Open-source super AI assistant & Agent Harness. Plans tasks, runs tools and skills, self-evolves with memory and knowledge. Multi-model, multi-channel. Lightweight, extensible, one-line install. (formerly chatgpt-on-wechat)
This report presents the forensic synthetic code analysis of zhayujie/CowAgent, a Python project with 46,710 GitHub stars. SynthScan v2.0 examined 158,289 lines of code across 547 source files, recording 3372 pattern matches distributed across 18 syntactic categories. The overall adjusted score of 28.3 places this repository in the Moderate AI signal band.
The scanner applied 160+ deterministic lexical heuristics, multi-line block detectors, abstract syntax tree depth profilers, and a cross-file Jaccard similarity matrix to construct a statistically normalised synthetic code estimate. All matches are individually weighted by severity coefficient and contextual multiplier before summation, and the resulting headline score is temporally discounted to account for the repository's development history relative to the commercial emergence of large language model coding tooling (November 2022 onward).
This chart maps the temporal evolution of the adjusted synthetic code score across successive scan runs. An upward trajectory indicates ongoing incorporation of AI-generated code or expanding LLM-assisted scaffolding; a stable or declining trajectory may reflect active human refactoring, code removal, or the adoption of stricter authorship policies. The dashed secondary line (right axis) independently tracks total raw pattern hit count, which can diverge from the normalised score when codebase size changes significantly between scans.
Classifies detected patterns by their diagnostic confidence and structural impact. CRITICAL patterns (coefficient 10) represent definitive synthetic signatures — hallucinated imports, explicit LLM attribution metadata — virtually never produced by human authors. HIGH (5) indicates strong structural tells such as cross-file repetition or cross-linguistic idioms. MEDIUM (2) covers recognisable conversational padding and AI-specific vocabulary. LOW (1) captures subtle indicators like tautological comments and generic boilerplate that require density to carry independent signal.
This horizontal bar chart decomposes the repository's raw synthetic code score by top-level directory, allowing you to pinpoint precisely which modules or components carry the highest AI authorship density. Directories with disproportionately high scores relative to their size warrant targeted manual review: concentrated AI signatures often trace back to mass-generated configuration layers, auto-ported test suites, LLM-scaffolded boilerplate classes, or entire subsystems authored under heavy copilot assistance. Use this view to prioritise your human code-review effort.
The scanner identified 3372 distinct pattern matches across 18 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a statistically significant AI authorship indicator. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the diagnostic confidence level (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — comment-context matches receive a ×1.5 weight because LLMs systematically over-annotate. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier as dense clusters constitute far stronger evidence of synthetic authorship than isolated hits.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | run.sh | 4 | # ============================ | COMMENT |
| MEDIUM | run.sh | 6 | # ============================ | COMMENT |
| MEDIUM⚡ | run.sh | 31 | # ============================ | COMMENT |
| MEDIUM⚡ | run.sh | 33 | # ============================ | COMMENT |
