 97 | def test_user_turns_carry_no_author(svc, monkeypatch): | CODE |
| LOW⚡ | tests/test_shared_history_alias.py | 102 | def test_persistence_off_yields_no_history(svc, monkeypatch): | CODE |
| LOW⚡ | tests/test_shared_history_alias.py | 106 | def test_outside_agent_id_maps_only_the_default(svc): | CODE |
| LOW | tests/test_memory_rerank.py | 76 | def fake_sentence_transformers(monkeypatch): | CODE |
| LOW | tests/test_memory_rerank.py | 96 | def test_rerank_reorders_by_reranker_score(): | CODE |
| LOW⚡ | tests/test_memory_rerank.py | 107 | def test_rerank_is_noop_without_reranker(): | CODE |
| LOW⚡ | tests/test_memory_rerank.py | 114 | def test_rerank_failure_keeps_fused_order(reranker): | CODE |
| LOW⚡ | tests/test_memory_rerank.py | 120 | def test_search_applies_min_score_before_rerank(): | CODE |
| LOW⚡ | tests/test_memory_rerank.py | 145 | def test_sigmoid_maps_to_unit_interval(): | CODE |
| LOW⚡ | tests/test_memory_rerank.py | 151 | def test_create_reranker_disabled_without_provider(provider): | CODE |
| LOW⚡ | tests/test_memory_rerank.py | 155 | def test_create_reranker_unknown_provider_is_disabled(): | CODE |
| LOW⚡ | tests/test_memory_rerank.py | 159 | def test_local_reranker_is_shared_and_loads_lazily(fake_sentence_transformers): | CODE |
| 3176 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | run.sh | 4 | # ============================ | COMMENT |
| MEDIUM | run.sh | 6 | # ============================ | COMMENT |
| MEDIUM⚡ | run.sh | 31 | # ============================ | COMMENT |
| MEDIUM⚡ | run.sh | 33 | # ============================ | COMMENT |
| MEDIUM⚡ | plugins/cow_cli/cow_cli.py | 352 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM⚡ | plugins/cow_cli/cow_cli.py | 354 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM⚡ | plugins/cow_cli/cow_cli.py | 625 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM⚡ | plugins/cow_cli/cow_cli.py | 627 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | plugins/cow_cli/cow_cli.py | 307 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | plugins/cow_cli/cow_cli.py | 309 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | plugins/cow_cli/cow_cli.py | 426 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | plugins/cow_cli/cow_cli.py | 430 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | plugins/cow_cli/cow_cli.py | 504 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | plugins/cow_cli/cow_cli.py | 508 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | plugins/cow_cli/cow_cli.py | 549 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | plugins/cow_cli/cow_cli.py | 551 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | plugins/cow_cli/cow_cli.py | 660 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | plugins/cow_cli/cow_cli.py | 662 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | plugins/cow_cli/cow_cli.py | 725 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | plugins/cow_cli/cow_cli.py | 727 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | plugins/cow_cli/cow_cli.py | 762 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | plugins/cow_cli/cow_cli.py | 764 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | plugins/cow_cli/cow_cli.py | 926 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | plugins/cow_cli/cow_cli.py | 928 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | plugins/cow_cli/cow_cli.py | 979 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | plugins/cow_cli/cow_cli.py | 981 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | plugins/cow_cli/cow_cli.py | 1437 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | plugins/cow_cli/cow_cli.py | 1439 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | plugins/cow_cli/cow_cli.py | 1838 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | plugins/cow_cli/cow_cli.py | 1840 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | plugins/cow_cli/cow_cli.py | 1964 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | plugins/cow_cli/cow_cli.py | 1966 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM⚡ | tests/test_wechatmp_passive_claim_and_cache_leak.py | 168 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_wechatmp_passive_claim_and_cache_leak.py | 170 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_wechatmp_passive_claim_and_cache_leak.py | 243 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_wechatmp_passive_claim_and_cache_leak.py | 245 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_doc_edit.py | 50 | # ---------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_doc_edit.py | 52 | # ---------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_doc_edit.py | 87 | # ---------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_doc_edit.py | 89 | # ---------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_doc_edit.py | 133 | # ---------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_doc_edit.py | 135 | # ---------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_doc_edit.py | 314 | # ---------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_doc_edit.py | 316 | # ---------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_doc_edit.py | 419 | # ---------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_doc_edit.py | 421 | # ---------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_doc_edit.py | 225 | # ---------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_doc_edit.py | 227 | # ---------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_root_config_atomic_write.py | 94 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_root_config_atomic_write.py | 96 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_root_config_atomic_write.py | 120 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_root_config_atomic_write.py | 122 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_security_ssrf_path_traversal.py | 138 | # ============================================================================= | COMMENT |
| MEDIUM⚡ | tests/test_security_ssrf_path_traversal.py | 140 | # ============================================================================= | COMMENT |
| MEDIUM | tests/test_security_ssrf_path_traversal.py | 23 | # ============================================================================= | COMMENT |
| MEDIUM | tests/test_security_ssrf_path_traversal.py | 25 | # ============================================================================= | COMMENT |
| MEDIUM⚡ | tests/test_artifact_index.py | 263 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_artifact_index.py | 265 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_channel_instances.py | 14 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_channel_instances.py | 16 | # --------------------------------------------------------------------------- | COMMENT |
| 425 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | config.py | 411 | def load_user_datas(self): | CODE |
| MEDIUM | config.py | 422 | def save_user_datas(self): | CODE |
| MEDIUM | config.py | 458 | def drag_sensitive(config): | CODE |
| LOW⚡ | config.py | 472 | except Exception as e: | CODE |
| LOW | config.py | 396 | except Exception as e: | CODE |
| LOW | config.py | 418 | except Exception as e: | CODE |
| LOW | config.py | 429 | except Exception as e: | CODE |
| LOW | config.py | 489 | except Exception as e: | CODE |
| LOW | config.py | 548 | except Exception as write_err: | CODE |
| LOW | config.py | 590 | except Exception: | CODE |
| LOW | config.py | 720 | except Exception: | CODE |
| LOW | config.py | 908 | except Exception as e: | CODE |
| MEDIUM | app.py | 527 | def _cleanup(): | CODE |
| MEDIUM | app.py | 794 | def run(): | CODE |
| LOW⚡ | app.py | 737 | except Exception as e: | CODE |
| LOW⚡ | app.py | 744 | except Exception as e: | CODE |
| LOW | app.py | 95 | except Exception as e: | CODE |
| LOW | app.py | 231 | except Exception as e: | CODE |
| LOW | app.py | 269 | except Exception: | CODE |
| LOW | app.py | 294 | except Exception as e: | CODE |
| LOW | app.py | 335 | except Exception as e: | CODE |
| LOW | app.py | 363 | except Exception as e: | CODE |
| LOW | app.py | 401 | except Exception: | CODE |
| LOW | app.py | 482 | except Exception as e: | CODE |
| LOW | app.py | 513 | except Exception: | CODE |
| LOW | app.py | 521 | except Exception as e: | CODE |
| LOW | app.py | 532 | except Exception: | CODE |
| LOW | app.py | 555 | except Exception as e: | CODE |
| LOW | app.py | 564 | except Exception as e: | CODE |
| LOW | app.py | 580 | except Exception as e: | CODE |
| LOW | app.py | 610 | except Exception: | CODE |
| LOW | app.py | 624 | except Exception as e: | CODE |
| LOW | app.py | 643 | except Exception as e: | CODE |
| LOW | app.py | 651 | except Exception as e: | CODE |
| LOW | app.py | 668 | except Exception as e: | CODE |
| LOW | app.py | 704 | except Exception as e: | CODE |
| LOW | app.py | 783 | except Exception as e: | CODE |
| LOW | app.py | 790 | except Exception as e: | CODE |
| LOW | app.py | 858 | except Exception as e: | CODE |
| LOW | docker/agent-mail/entrypoint.sh | 51 | except Exception as e: | CODE |
| LOW | plugins/plugin.py | 42 | except Exception as e: | CODE |
| LOW | plugins/plugin_manager.py | 178 | except Exception as e: | CODE |
| LOW | plugins/plugin_manager.py | 206 | except Exception as e: | CODE |
| LOW | plugins/plugin_manager.py | 244 | except Exception as e: | CODE |
| LOW | plugins/plugin_manager.py | 370 | except Exception as e: | CODE |
| LOW⚡ | plugins/plugin_manager.py | 392 | except Exception as e: | CODE |
| LOW⚡ | plugins/plugin_manager.py | 402 | except Exception as e: | CODE |
| LOW⚡ | plugins/plugin_manager.py | 411 | except Exception as e: | CODE |
| LOW | plugins/plugin_manager.py | 437 | except Exception as e: | CODE |
| LOW | plugins/plugin_manager.py | 461 | except Exception as e: | CODE |
| LOW | plugins/role/role.py | 78 | except Exception as e: | CODE |
| LOW | plugins/role/role.py | 103 | except Exception as e: | CODE |
| LOW | plugins/linkai/linkai.py | 296 | except Exception as e: | CODE |
| LOW | plugins/linkai/midjourney.py | 291 | except Exception as e: | CODE |
| LOW | plugins/linkai/midjourney.py | 435 | except Exception as e: | CODE |
| LOW | plugins/linkai/utils.py | 40 | except Exception: | CODE |
| LOW | plugins/linkai/utils.py | 63 | except Exception: | CODE |
| MEDIUM | plugins/cow_cli/cow_cli.py | 1500 | def _run(): | CODE |
| MEDIUM | plugins/cow_cli/cow_cli.py | 1687 | def _run(): | CODE |
| LOW⚡ | plugins/cow_cli/cow_cli.py | 346 | except Exception as e: | CODE |
| 1318 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | app.py | 856 | except KeyboardInterrupt: | CODE |
| HIGH | app.py | 532 | except Exception: | CODE |
| HIGH | app.py | 610 | except Exception: | CODE |
| HIGH | app.py | 480 | except ValueError: | CODE |
| HIGH | app.py | 269 | except Exception: | CODE |
| HIGH | plugins/cow_cli/cow_cli.py | 1310 | except Exception: | CODE |
| HIGH | bridge/agent_bridge.py | 907 | except Exception: | CODE |
| HIGH | bridge/agent_bridge.py | 1592 | except Exception: | CODE |
| HIGH | bridge/agent_bridge.py | 1752 | except Exception: | CODE |
| HIGH | bridge/agent_bridge.py | 1782 | except Exception: | CODE |
| HIGH | bridge/agent_bridge.py | 1833 | except Exception: | CODE |
| HIGH | bridge/agent_bridge.py | 1796 | except Exception: | CODE |
| HIGH | bridge/agent_bridge.py | 1884 | except Exception: | CODE |
| HIGH | bridge/agent_bridge.py | 1889 | except Exception: | CODE |
| HIGH | tests/test_wechatmp_passive_claim_and_cache_leak.py | 272 | except IndexError: | CODE |
| HIGH | tests/test_oversized_context_files.py | 142 | except Exception: | CODE |
| HIGH | tests/test_evolution.py | 694 | except Exception: | CODE |
| HIGH | tests/test_chat_channel_consume_loop_survives.py | 109 | except RuntimeError: | CODE |
| HIGH | agent/admin.py | 798 | except (OSError, NotImplementedError): | CODE |
| HIGH | agent/admin.py | 400 | except KeyError: | CODE |
| HIGH | agent/admin.py | 902 | except OSError: | CODE |
| HIGH | agent/tools/tool_manager.py | 479 | except Exception: | CODE |
| HIGH | agent/tools/web_fetch/web_fetch.py | 439 | except Exception: | CODE |
| HIGH | agent/tools/scheduler/task_store.py | 260 | except Exception: | CODE |
| HIGH | agent/tools/scheduler/task_store.py | 135 | except Exception: | CODE |
| HIGH | agent/tools/scheduler/integration.py | 560 | except Exception: | CODE |
| HIGH | agent/tools/scheduler/scheduler_tool.py | 569 | except Exception: | CODE |
| HIGH | agent/tools/scheduler/scheduler_tool.py | 593 | except Exception: | CODE |
| HIGH | agent/tools/scheduler/recipient_store.py | 143 | except (KeyError, TypeError, ValueError): | CODE |
| HIGH | agent/tools/mcp/service.py | 354 | except Exception: | CODE |
| HIGH | agent/tools/mcp/mcp_oauth.py | 44 | except OSError: | CODE |
| HIGH | agent/tools/mcp/mcp_oauth.py | 72 | except OSError: | CODE |
| HIGH | agent/tools/mcp/mcp_client.py | 398 | except Exception: | CODE |
| HIGH | agent/tools/mcp/mcp_client.py | 683 | except Exception: | CODE |
| HIGH | agent/tools/mcp/mcp_client.py | 687 | except Exception: | CODE |
| HIGH | agent/tools/mcp/mcp_client.py | 238 | except Exception: | CODE |
| HIGH | agent/tools/mcp/mcp_client.py | 261 | except Exception: | CODE |
| HIGH | agent/tools/mcp/mcp_client.py | 403 | except Exception: | CODE |
| HIGH | agent/tools/mcp/mcp_client.py | 664 | except Exception: | CODE |
| HIGH | agent/tools/mcp/mcp_client.py | 781 | except Exception: | CODE |
| HIGH | agent/tools/mcp/mcp_client.py | 808 | except Exception: | CODE |
| HIGH | agent/tools/mcp/mcp_client.py | 940 | except Exception: | CODE |
| HIGH | agent/tools/mcp/mcp_client.py | 246 | except Exception: | CODE |
| HIGH | agent/tools/mcp/mcp_client.py | 768 | except Exception: | CODE |
| HIGH | agent/tools/mcp/mcp_client.py | 945 | except Exception: | CODE |
| HIGH | agent/tools/bash/bash.py | 115 | except Exception: | CODE |
| HIGH | agent/tools/bash/bash.py | 196 | except Exception: | CODE |
| HIGH | agent/tools/bash/bash.py | 260 | except OSError: | CODE |
| HIGH | agent/tools/bash/background.py | 99 | except (OSError, ValueError): | CODE |
| HIGH | agent/tools/bash/background.py | 120 | except OSError: | CODE |
| HIGH | agent/tools/bash/decode.py | 37 | except (UnicodeDecodeError, LookupError): | CODE |
| HIGH | agent/tools/edit/edit.py | 245 | except Exception: | CODE |
| HIGH | agent/tools/browser/browser_service.py | 356 | except OSError: | CODE |