| MEDIUM⚡ | plugins/cow_cli/cow_cli.py | 345 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM⚡ | plugins/cow_cli/cow_cli.py | 347 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | plugins/cow_cli/cow_cli.py | 300 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | plugins/cow_cli/cow_cli.py | 302 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | plugins/cow_cli/cow_cli.py | 415 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | plugins/cow_cli/cow_cli.py | 419 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | plugins/cow_cli/cow_cli.py | 493 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | plugins/cow_cli/cow_cli.py | 497 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | plugins/cow_cli/cow_cli.py | 538 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | plugins/cow_cli/cow_cli.py | 540 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | plugins/cow_cli/cow_cli.py | 587 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | plugins/cow_cli/cow_cli.py | 589 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | plugins/cow_cli/cow_cli.py | 624 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | plugins/cow_cli/cow_cli.py | 626 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | plugins/cow_cli/cow_cli.py | 689 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | plugins/cow_cli/cow_cli.py | 691 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | plugins/cow_cli/cow_cli.py | 726 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | plugins/cow_cli/cow_cli.py | 728 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | plugins/cow_cli/cow_cli.py | 894 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | plugins/cow_cli/cow_cli.py | 896 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | plugins/cow_cli/cow_cli.py | 947 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | plugins/cow_cli/cow_cli.py | 949 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | plugins/cow_cli/cow_cli.py | 1349 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | plugins/cow_cli/cow_cli.py | 1351 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | plugins/cow_cli/cow_cli.py | 1740 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | plugins/cow_cli/cow_cli.py | 1742 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | plugins/cow_cli/cow_cli.py | 1867 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | plugins/cow_cli/cow_cli.py | 1869 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM⚡ | tests/test_security_ssrf_path_traversal.py | 138 | # ============================================================================= | COMMENT |
| MEDIUM⚡ | tests/test_security_ssrf_path_traversal.py | 140 | # ============================================================================= | COMMENT |
| MEDIUM | tests/test_security_ssrf_path_traversal.py | 23 | # ============================================================================= | COMMENT |
| MEDIUM | tests/test_security_ssrf_path_traversal.py | 25 | # ============================================================================= | COMMENT |
| MEDIUM | tests/test_robustness_fixes.py | 20 | # ============================================================================= | COMMENT |
| MEDIUM | tests/test_robustness_fixes.py | 22 | # ============================================================================= | COMMENT |
| MEDIUM⚡ | tests/test_robustness_fixes.py | 67 | # ============================================================================= | COMMENT |
| MEDIUM⚡ | tests/test_robustness_fixes.py | 69 | # ============================================================================= | COMMENT |