| HIGH | agent/tools/browser/browser_service.py | 1117 | except Exception: | CODE |
| HIGH | agent/tools/browser/browser_service.py | 876 | except Exception: | CODE |
| HIGH | agent/tools/browser/browser_env.py | 164 | except OSError: | CODE |
| HIGH | agent/tools/env_config/env_config.py | 121 | except OSError: | CODE |
| HIGH | agent/tools/send/send.py | 120 | except Exception: | CODE |
| HIGH | agent/multiagent/transport.py | 222 | except Exception: | CODE |
| HIGH | agent/memory/conversation_store.py | 2337 | except Exception: | CODE |
| 129 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | app.py | 15 | CODE | |
| LOW | app.py | 24 | CODE | |
| LOW | plugins/__init__.py | 1 | CODE | |
| LOW | plugins/__init__.py | 2 | CODE | |
| LOW | plugins/plugin.py | 3 | CODE | |
| LOW | plugins/plugin_manager.py | 15 | CODE | |
| LOW | plugins/role/__init__.py | 1 | CODE | |
| LOW | plugins/role/role.py | 13 | CODE | |
| LOW | plugins/linkai/__init__.py | 1 | CODE | |
| LOW | plugins/linkai/linkai.py | 4 | CODE | |
| LOW | plugins/linkai/linkai.py | 12 | CODE | |
| LOW | plugins/dungeon/dungeon.py | 11 | CODE | |
| LOW | plugins/dungeon/__init__.py | 1 | CODE | |
| LOW | plugins/finish/__init__.py | 1 | CODE | |
| LOW | plugins/finish/finish.py | 8 | CODE | |
| LOW | plugins/cow_cli/__init__.py | 1 | CODE | |
| LOW | plugins/godcmd/godcmd.py | 16 | CODE | |
| LOW | plugins/godcmd/__init__.py | 1 | CODE | |
| LOW | plugins/hello/hello.py | 8 | CODE | |
| LOW | plugins/hello/__init__.py | 1 | CODE | |
| LOW | plugins/banwords/banwords.py | 10 | CODE | |
| LOW | plugins/banwords/__init__.py | 1 | CODE | |
| LOW | plugins/keyword/__init__.py | 1 | CODE | |
| LOW | plugins/keyword/keyword.py | 12 | CODE | |
| LOW | plugins/tool/tool.py | 10 | CODE | |
| LOW | plugins/tool/tool.py | 11 | CODE | |
| LOW | tests/test_scheduler_run_records.py | 7 | CODE | |
| LOW | tests/test_tool_path_and_eval.py | 8 | CODE | |
| LOW | tests/test_robustness_fixes.py | 13 | CODE | |
| LOW | tests/test_robustness_fixes.py | 77 | CODE | |
| LOW | tests/test_cow_cli_skill_uninstall_traversal.py | 17 | CODE | |
| LOW | tests/test_bash_background.py | 9 | CODE | |
| LOW | tests/test_cloud_channel_dispatch.py | 13 | CODE | |
| LOW | tests/test_log_tail.py | 32 | CODE | |
| LOW | tests/test_syntax_gate.py | 72 | CODE | |
| LOW | tests/test_syntax_gate.py | 80 | CODE | |
| LOW | tests/test_syntax_gate.py | 90 | CODE | |
| LOW | tests/test_token_budget_trim.py | 12 | CODE | |
| LOW | tests/test_knowledge_path_advertised.py | 9 | CODE | |
| LOW | tests/test_web_channel_disconnect.py | 114 | CODE | |
| LOW | tests/test_web_bind_failure.py | 18 | CODE | |
| LOW | tests/test_memory_index_rel_path.py | 13 | CODE | |
| LOW | tests/test_memory_sync_shared_root.py | 17 | CODE | |
| LOW | tests/test_read_edit_improvements.py | 322 | CODE | |
| LOW | tests/test_dingtalk_richtext_without_images.py | 21 | CODE | |
| LOW | tests/test_config_subagent_toggle.py | 20 | CODE | |
| LOW | tests/test_read_shared_knowledge.py | 10 | CODE | |
| LOW | tests/test_evolution.py | 559 | CODE | |
| LOW | tests/test_evolution.py | 662 | CODE | |
| LOW | tests/test_minimax_provider.py | 115 | CODE | |
| LOW | agent/registry.py | 8 | CODE | |
| LOW | agent/team_addressing.py | 9 | CODE | |
| LOW | agent/team.py | 20 | CODE | |
| LOW | agent/admin.py | 3 | CODE | |
| LOW | agent/routing.py | 11 | CODE | |
| LOW | agent/tools/__init__.py | 2 | CODE | |
| LOW | agent/tools/__init__.py | 3 | CODE | |
| LOW | agent/tools/__init__.py | 6 | CODE | |
| LOW | agent/tools/__init__.py | 7 | CODE | |
| LOW | agent/tools/__init__.py | 8 | CODE | |
| 343 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | config.py | 493 | CODE | |
| LOW | config.py | 760 | CODE | |
| LOW | app.py | 442 | CODE | |
| LOW | app.py | 708 | CODE | |
| LOW | app.py | 748 | CODE | |
| LOW | app.py | 201 | CODE | |
| LOW | app.py | 307 | CODE | |
| LOW | plugins/plugin_manager.py | 181 | CODE | |
| LOW | plugins/plugin_manager.py | 235 | CODE | |
| LOW | plugins/plugin_manager.py | 308 | CODE | |
| LOW | plugins/plugin_manager.py | 365 | CODE | |
| LOW | plugins/role/role.py | 44 | CODE | |
| LOW | plugins/role/role.py | 85 | CODE | |
| LOW | plugins/role/role.py | 106 | CODE | |
| LOW | plugins/role/role.py | 127 | CODE | |
| LOW | plugins/linkai/midjourney.py | 81 | CODE | |
| LOW | plugins/linkai/midjourney.py | 106 | CODE | |
| LOW | plugins/linkai/midjourney.py | 268 | CODE | |
| LOW | plugins/dungeon/dungeon.py | 64 | CODE | |
| LOW | plugins/cow_cli/cow_cli.py | 468 | CODE | |
| LOW | plugins/cow_cli/cow_cli.py | 983 | CODE | |
| LOW | plugins/cow_cli/cow_cli.py | 1037 | CODE | |
| LOW | plugins/cow_cli/cow_cli.py | 1441 | CODE | |
| LOW | plugins/godcmd/godcmd.py | 230 | CODE | |
| LOW | plugins/banwords/banwords.py | 28 | CODE | |
| LOW | plugins/banwords/lib/WordsSearch.py | 78 | CODE | |
| LOW | plugins/banwords/lib/WordsSearch.py | 186 | CODE | |
| LOW | plugins/banwords/lib/WordsSearch.py | 229 | CODE | |
| LOW | plugins/keyword/keyword.py | 49 | CODE | |
| LOW | plugins/tool/tool.py | 49 | CODE | |
| LOW | bridge/agent_bridge.py | 433 | CODE | |
| LOW | bridge/agent_bridge.py | 503 | CODE | |
| LOW | bridge/agent_bridge.py | 634 | CODE | |
| LOW | bridge/agent_bridge.py | 724 | CODE | |
| LOW | bridge/agent_bridge.py | 1500 | CODE | |
| LOW | bridge/agent_bridge.py | 1985 | CODE | |
| LOW | bridge/agent_bridge.py | 2307 | CODE | |
| LOW | bridge/agent_bridge.py | 2317 | CODE | |
| LOW | bridge/agent_initializer.py | 248 | CODE | |
| LOW | bridge/agent_initializer.py | 389 | CODE | |
| LOW | bridge/agent_initializer.py | 544 | CODE | |
| LOW | bridge/agent_initializer.py | 625 | CODE | |
| LOW | bridge/agent_initializer.py | 672 | CODE | |
| LOW | bridge/agent_initializer.py | 938 | CODE | |
| LOW | bridge/agent_initializer.py | 1053 | CODE | |
| LOW | bridge/agent_initializer.py | 1190 | CODE | |
| LOW | bridge/agent_initializer.py | 1288 | CODE | |
| LOW | bridge/agent_event_handler.py | 35 | CODE | |
| LOW | bridge/bridge.py | 134 | CODE | |
| LOW | tests/conftest.py | 57 | CODE | |
| LOW | tests/test_web_sse_replay.py | 45 | CODE | |
| LOW | tests/test_web_console_assets.py | 219 | CODE | |
| LOW | tests/test_openai_voice.py | 87 | CODE | |
| LOW | tests/test_openai_voice.py | 108 | CODE | |
| LOW | tests/test_wechatmp_image_type.py | 83 | CODE | |
| LOW | tests/test_models_handler.py | 143 | CODE | |
| LOW | tests/test_models_handler.py | 168 | CODE | |
| LOW | tests/test_models_handler.py | 194 | CODE | |
| LOW | tests/trajectory_eval.py | 49 | CODE | |
| LOW | tests/test_evolution.py | 557 | CODE | |
| 345 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | tests/test_task_store_atomic_save.py | 137 | @pytest.mark.parametrize("corrupt", ["{broken json", '{"tasks": []}', '{"tasks": {"bad": null}}']) | CODE |
| HIGH⚡ | tests/test_doc_edit.py | 434 | assert "if (!edit || edit.saving) return" in store | CODE |
| HIGH | tests/test_doc_edit.py | 475 | assert "expected_mtime: args.expectedMtime ?? null," in client | CODE |
| HIGH⚡ | tests/test_artifact_index.py | 277 | f"cd {tmp_path}/websites && cp plan.html {backup} && python3 - <<'PY'\n" | CODE |
| HIGH | tests/test_permission_flag_driven_writes.py | 53 | "sort -o out.txt in.txt && echo done", | CODE |
| HIGH | tests/test_scheduler_toggle_missing.py | 6 | therefore produced ``{"status": "success", "task": null}`` -- a success toast | STRING |
| HIGH⚡ | tests/test_bash_exit_codes.py | 39 | chain = 'find / -iname "*x*" 2>/dev/null; echo "---"; find ~ -iname "*y*" 2>/dev/null' | CODE |
| HIGH⚡ | tests/test_bash_exit_codes.py | 76 | "false && grep hello f.txt", | CODE |
| HIGH⚡ | tests/test_bash_exit_codes.py | 77 | "false && grep hello f.txt || false && grep hello f.txt", | CODE |
| HIGH⚡ | tests/test_bash_exit_codes.py | 77 | "false && grep hello f.txt || false && grep hello f.txt", | CODE |
| HIGH⚡ | tests/test_bash_exit_codes.py | 78 | "false && cat f.txt | grep hello", | CODE |
| HIGH⚡ | tests/test_bash_exit_codes.py | 90 | "true && grep zzzz f.txt", "false || grep zzzz f.txt", | CODE |
| HIGH⚡ | tests/test_bash_exit_codes.py | 90 | "true && grep zzzz f.txt", "false || grep zzzz f.txt", | CODE |
| HIGH⚡ | tests/test_bash_exit_codes.py | 102 | "false && cat f.txt; grep zzzz f.txt", | CODE |
| HIGH⚡ | tests/test_bash_exit_codes.py | 103 | "false && cat f.txt\ngrep zzzz f.txt", | CODE |
| HIGH | tests/test_workspace_edit.py | 462 | assert "expected_mtime: args.expectedMtime ?? null," in client | CODE |
| HIGH | tests/test_workspace_edit.py | 471 | assert "if (!edit || edit.saving) return" in store | CODE |
| HIGH | agent/tools/scheduler/time_utils.py | 60 | A stored schedule that is not a mapping (null, a string) declares no zone. | STRING |
| HIGH | agent/tools/bash/bash.py | 632 | corrections.append("chain commands with && instead of ;") | STRING |
| HIGH⚡ | agent/tools/browser/browser_service.py | 135 | return t ? t : null; | CODE |
| HIGH⚡ | agent/tools/browser/browser_service.py | 137 | if (node.nodeType !== Node.ELEMENT_NODE) return null; | CODE |
| HIGH⚡ | agent/tools/browser/browser_service.py | 139 | if (SKIP.has(tag)) return null; | CODE |
| HIGH⚡ | agent/tools/browser/browser_service.py | 140 | if (!visible(node)) return null; | CODE |
| HIGH⚡ | agent/tools/browser/browser_service.py | 145 | if (r !== null) { | CODE |
| HIGH⚡ | agent/tools/browser/browser_service.py | 146 | if (typeof r === "string") children.push(r); | CODE |
| HIGH⚡ | agent/tools/browser/browser_service.py | 147 | else children.push(r); | CODE |
| HIGH⚡ | agent/tools/browser/browser_service.py | 156 | if (children.length === 0) return null; | CODE |
| HIGH⚡ | agent/tools/browser/browser_service.py | 162 | if (nativeInteractive || implicitInteractive) { | CODE |
| HIGH⚡ | agent/tools/browser/browser_service.py | 172 | if (!directText && children.length === 0) { | CODE |
| HIGH⚡ | agent/tools/browser/browser_service.py | 188 | obj.name = node.name || undefined; | CODE |
| HIGH⚡ | agent/tools/browser/browser_service.py | 188 | obj.name = node.name || undefined; | CODE |
| HIGH⚡ | agent/tools/browser/browser_service.py | 189 | obj.value = node.value || undefined; | CODE |
| HIGH⚡ | agent/tools/browser/browser_service.py | 189 | obj.value = node.value || undefined; | CODE |
| HIGH⚡ | agent/tools/browser/browser_service.py | 190 | obj.placeholder = node.placeholder || undefined; | CODE |
| HIGH⚡ | agent/tools/browser/browser_service.py | 190 | obj.placeholder = node.placeholder || undefined; | CODE |
| HIGH | agent/tools/browser/browser_service.py | 83 | if (role && CLICKABLE_ROLES.has(role)) return true; | CODE |
| HIGH | agent/tools/browser/browser_service.py | 110 | if (ariaLabel && ariaLabel.trim()) return true; | CODE |
| HIGH | agent/tools/browser/browser_service.py | 112 | if (title && title.trim()) return true; | CODE |
| HIGH | agent/tools/browser/browser_service.py | 212 | if (children.length === 1 && typeof children[0] === "string") { | CODE |
| HIGH | agent/tools/browser/browser_service.py | 1187 | "ref => (window.__cowRefMap && window.__cowRefMap[ref]) || null", ref | CODE |
| HIGH | channel/web/api/menu.py | 163 | """GET /api/menu -> {menu: null | {groups}}; POST {menu} saves, {menu: null} resets.""" | STRING |
| HIGH | channel/web/api/workspace.py | 327 | """Bind a session to a project directory, or clear it (project_dir=null).""" | STRING |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | tests/test_custom_provider.py | 0 | install a fresh config as the global config used by conf(). | STRING |
| HIGH | tests/test_fallback_provider_credentials.py | 0 | install a fresh config as the global config used by conf(). | STRING |
| HIGH | tests/test_custom_provider_handlers.py | 0 | install a fresh config as the global config used by conf(). | STRING |
| HIGH | tests/test_doc_edit.py | 0 | write lf-only bytes; path.write_text would translate to crlf on windows. | STRING |
| HIGH | tests/test_workspace_edit.py | 0 | write lf-only bytes; path.write_text would translate to crlf on windows. | STRING |
| HIGH | tests/test_edit_write_atomic.py | 0 | write lf-only bytes; path.write_text would translate to crlf on windows. | STRING |
| HIGH | models/openai_compatible_bot.py | 0 | convert tools from claude format to dashscope format claude format: {name, description, input_schema} dashscope format: | STRING |
| HIGH | models/zhipuai/zhipuai_bot.py | 0 | convert tools from claude format to dashscope format claude format: {name, description, input_schema} dashscope format: | STRING |
| HIGH | models/dashscope/dashscope_bot.py | 0 | convert tools from claude format to dashscope format claude format: {name, description, input_schema} dashscope format: | STRING |
| HIGH | models/moonshot/moonshot_bot.py | 0 | convert tools from claude format to openai format. claude: {name, description, input_schema} openai: {type: "function", | STRING |
| HIGH | models/doubao/doubao_bot.py | 0 | convert tools from claude format to openai format. claude: {name, description, input_schema} openai: {type: "function", | STRING |
| HIGH | models/deepseek/deepseek_bot.py | 0 | convert tools from claude format to openai format. claude: {name, description, input_schema} openai: {type: "function", | STRING |
| HIGH | models/baidu/baidu_wenxin_session.py | 0 | returns the number of tokens used by a list of messages. | STRING |
| HIGH | models/minimax/minimax_session.py | 0 | returns the number of tokens used by a list of messages. | STRING |
| HIGH | models/chatgpt/chat_gpt_session.py | 0 | returns the number of tokens used by a list of messages. | STRING |
| HIGH | models/linkai/link_ai_bot.py | 0 | get api configuration for openai-compatible base class | STRING |
| HIGH | models/chatgpt/chat_gpt_bot.py | 0 | get api configuration for openai-compatible base class | STRING |
| HIGH | models/openai/open_ai_bot.py | 0 | get api configuration for openai-compatible base class | STRING |
| HIGH | channel/discord/discord_channel.py | 0 | fast-path: /cancel calls cancel_session directly without going through agent. | STRING |
| HIGH | channel/telegram/telegram_channel.py | 0 | fast-path: /cancel calls cancel_session directly without going through agent. | STRING |
| HIGH | channel/slack/slack_channel.py | 0 | fast-path: /cancel calls cancel_session directly without going through agent. | STRING |
| HIGH | channel/discord/discord_channel.py | 0 | split long text preferring line breaks to keep markdown structure intact. | STRING |