| MEDIUM⚡ | tests/test_mcp_tool_retrieval.py | 66 | # -------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_mcp_tool_retrieval.py | 68 | # -------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_mcp_tool_retrieval.py | 107 | # -------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_mcp_tool_retrieval.py | 109 | # -------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_mcp_tool_retrieval.py | 125 | # -------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_mcp_tool_retrieval.py | 127 | # -------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_mcp_tool_retrieval.py | 167 | # -------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_mcp_tool_retrieval.py | 169 | # -------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_bash_config_propagation.py | 17 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_bash_config_propagation.py | 19 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_bash_config_propagation.py | 44 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_bash_config_propagation.py | 46 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_bash_config_propagation.py | 105 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_bash_config_propagation.py | 107 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_bash_config_propagation.py | 182 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_bash_config_propagation.py | 184 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_evolution.py | 93 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_evolution.py | 95 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_evolution.py | 28 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_evolution.py | 30 | # --------------------------------------------------------------------------- | COMMENT |
| 311 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | config.py | 438 | def _quarantine_corrupted_config(config_path): | CODE |
| LOW | config.py | 403 | def _mask_sensitive_recursive(obj): | CODE |
| LOW | config.py | 745 | def _sync_skill_config_to_env(skill_section) -> int: | CODE |
| LOW | config.py | 775 | def sync_image_generation_custom_provider_env( | CODE |
| LOW | config.py | 893 | def get_weixin_credentials_path(): | CODE |
| LOW⚡ | app.py | 492 | def _scaffold_subagent_assets(): | CODE |
| LOW | app.py | 416 | def _warn_if_legacy_workspace_data_exists(): | CODE |
| LOW | plugins/plugin_manager.py | 213 | def _apply_desktop_plugin_denylist(self): | CODE |
| LOW | plugins/cow_cli/cow_cli.py | 859 | def _resolve_bot_type_for_model(model_name: str) -> str: | CODE |
| LOW | plugins/cow_cli/cow_cli.py | 1441 | def _resolve_active_embedding(): | CODE |
| LOW | plugins/cow_cli/cow_cli.py | 1727 | def _create_standalone_flush_manager(): | CODE |
| LOW | bridge/agent_bridge.py | 29 | def add_openai_compatible_support(bot_instance): | CODE |
| LOW | bridge/agent_bridge.py | 173 | def _normalized_reasoning_effort(self): | CODE |
| LOW | bridge/agent_bridge.py | 659 | def sync_session_messages_from_store( | CODE |
| LOW | bridge/agent_bridge.py | 1144 | def _pre_persist_user_message( | CODE |
| LOW | bridge/agent_bridge.py | 1258 | def remember_scheduled_output( | CODE |
| LOW | bridge/agent_bridge.py | 1390 | def _prune_scheduled_in_memory(cls, agent, keep_last_n: int) -> None: | CODE |
| LOW | bridge/agent_bridge.py | 1554 | def _refresh_conditional_tools(agent): | CODE |
| LOW⚡ | bridge/agent_initializer.py | 573 | def _initialize_skill_manager(self, workspace_root: str, session_id: Optional[str] = None): | CODE |
| LOW | bridge/agent_initializer.py | 163 | def _restore_conversation_history(self, agent, session_id: str) -> None: | CODE |
| LOW | bridge/agent_initializer.py | 212 | def _filter_text_only_messages(messages: list) -> list: | CODE |
| LOW | bridge/agent_event_handler.py | 83 | def _handle_tool_execution_start(self, data): | CODE |
| LOW | bridge/agent_event_handler.py | 86 | def _handle_tool_execution_end(self, data): | CODE |
| LOW | tests/test_image_generation_custom_provider.py | 43 | def test_sync_selected_custom_image_provider_to_env(monkeypatch): | CODE |
| LOW | tests/test_image_generation_custom_provider.py | 63 | def test_build_providers_uses_explicit_custom_provider(monkeypatch): | CODE |