| HIGH | channel/telegram/telegram_channel.py | 0 | split long text preferring line breaks to keep markdown structure intact. | STRING |
| HIGH | channel/slack/slack_channel.py | 0 | split long text preferring line breaks to keep markdown structure intact. | STRING |
| HIGH | channel/discord/discord_message.py | 0 | local download directory, aligned with other channels (workspace tmp). | STRING |
| HIGH | channel/telegram/telegram_message.py | 0 | local download directory, aligned with other channels (workspace tmp). | STRING |
| HIGH | channel/slack/slack_message.py | 0 | local download directory, aligned with other channels (workspace tmp). | STRING |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | config.py | 310 | # Set 0 to disable the manual cap and follow the model window instead. | COMMENT |
| LOW | config.py | 322 | # Set enabled to false to withhold the subagent tool entirely. | COMMENT |
| LOW⚡ | run.sh | 25 | # Check if using Bash | COMMENT |
| LOW | run.sh | 1025 | # Check if service is running | COMMENT |
| LOW | run.sh | 1030 | # Check if cow CLI is available | COMMENT |
| LOW | bridge/agent_bridge.py | 1847 | # Check if there are files to send (from send/read tool) | COMMENT |
| LOW | agent/tools/tool_manager.py | 146 | # Check if __all__ is defined | COMMENT |
| LOW | agent/tools/read/read.py | 167 | # Check if file exists. Both misses below name the tool that answers | COMMENT |
| LOW⚡ | agent/tools/read/read.py | 197 | # Check if readable | COMMENT |
| LOW⚡ | agent/tools/read/read.py | 205 | # Check if image - return metadata for sending | COMMENT |
| LOW⚡ | agent/tools/read/read.py | 209 | # Check if video/audio/binary/archive - return metadata only | COMMENT |
| LOW⚡ | agent/tools/read/read.py | 217 | # Check if PDF | COMMENT |
| LOW⚡ | agent/tools/read/read.py | 221 | # Check if Office document (.docx, .xlsx, .pptx, etc.) | COMMENT |
| LOW | agent/tools/read/read.py | 464 | # Read file (utf-8-sig strips BOM automatically on Windows) | COMMENT |
| LOW | agent/tools/utils/truncate.py | 100 | # Check if no truncation is needed | COMMENT |
| LOW | agent/tools/utils/truncate.py | 116 | # Check if first line alone exceeds byte limit | COMMENT |
| LOW | agent/tools/utils/truncate.py | 195 | # Check if no truncation is needed | COMMENT |
| LOW | agent/tools/bash/bash.py | 320 | # Check if we need to save full output to temp file | STRING |
| LOW⚡ | agent/tools/edit/edit.py | 101 | # Check if file exists | COMMENT |
| LOW⚡ | agent/tools/edit/edit.py | 105 | # Check if readable/writable | COMMENT |
| LOW⚡ | agent/tools/edit/edit.py | 110 | # Read the file's bytes instead of opening it in text mode. A | COMMENT |
| LOW | agent/tools/send/send.py | 70 | # Check if file exists | COMMENT |
| LOW | agent/tools/send/send.py | 74 | # Check if readable | COMMENT |
| LOW | agent/memory/chunker.py | 88 | # Check if adding this line would exceed limit | COMMENT |
| LOW | agent/protocol/agent_stream.py | 1106 | # Check if this is a file to send | COMMENT |
| LOW | agent/protocol/agent_stream.py | 1673 | # Check if this is a context overflow error. Use the single | COMMENT |
| LOW | agent/protocol/agent_stream.py | 1843 | # Check if error is rate limit (429) | COMMENT |
| LOW | agent/protocol/agent_stream.py | 1846 | # Check if error is retryable (timeout, connection, server busy, etc.) | COMMENT |
| LOW | agent/prompt/workspace.py | 45 | # Check if this is a brand new workspace (AGENT.md not yet created). | COMMENT |
| LOW | agent/skills/config.py | 235 | # Check if value is truthy | COMMENT |
| LOW | models/openai_compatible_bot.py | 399 | # Check if already in OpenAI format | COMMENT |
| LOW | models/openai_compatible_bot.py | 463 | # Check if this is a tool result message (user role with tool_result blocks) | COMMENT |
| LOW | models/openai_compatible_bot.py | 497 | # Check if this is an assistant message with tool_use blocks | COMMENT |
| LOW | models/zhipuai/zhipuai_bot.py | 481 | # Check if already in ZhipuAI/OpenAI format | COMMENT |
| LOW | models/zhipuai/zhipuai_bot.py | 520 | # Check if this is a tool result message (user role with tool_result blocks) | COMMENT |
| LOW | models/zhipuai/zhipuai_bot.py | 531 | # Check if this is an assistant message with tool_use blocks | COMMENT |
| LOW | models/dashscope/dashscope_bot.py | 591 | # Check if already in DashScope/OpenAI format | COMMENT |
| LOW | models/dashscope/dashscope_bot.py | 661 | # Check if this is a tool result message (user role with tool_result blocks) | COMMENT |
| LOW | models/dashscope/dashscope_bot.py | 672 | # Check if this is an assistant message with tool_use blocks | COMMENT |
| LOW | models/chatgpt/chat_gpt_bot.py | 202 | # Check if file exists | COMMENT |
| LOW | channel/channel.py | 155 | # Check if agent mode is enabled | COMMENT |
| LOW | channel/dingtalk/dingtalk_channel.py | 865 | # Check if msg exists (for scheduled tasks, msg might be None) | COMMENT |
| LOW⚡ | channel/feishu/feishu_channel.py | 2127 | # Check if it's a local file path (file:// protocol) | COMMENT |
| LOW | channel/feishu/feishu_channel.py | 983 | # Check if we can reply to an existing message (need msg_id) | COMMENT |
| LOW | channel/feishu/feishu_channel.py | 1860 | # Check if it's a local file path (file:// protocol) | COMMENT |
| LOW | channel/web/api/config.py | 249 | # Check if password was cleared: if there was a password before clearing, | COMMENT |
| LOW | channel/wecom_bot/wecom_bot_channel.py | 525 | # Check if this is a response to a pending request | COMMENT |
| LOW | skills/skill-creator/scripts/init_skill.py | 208 | # Check if directory already exists | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | config.py | 288 | # Optional native multi-agent registry. When empty or omitted, CowAgent | COMMENT |
| MEDIUM | config.py | 134 | "qwen_node_id": "", # id used by workflow-orchestration models; keep it an empty string if qwen_node_id is unused | CODE |
| MEDIUM | bridge/agent_bridge.py | 472 | # reasoning trace, but still benefit from the higher answer | COMMENT |
| MEDIUM | bridge/agent_bridge.py | 544 | # reasoning trace, but still benefit from the higher answer | COMMENT |
| MEDIUM | bridge/agent_bridge.py | 2133 | # Thinking-only models need their reasoning trace in stored | COMMENT |
| MEDIUM | bridge/agent_initializer.py | 182 | # from the effective model's context window (see | COMMENT |
| MEDIUM | tests/test_agent_trim_new_messages.py | 40 | # 2. trim oldest turns if this run overflows the context window | COMMENT |
| MEDIUM⚡ | tests/test_knowledge_graph_rel_path.py | 42 | (root / "concepts/rag.md").write_text("# RAG\n", encoding="utf-8") | CODE |
| MEDIUM⚡ | tests/test_knowledge_graph_rel_path.py | 44 | "# DeepSeek\nsee [RAG](../concepts/rag.md)\n", encoding="utf-8" | CODE |
| MEDIUM⚡ | tests/test_evolution.py | 94 | # Test scaffolding | COMMENT |
| MEDIUM | tests/test_knowledge_service.py | 473 | (root / "concepts/rag.md").write_text("# RAG", encoding="utf-8") | CODE |
| MEDIUM | agent/tools/mcp/tool_retrieval.py | 196 | # embedding model; ranking across dims is meaningless. | COMMENT |
| MEDIUM⚡ | agent/memory/embedding/provider.py | 78 | # default_model : default embedding model name | COMMENT |
| MEDIUM | agent/memory/embedding/factory.py | 19 | # Track whether the embedding model log has been printed in this process, | COMMENT |