| LOW | tests/test_image_generation_custom_provider.py | 84 | def test_build_providers_does_not_fallback_for_missing_custom_provider( | CODE |
| LOW | tests/test_time_check.py | 16 | def test_default_end_of_day_stop_time_allows_messages(self): | CODE |
| LOW⚡ | tests/test_reasoning_capabilities.py | 135 | def test_linkai_hides_unsupported_or_unverified_passthrough_models(): | CODE |
| LOW⚡ | tests/test_reasoning_capabilities.py | 141 | def test_openai_is_hidden_until_responses_api_runtime_support_exists(): | CODE |
| LOW⚡ | tests/test_reasoning_capabilities.py | 147 | def test_custom_provider_is_hidden_by_default(): | CODE |
| LOW⚡ | tests/test_reasoning_capabilities.py | 153 | def test_unsupported_provider_returns_hidden_capability(): | CODE |
| LOW⚡ | tests/test_reasoning_capabilities.py | 159 | def test_normalize_returns_provider_default_for_invalid_value(): | CODE |
| LOW⚡ | tests/test_reasoning_capabilities.py | 189 | def test_resolve_returns_stored_per_model_value_without_rewriting(): | CODE |
| LOW⚡ | tests/test_reasoning_capabilities.py | 195 | def test_resolve_prefers_raw_provider_key_over_base_key(): | CODE |
| LOW⚡ | tests/test_reasoning_capabilities.py | 202 | def test_resolve_falls_back_to_base_provider_key(): | CODE |
| LOW⚡ | tests/test_reasoning_capabilities.py | 209 | def test_resolve_falls_back_to_legacy_global_value_when_no_per_model_entry(): | CODE |
| LOW⚡ | tests/test_reasoning_capabilities.py | 213 | def test_resolve_invalid_stored_value_falls_to_model_default_not_remap(): | CODE |
| LOW⚡ | tests/test_reasoning_capabilities.py | 218 | def test_resolve_does_not_apply_legacy_remap_to_valid_per_model_value(): | CODE |
| LOW⚡ | tests/test_reasoning_capabilities.py | 223 | def test_resolve_unsupported_provider_returns_none(): | CODE |
| LOW⚡ | tests/test_reasoning_capabilities.py | 227 | def test_resolve_non_dict_by_model_degrades_to_legacy(): | CODE |
| LOW | tests/test_reasoning_capabilities.py | 17 | def test_deepseek_exposes_native_effort_values(): | CODE |
| LOW | tests/test_reasoning_capabilities.py | 31 | def test_zhipu_exposes_native_effort_values_without_disable_aliases(): | CODE |
| LOW | tests/test_reasoning_capabilities.py | 58 | def test_older_claude_models_hide_effort_control(): | CODE |
| LOW | tests/test_reasoning_capabilities.py | 75 | def test_dashscope_glm_exposes_high_max_effort_values(): | CODE |
| LOW | tests/test_reasoning_capabilities.py | 83 | def test_dashscope_deepseek_keeps_the_model_native_effort_values(): | CODE |
| LOW | tests/test_reasoning_capabilities.py | 99 | def test_dashscope_other_qwen_models_hide_effort_control(): | CODE |
| LOW | tests/test_reasoning_capabilities.py | 118 | def test_linkai_exposes_known_passthrough_effort_models(): | CODE |
| LOW | tests/test_reasoning_capabilities.py | 244 | def test_normalization_always_outputs_valid_native_enum(): | CODE |
| LOW | tests/test_agent_delegation.py | 63 | def test_policy_defaults_to_other_agents_and_honors_allowlist(): | CODE |
| LOW | tests/test_agent_delegation.py | 75 | def test_delegate_lists_only_enabled_allowed_targets(): | CODE |
| LOW | tests/test_agent_delegation.py | 87 | def test_delegate_runs_target_with_source_attribution_and_private_relay_session(): | CODE |
| LOW | tests/test_agent_delegation.py | 107 | def test_delegate_rejects_disabled_unknown_and_disallowed_targets(): | CODE |
| LOW | tests/test_agent_delegation.py | 124 | def test_delegate_rejects_cycles_and_depth_overflow(): | CODE |
| LOW | tests/test_agent_delegation.py | 145 | def test_delegate_enforces_message_limit(): | CODE |
| LOW | tests/test_agent_delegation.py | 175 | def test_delegate_timeout_cancels_target_run_without_blocking_caller(): | CODE |
| LOW | tests/test_claude_effort.py | 8 | def test_claude_tool_call_maps_reasoning_effort_to_output_config(monkeypatch): | CODE |