| MEDIUM⚡ | agent/protocol/agent_stream.py | 2749 | # Step 2: Calculate the token budget (context window - output reserve - system prompt) | COMMENT |
| MEDIUM⚡ | agent/protocol/agent_stream.py | 2750 | # Get context window from agent (based on model) | COMMENT |
| MEDIUM⚡ | agent/protocol/agent_stream.py | 2775 | # overflows the model context window; | COMMENT |
| MEDIUM | agent/protocol/agent.py | 29 | # Known model families: total context window (tokens) and, when the provider | COMMENT |
| MEDIUM | agent/protocol/agent.py | 457 | # Reserve ~10% of context window, with min 10K and max 200K | COMMENT |
| MEDIUM | agent/prompt/workspace.py | 160 | # Truncate MEMORY.md to protect context window (frozen snapshot) | COMMENT |
| MEDIUM | cli/commands/backup.py | 527 | # multi-agent restore. | COMMENT |
| MEDIUM | channel/web/api/models.py | 1326 | # Researched specs (context window / max output) for built-in preset | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | config.py | 41 | # chatgpt model; when use_azure_chatgpt is true, this is the Azure model deployment name | COMMENT |
| LOW | config.py | 301 | # Routes inbound conversations to an agent. Each entry needs channel_type | COMMENT |
| LOW | config.py | 321 | # short-lived worker with its own context, and gets back only the result. | COMMENT |
| LOW | config.py | 561 | _migrate_chat_fallback(config) | COMMENT |
| LOW | docker/entrypoint.sh | 1 | #!/bin/bash | COMMENT |
| LOW | plugins/keyword/keyword.py | 61 | COMMENT | |
| LOW | plugins/tool/README.md | 121 | ###### 发送短信 | COMMENT |
| LOW | bridge/agent_bridge.py | 101 | _session_model = None | COMMENT |
| LOW | bridge/agent_bridge.py | 1541 | # its roster on every inbound message. Materialize it into the | COMMENT |
| LOW | bridge/agent_initializer.py | 21 | COMMENT | |
| LOW | tests/test_permission_shell_substitution.py | 101 | COMMENT | |
| LOW | desktop/electron-builder.win.js | 101 | async function customSign(configuration) { | COMMENT |
| LOW | desktop/src/renderer/src/product/types.ts | 1 | // ============================================================ | COMMENT |
| LOW | desktop/src/renderer/src/product/types.ts | 21 | COMMENT | |
| LOW | desktop/src/renderer/src/product/types.ts | 61 | hideProviderSelect?: boolean | COMMENT |
| LOW | desktop/src/renderer/src/product/types.ts | 81 | // external destinations without touching core code. | COMMENT |
| LOW | desktop/src/renderer/src/theme/themes.ts | 1 | // ============================================================ | COMMENT |
| LOW | desktop/src/renderer/src/hooks/useBackend.ts | 1 | import { useState, useEffect, useCallback, useRef } from 'react' | COMMENT |
| LOW | …sktop/src/renderer/src/hooks/useSchedulerNotifyPoll.ts | 1 | import { useEffect } from 'react' | COMMENT |
| LOW | desktop/src/renderer/src/api/client.ts | 181 | // carries it: web.py merges query + form fields and a duplicate collapses | COMMENT |
| LOW | …src/renderer/src/pages/settings/ModelCatalogEditor.tsx | 1 | import React, { useMemo, useState } from 'react' | COMMENT |
| LOW | desktop/src/renderer/src/store/onboardingStore.ts | 1 | import { create } from 'zustand' | COMMENT |
| LOW | desktop/src/main/updater.ts | 41 | // A bundled app-config may point the updater at a different feed origin. When | COMMENT |
| LOW | desktop/src/main/updater.ts | 201 | COMMENT | |
| LOW | desktop/src/main/index.ts | 21 | // Kept in sync with COW_DATA_DIR in python-manager.ts so the desktop shell | COMMENT |
| LOW | desktop/src/main/index.ts | 621 | // Electron docs, `openAtLogin` only reports true when getLoginItemSettings() | COMMENT |
| LOW | desktop/src/main/app-icon.ts | 21 | const MAX_ICON_BYTES = 4 * 1024 * 1024 | COMMENT |
| LOW | desktop/src/main/python-manager.ts | 21 | export const DESKTOP_BACKEND_PORT = 9876 | COMMENT |
| LOW | desktop/src/main/python-manager.ts | 81 | private process: ChildProcess | null = null | COMMENT |
| LOW | desktop/src/main/python-manager.ts | 101 | // Rolling tail of backend output. A startup that never reaches "ready" is | COMMENT |
| LOW | desktop/src/main/themes.ts | 1 | import { app, ipcMain } from 'electron' | COMMENT |
| LOW | agent/tools/mcp/mcp_client.py | 141 | # complete the browser authorization. Callers can surface this state. | COMMENT |
| LOW | agent/tools/browser/browser_service.py | 441 | self._context = None | COMMENT |
| LOW | agent/tools/browser/browser_service.py | 481 | # Resolve which browser engine to drive (system Chrome vs downloaded | COMMENT |
| LOW | agent/memory/chunker.py | 141 | chars += line_chars | COMMENT |
| LOW | agent/memory/conversation_store.py | 621 | self._db_path = db_path | COMMENT |
| LOW | agent/memory/manager.py | 441 | "source": source, | COMMENT |
| LOW | agent/memory/embedding/provider.py | 61 | @property | COMMENT |
| LOW | agent/memory/embedding/provider.py | 81 | # needs_client_truncate : whether to slice + L2-normalize on the client side | COMMENT |
| LOW | agent/chat/service.py | 461 | # We cannot simply slice at original_length (it exceeds the | COMMENT |
| LOW | agent/protocol/agent_stream.py | 881 | # every turn), a sub agent spawn or a delegation; this run adopts it. | COMMENT |
| LOW | agent/protocol/agent_stream.py | 1561 | except Exception as e: | COMMENT |
| LOW | agent/protocol/agent.py | 141 | self.memory_manager = memory_manager # Memory manager for auto memory flush | COMMENT |
| LOW | agent/protocol/agent.py | 541 | # value is both correct and free. get_full_system_prompt() would re-read | COMMENT |
| LOW | models/claudeapi/claude_api_bot.py | 61 | COMMENT | |
| LOW | models/openai/open_ai_bot.py | 161 | # which calls /chat/completions via our shared HTTP client. The previous | COMMENT |
| LOW | channel/channel.py | 21 | # Multi-instance support. All optional and empty by default, so a | COMMENT |
| LOW | channel/feishu/feishu_channel.py | 861 | isgroup=is_group, | COMMENT |
| LOW | channel/web/core/channel.py | 321 | """Build a callback that publishes agent events to the SSE replay log.""" | COMMENT |
| LOW | channel/web/static/js/core/notify.js | 121 | // The global runs poller is the single source of scheduler notifications (the | COMMENT |
| LOW | channel/web/static/js/core/auth.js | 1 | /* Login screen, logout, and the 401 handling around fetch. | COMMENT |
| LOW | channel/web/static/js/core/router.js | 1 | /* Address-bar routing: mirrors the current view and tab into the URL path, so | COMMENT |
| LOW | channel/web/static/js/core/router.js | 181 | // Settle the address bar on whatever ended up on screen. Usually it | COMMENT |
| LOW | channel/web/static/js/core/nav.js | 181 | } | COMMENT |
| LOW | channel/web/static/js/views/agents.js | 941 | _paintCoreFileStatus('pending', ''); | COMMENT |
| LOW | channel/web/static/js/views/models.js | 1 | /* Model configuration tab: vendors, capabilities, fallbacks. | COMMENT |
| LOW | channel/web/static/js/views/models.js | 261 | } | COMMENT |
| LOW | channel/web/static/js/views/models.js | 1361 | // Capabilities that can be in "auto" mode show a fallback hint right | COMMENT |
| LOW | channel/web/static/js/views/models.js | 1941 | // capability provider dropdowns. The .active row already shows the | COMMENT |