| LOW | tests/test_claude_effort.py | 29 | def test_claude_tool_call_preserves_existing_output_config(monkeypatch): | CODE |
| LOW | tests/test_custom_provider.py | 70 | def test_legacy_fallback_when_no_providers(self): | CODE |
| LOW | tests/test_custom_provider.py | 87 | def test_provider_selected_by_id(self): | CODE |
| LOW | tests/test_custom_provider.py | 102 | def test_id_not_found_falls_back_to_legacy(self): | CODE |
| 952 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | config.py | 371 | def load_user_datas(self): | CODE |
| MEDIUM | config.py | 382 | def save_user_datas(self): | CODE |
| MEDIUM | config.py | 418 | def drag_sensitive(config): | CODE |
| LOW⚡ | config.py | 432 | except Exception as e: | CODE |
| LOW | config.py | 356 | except Exception as e: | CODE |
| LOW | config.py | 378 | except Exception as e: | CODE |
| LOW | config.py | 389 | except Exception as e: | CODE |
| LOW | config.py | 449 | except Exception as e: | CODE |
| LOW | config.py | 508 | except Exception as write_err: | CODE |
| LOW | config.py | 546 | except Exception: | CODE |
| LOW | config.py | 702 | except Exception: | CODE |
| LOW | config.py | 855 | except Exception as e: | CODE |
| LOW⚡ | app.py | 481 | except Exception as e: | CODE |
| LOW⚡ | app.py | 488 | except Exception as e: | CODE |
| LOW | app.py | 93 | except Exception as e: | CODE |
| LOW | app.py | 131 | except Exception: | CODE |
| LOW | app.py | 156 | except Exception as e: | CODE |
| LOW | app.py | 197 | except Exception as e: | CODE |
| LOW | app.py | 225 | except Exception as e: | CODE |
| LOW | app.py | 309 | except Exception as e: | CODE |
| LOW | app.py | 343 | except Exception as e: | CODE |
| LOW | app.py | 352 | except Exception as e: | CODE |
| LOW | app.py | 368 | except Exception as e: | CODE |
| LOW | app.py | 398 | except Exception: | CODE |
| LOW | app.py | 412 | except Exception as e: | CODE |
| LOW | app.py | 448 | except Exception as e: | CODE |
| LOW | app.py | 527 | except Exception as e: | CODE |
| LOW | app.py | 534 | except Exception as e: | CODE |
| LOW | app.py | 597 | except Exception as e: | CODE |
| LOW | plugins/plugin.py | 43 | except Exception as e: | CODE |
| LOW | plugins/plugin_manager.py | 111 | except Exception as e: | CODE |
| LOW | plugins/plugin_manager.py | 139 | except Exception as e: | CODE |
| LOW | plugins/plugin_manager.py | 176 | except Exception as e: | CODE |
| LOW | plugins/plugin_manager.py | 300 | except Exception as e: | CODE |
| LOW⚡ | plugins/plugin_manager.py | 322 | except Exception as e: | CODE |
| LOW⚡ | plugins/plugin_manager.py | 332 | except Exception as e: | CODE |
| LOW⚡ | plugins/plugin_manager.py | 341 | except Exception as e: | CODE |
| LOW | plugins/plugin_manager.py | 367 | except Exception as e: | CODE |
| LOW | plugins/plugin_manager.py | 391 | except Exception as e: | CODE |
| LOW | plugins/role/role.py | 78 | except Exception as e: | CODE |
| LOW | plugins/role/role.py | 103 | except Exception as e: | CODE |
| LOW | plugins/linkai/linkai.py | 296 | except Exception as e: | CODE |
| LOW | plugins/linkai/midjourney.py | 293 | except Exception as e: | CODE |
| LOW | plugins/linkai/midjourney.py | 437 | except Exception as e: | CODE |
| LOW | plugins/linkai/utils.py | 49 | except Exception as e: | CODE |
| MEDIUM | plugins/cow_cli/cow_cli.py | 1412 | def _run(): | CODE |
| MEDIUM | plugins/cow_cli/cow_cli.py | 1587 | def _run(): | CODE |
| LOW⚡ | plugins/cow_cli/cow_cli.py | 339 | except Exception as e: | CODE |
| LOW | plugins/cow_cli/cow_cli.py | 100 | except Exception as e: | CODE |
| LOW | plugins/cow_cli/cow_cli.py | 513 | except Exception: | CODE |
| LOW | plugins/cow_cli/cow_cli.py | 608 | except Exception as e: | CODE |
| LOW | plugins/cow_cli/cow_cli.py | 829 | except Exception as e: | CODE |