| LOW | channel/web/static/js/views/models.js | 2081 | function closeVendorModal() { | COMMENT |
| 22 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | bridge/bridge.py | 121 | return v != "" and v not in ("YOUR API KEY", "YOUR_API_KEY") | CODE |
| HIGH | …sktop/src/renderer/src/pages/skills/McpEditorModal.tsx | 333 | placeholder="Authorization=Bearer YOUR_API_KEY" | CODE |
| HIGH | agent/memory/embedding/provider.py | 234 | if not self.api_key or self.api_key in ["", "YOUR API KEY", "YOUR_API_KEY"]: | CODE |
| HIGH | agent/memory/embedding/provider.py | 380 | if not self.api_key or self.api_key in ["", "YOUR API KEY", "YOUR_API_KEY"]: | CODE |
| HIGH⚡ | agent/memory/embedding/factory.py | 48 | if openai_api_key and openai_api_key not in ["", "YOUR API KEY", "YOUR_API_KEY"]: | CODE |
| HIGH⚡ | agent/memory/embedding/factory.py | 64 | if linkai_api_key and linkai_api_key not in ["", "YOUR API KEY", "YOUR_API_KEY"]: | CODE |
| HIGH | agent/memory/embedding/factory.py | 182 | if value in ["", "YOUR API KEY", "YOUR_API_KEY"]: | CODE |
| HIGH | channel/web/core/channel.py | 675 | if val and val not in ("YOUR API KEY", "YOUR_API_KEY"): | CODE |
| HIGH | channel/web/core/providers.py | 161 | return bool(value) and value not in ("", "YOUR API KEY", "YOUR_API_KEY") | CODE |
| HIGH | channel/web/templates/modals/mcp-editor.html | 63 | <textarea id="mcp-field-headers" rows="2" class="cap-input cap-input-mono resize-y" spellche | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | plugins/banwords/lib/WordsSearch.py | 10 | __all__ = ['WordsSearch'] | CODE |
| LOW | bridge/agent_bridge.py | 289 | def set_agent_default(self, provider: Optional[str], model: Optional[str]) -> None: | CODE |
| LOW | bridge/agent_bridge.py | 301 | def set_session_override(self, provider: Optional[str], model: Optional[str]) -> None: | CODE |
| LOW | agent/registry.py | 335 | def set_default(self, agent_id: str) -> None: | CODE |
| LOW | agent/registry.py | 415 | def set_agent_registry(registry: Optional[AgentRegistry]) -> None: | CODE |
| LOW | agent/routing.py | 108 | def set_agent_router(router: Optional[AgentRouter]) -> None: | CODE |
| LOW | agent/tools/__init__.py | 147 | __all__ = [ | CODE |
| LOW | agent/tools/write/__init__.py | 3 | __all__ = ['Write'] | CODE |
| LOW | agent/tools/web_search/__init__.py | 3 | __all__ = ["WebSearch"] | CODE |
| LOW | agent/tools/memory/__init__.py | 10 | __all__ = ['MemorySearchTool', 'MemoryGetTool'] | CODE |
| LOW | agent/tools/search_files/__init__.py | 3 | __all__ = ['SearchFiles'] | CODE |
| LOW | agent/tools/read/__init__.py | 3 | __all__ = ['Read'] | CODE |
| LOW | agent/tools/scheduler/__init__.py | 7 | __all__ = ["SchedulerTool"] | CODE |
| LOW | agent/tools/evolution_undo/__init__.py | 3 | __all__ = ["EvolutionUndoTool"] | CODE |
| LOW | agent/tools/utils/__init__.py | 33 | __all__ = [ | CODE |
| LOW | agent/tools/mcp/__init__.py | 4 | __all__ = ["McpClient", "McpClientRegistry", "McpTool"] | CODE |
| LOW | agent/tools/mcp/mcp_client.py | 57 | def set_reload_callback(fn) -> None: | CODE |
| LOW | agent/tools/bash/bash.py | 103 | def set_cwd(self, cwd: str) -> None: | STRING |
| LOW | agent/tools/bash/__init__.py | 3 | __all__ = ['Bash'] | CODE |
| LOW | agent/tools/edit/__init__.py | 3 | __all__ = ['Edit'] | CODE |
| LOW | agent/tools/browser/__init__.py | 3 | __all__ = ["BrowserTool"] | CODE |
| LOW | agent/tools/env_config/__init__.py | 3 | __all__ = ['EnvConfig'] | CODE |
| LOW | agent/tools/agent_delegate/__init__.py | 5 | __all__ = ["AgentDelegateTool", "DelegationPolicy"] | CODE |
| LOW | agent/tools/ls/__init__.py | 3 | __all__ = ['Ls'] | CODE |
| LOW | agent/tools/current_time/__init__.py | 3 | __all__ = ['TimeTool', 'current_time_info'] | CODE |
| LOW | agent/tools/send/__init__.py | 3 | __all__ = ['Send'] | CODE |
| LOW | agent/tools/subagent/__init__.py | 3 | __all__ = ["SubagentTool", "format_results"] | CODE |
| LOW | agent/multiagent/transport.py | 177 | def set_transport(transport: Optional[PeerTransport]) -> None: | CODE |
| LOW | agent/multiagent/__init__.py | 27 | __all__ = [ | CODE |
| LOW | agent/memory/config.py | 139 | def set_global_memory_config(config: Optional[MemoryConfig]) -> None: | CODE |
| LOW | agent/memory/__init__.py | 43 | __all__ = [ | CODE |
| LOW | agent/memory/storage.py | 1023 | def set_meta(self, key: str, value: str) -> None: | CODE |
| LOW | agent/memory/embedding/__init__.py | 31 | __all__ = [ | CODE |
| LOW | agent/chat/__init__.py | 3 | __all__ = ["ChatService"] | CODE |
| LOW | agent/workspace/__init__.py | 5 | __all__ = ["WorkspaceService", "project_store", "session_prefs"] | CODE |
| LOW | agent/protocol/task.py | 88 | def update_status(self, status: TaskStatus) -> None: | CODE |
| LOW | agent/protocol/__init__.py | 19 | __all__ = [ | CODE |
| LOW | agent/prompt/__init__.py | 8 | __all__ = [ | CODE |
| LOW | agent/evolution/__init__.py | 16 | __all__ = [ | CODE |
| LOW | agent/skills/__init__.py | 21 | __all__ = [ | CODE |
| LOW | agent/permission/__init__.py | 16 | __all__ = [ | CODE |
| LOW | agent/subagent/__init__.py | 24 | __all__ = [ | CODE |
| LOW | models/openai/openai_compat.py | 148 | __all__ = [ | CODE |
| LOW | cli/update_service.py | 24 | logger = logging.getLogger(__name__) | CODE |
| LOW | channel/file_cache.py | 9 | logger = logging.getLogger(__name__) | CODE |
| LOW⚡ | channel/weixin/weixin_channel.py | 362 | def _update_context_token(self, user_id: str, token: str) -> None: | CODE |
| LOW | common/channel_registry.py | 20 | def set_channel_manager(manager) -> None: | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | bridge/agent_bridge.py | 45 | # Create a temporary mixin class that combines the bot with OpenAI compatibility | COMMENT |
| MEDIUM⚡ | tests/test_security_ssrf_path_traversal.py | 147 | # Create a minimal SkillManager mock with custom_dir set. | COMMENT |
| MEDIUM | agent/tools/tool_manager.py | 176 | # Create a temporary instance to get the name | COMMENT |
| MEDIUM | agent/tools/tool_manager.py | 240 | # Create a temporary instance to get the name | COMMENT |
| MEDIUM | agent/tools/tool_manager.py | 797 | # Create a new instance | COMMENT |
| MEDIUM | agent/tools/tool_manager.py | 821 | # Create a temporary instance to get schema | COMMENT |
| MEDIUM | agent/tools/scheduler/integration.py | 805 | # Create a unique session_id for this scheduled task to avoid polluting user's conversation | COMMENT |
| MEDIUM | agent/tools/bash/bash.py | 298 | # Create a mock result with helpful error message | STRING |
| MEDIUM | agent/memory/summarizer.py | 938 | # Create main MEMORY.md in workspace root (always needed for bootstrap) | COMMENT |
| MEDIUM | agent/chat/service.py | 359 | # Create a copy of messages for this execution | COMMENT |
| MEDIUM | agent/protocol/agent.py | 815 | # Create a copy of messages for this execution to avoid concurrent modification | COMMENT |
| MEDIUM | agent/prompt/workspace.py | 60 | # Create the memory subdirectory | COMMENT |
| MEDIUM | channel/web/api/models.py | 1721 | # Creating a new provider — api_base is mandatory. | COMMENT |
| MEDIUM | channel/wechatmp/passive_reply.py | 18 | # This class is instantiated once per query | COMMENT |
| MEDIUM | channel/wechatmp/active_reply.py | 14 | # This class is instantiated once per query | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | run.sh | 1251 | # Step 0: choose the install/UI language. Everything after this is localized. | COMMENT |
| LOW | agent/tools/vision/vision.py | 252 | # Step 1: preferred provider — explicit `tools.vision.provider` | COMMENT |
| LOW | agent/tools/vision/vision.py | 263 | # Step 2: auto-discovery chain as fallback | COMMENT |
| LOW⚡ | agent/memory/storage.py | 844 | # Step 2: Trigram FTS5 — CJK/mixed queries, plus fallback when unicode61 | COMMENT |
| LOW⚡ | agent/memory/storage.py | 854 | # Step 3: LIKE fallback — last resort (FTS5 unavailable, CJK queries | COMMENT |
| LOW | agent/memory/storage.py | 829 | # Step 1: Standard FTS5 (unicode61) — pure ASCII queries only. | COMMENT |
| LOW⚡ | agent/protocol/agent_stream.py | 464 | # Step 2: append a stable "interrupted" marker so the LLM sees a | COMMENT |
| LOW⚡ | agent/protocol/agent_stream.py | 2740 | # Step 0: Truncate large tool results in historical turns (30K -> 10K) | COMMENT |
| LOW⚡ | agent/protocol/agent_stream.py | 2743 | # Step 1: 识别完整轮次 | COMMENT |
| LOW⚡ | agent/protocol/agent_stream.py | 2749 | # Step 2: Calculate the token budget (context window - output reserve - system prompt) | COMMENT |
| LOW⚡ | agent/protocol/agent_stream.py | 2773 | # Step 3: Trim to satisfy BOTH constraints (AND): | COMMENT |
| LOW | agent/protocol/agent_stream.py | 432 | # Step 1: close any orphaned tool_use in the trailing assistant | COMMENT |
| LOW⚡ | channel/web/static/js/core/markdown.js | 214 | // Step 1: replace markdown-it anchor tags whose href points to a video file. | COMMENT |
| LOW⚡ | channel/web/static/js/core/markdown.js | 219 | // Step 2: replace any remaining bare video URLs in text nodes (not inside HTML tags). | COMMENT |
| LOW⚡ | channel/web/static/js/core/markdown.js | 237 | // Step 1: anchor whose href points to an image file -> replace with <img> preview. | COMMENT |
| LOW⚡ | channel/web/static/js/core/markdown.js | 242 | // Step 2: bare image URLs left in text nodes (rare — markdown-it's linkify usually catches them). | COMMENT |
| LOW | channel/web/static/js/views/tasks-modal.js | 105 | // Step 1: load the channel instances the console can deliver through, then wire | COMMENT |
| LOW | channel/web/static/js/views/tasks-modal.js | 156 | // Step 2: the recipient dropdown appears only after a channel is picked, listing | COMMENT |
| LOW | skills/skill-creator/SKILL.md | 135 | ### Step 1: Understanding the Skill with Concrete Examples | COMMENT |
| LOW | skills/skill-creator/SKILL.md | 152 | ### Step 2: Planning the Reusable Skill Contents | COMMENT |
| LOW | skills/skill-creator/SKILL.md | 185 | ### Step 3: Initialize the Skill | COMMENT |
| LOW | skills/skill-creator/SKILL.md | 220 | ### Step 4: Edit the Skill | COMMENT |
| LOW | skills/skill-creator/SKILL.md | 370 | ### Step 5: Validate (Optional) | COMMENT |
| LOW | skills/skill-creator/SKILL.md | 392 | ### Step 6: Iterate | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | run.sh | 1251 | # Step 0: choose the install/UI language. Everything after this is localized. | COMMENT |
| LOW | agent/tools/vision/vision.py | 252 | # Step 1: preferred provider — explicit `tools.vision.provider` | COMMENT |
| LOW | agent/tools/vision/vision.py | 263 | # Step 2: auto-discovery chain as fallback | COMMENT |
| LOW⚡ | agent/memory/storage.py | 844 | # Step 2: Trigram FTS5 — CJK/mixed queries, plus fallback when unicode61 | COMMENT |
| LOW⚡ | agent/memory/storage.py | 854 | # Step 3: LIKE fallback — last resort (FTS5 unavailable, CJK queries | COMMENT |
| LOW | agent/memory/storage.py | 829 | # Step 1: Standard FTS5 (unicode61) — pure ASCII queries only. | COMMENT |
| LOW⚡ | agent/protocol/agent_stream.py | 464 | # Step 2: append a stable "interrupted" marker so the LLM sees a | COMMENT |
| LOW⚡ | agent/protocol/agent_stream.py | 2740 | # Step 0: Truncate large tool results in historical turns (30K -> 10K) | COMMENT |
| LOW⚡ | agent/protocol/agent_stream.py | 2743 | # Step 1: 识别完整轮次 | COMMENT |
| LOW⚡ | agent/protocol/agent_stream.py | 2749 | # Step 2: Calculate the token budget (context window - output reserve - system prompt) | COMMENT |
| LOW⚡ | agent/protocol/agent_stream.py | 2773 | # Step 3: Trim to satisfy BOTH constraints (AND): | COMMENT |
| LOW | agent/protocol/agent_stream.py | 432 | # Step 1: close any orphaned tool_use in the trailing assistant | COMMENT |
| LOW⚡ | channel/web/static/js/core/markdown.js | 214 | // Step 1: replace markdown-it anchor tags whose href points to a video file. | COMMENT |
| LOW⚡ | channel/web/static/js/core/markdown.js | 219 | // Step 2: replace any remaining bare video URLs in text nodes (not inside HTML tags). | COMMENT |
| LOW⚡ | channel/web/static/js/core/markdown.js | 237 | // Step 1: anchor whose href points to an image file -> replace with <img> preview. | COMMENT |
| LOW⚡ | channel/web/static/js/core/markdown.js | 242 | // Step 2: bare image URLs left in text nodes (rare — markdown-it's linkify usually catches them). | COMMENT |
| LOW | channel/web/static/js/views/tasks-modal.js | 105 | // Step 1: load the channel instances the console can deliver through, then wire | COMMENT |
| LOW | channel/web/static/js/views/tasks-modal.js | 156 | // Step 2: the recipient dropdown appears only after a channel is picked, listing | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| CRITICAL | tests/test_browser_scroll_amount.py | 25 | assert tool._service.scroll.call_args.kwargs.get("amount", 500) == expected | CODE |
| CRITICAL | agent/tools/browser/browser_service.py | 640 | return pw._impl_obj._connection._transport.on_error_future.done() | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | agent/admin.py | 376 | CODE | |
| LOW | agent/admin.py | 479 | CODE | |
| LOW | agent/memory/conversation_store.py | 1331 | CODE | |
| LOW | agent/memory/conversation_store.py | 1517 | CODE | |
| LOW | agent/memory/embedding/provider.py | 191 | CODE | |
| LOW | agent/protocol/agent.py | 98 | CODE | |
| LOW | agent/prompt/builder.py | 83 | CODE | |
| LOW | agent/prompt/builder.py | 38 | CODE | |
| LOW | agent/skills/loader.py | 74 | CODE | |
| LOW | models/xunfei/xunfei_spark_bot.py | 267 | CODE | |
| LOW | models/xunfei/xunfei_spark_bot.py | 181 | CODE | |
| LOW | models/openai/openai_http_client.py | 205 | CODE | |
| LOW | models/openai/openai_http_client.py | 238 | CODE | |
| LOW | channel/web/core/_common.py | 550 | CODE | |
| LOW | voice/ali/ali_api.py | 189 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | config.py | 470 | # the log with a full traceback here — just return it unmasked. | COMMENT |
| LOW | agent/memory/manager.py | 265 | # No embeddings, just use None | COMMENT |
| MEDIUM | agent/memory/manager.py | 382 | # on any sibling helpers — keeps it robust against partial reloads | COMMENT |
| MEDIUM | agent/evolution/executor.py | 549 | # plus legacy watched changes used by the deterministic test harness. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/test_terminal_image_download.py | 106 | response = FakeResponse([b"placeholder"]) | CODE |
| LOW | agent/tools/browser/browser_service.py | 382 | for attr in ("type", "name", "href", "alt", "role", "ariaLabel", "placeholder", "value"): | CODE |