| LOW | plugins/cow_cli/cow_cli.py | 850 | except Exception as e: | CODE |
| LOW | plugins/cow_cli/cow_cli.py | 911 | except Exception as e: | CODE |
| LOW | plugins/cow_cli/cow_cli.py | 1002 | except Exception as e: | CODE |
| LOW | plugins/cow_cli/cow_cli.py | 1083 | except Exception as e: | CODE |
| LOW | plugins/cow_cli/cow_cli.py | 1128 | except Exception as e: | CODE |
| LOW | plugins/cow_cli/cow_cli.py | 1176 | except Exception as e: | CODE |
| LOW | plugins/cow_cli/cow_cli.py | 1229 | except Exception: | CODE |
| LOW | plugins/cow_cli/cow_cli.py | 1334 | except Exception as e: | CODE |
| 987 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | config.py | 4 | CODE | |
| LOW | app.py | 14 | CODE | |
| LOW | plugins/__init__.py | 1 | CODE | |
| LOW | plugins/__init__.py | 2 | CODE | |
| LOW | plugins/plugin.py | 3 | CODE | |
| LOW | plugins/plugin_manager.py | 12 | CODE | |
| LOW | plugins/plugin_manager.py | 14 | CODE | |
| LOW | plugins/role/__init__.py | 1 | CODE | |
| LOW | plugins/role/role.py | 13 | CODE | |
| LOW | plugins/linkai/__init__.py | 1 | CODE | |
| LOW | plugins/linkai/linkai.py | 4 | CODE | |
| LOW | plugins/linkai/linkai.py | 12 | CODE | |
| LOW | plugins/dungeon/dungeon.py | 11 | CODE | |
| LOW | plugins/dungeon/__init__.py | 1 | CODE | |
| LOW | plugins/finish/__init__.py | 1 | CODE | |
| LOW | plugins/finish/finish.py | 8 | CODE | |
| LOW | plugins/cow_cli/__init__.py | 1 | CODE | |
| LOW | plugins/cow_cli/cow_cli.py | 1729 | CODE | |
| LOW | plugins/godcmd/godcmd.py | 10 | CODE | |
| LOW | plugins/godcmd/godcmd.py | 17 | CODE | |
| LOW | plugins/godcmd/__init__.py | 1 | CODE | |
| LOW | plugins/hello/hello.py | 8 | CODE | |
| LOW | plugins/hello/__init__.py | 1 | CODE | |
| LOW | plugins/banwords/banwords.py | 10 | CODE | |
| LOW | plugins/banwords/__init__.py | 1 | CODE | |
| LOW | plugins/keyword/__init__.py | 1 | CODE | |
| LOW | plugins/keyword/keyword.py | 10 | CODE | |
| LOW | plugins/tool/tool.py | 10 | CODE | |
| LOW | plugins/tool/tool.py | 11 | CODE | |
| LOW | tests/test_tool_path_and_eval.py | 8 | CODE | |
| LOW | tests/test_robustness_fixes.py | 13 | CODE | |
| LOW | tests/test_robustness_fixes.py | 77 | CODE | |
| LOW | tests/test_bash_background.py | 9 | CODE | |
| LOW | tests/test_syntax_gate.py | 72 | CODE | |
| LOW | tests/test_syntax_gate.py | 80 | CODE | |
| LOW | tests/test_syntax_gate.py | 90 | CODE | |
| LOW | tests/test_web_bind_failure.py | 18 | CODE | |
| LOW | tests/test_config_subagent_toggle.py | 20 | CODE | |
| LOW | tests/test_evolution.py | 559 | CODE | |
| LOW | tests/test_evolution.py | 662 | CODE | |
| LOW | tests/test_minimax_provider.py | 10 | CODE | |
| LOW | tests/test_minimax_provider.py | 12 | CODE | |
| LOW | tests/test_minimax_provider.py | 75 | CODE | |
| LOW | tests/test_knowledge_service.py | 3 | CODE | |
| LOW | agent/registry.py | 8 | CODE | |
| LOW | agent/routing.py | 3 | CODE | |
| LOW | agent/routing.py | 9 | CODE | |
| LOW | agent/tools/tool_manager.py | 5 | CODE | |
| LOW | agent/tools/tool_manager.py | 5 | CODE | |
| LOW | agent/tools/__init__.py | 2 | CODE | |
| LOW | agent/tools/__init__.py | 3 | CODE | |
| LOW | agent/tools/__init__.py | 6 | CODE | |
| LOW | agent/tools/__init__.py | 7 | CODE | |
| LOW | agent/tools/__init__.py | 8 | CODE | |
| LOW | agent/tools/__init__.py | 9 | CODE | |
| LOW | agent/tools/__init__.py | 10 | CODE | |
| LOW | agent/tools/__init__.py | 11 | CODE | |
| LOW | agent/tools/__init__.py | 12 | CODE | |
| LOW | agent/tools/__init__.py | 15 | CODE | |
| LOW | agent/tools/__init__.py | 16 | CODE | |
| 252 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | config.py | 453 | CODE | |
| LOW | config.py | 707 | CODE | |
| LOW | app.py | 269 | CODE | |
| LOW | app.py | 452 | CODE | |
| LOW | app.py | 492 | CODE | |
| LOW | app.py | 67 | CODE | |
| LOW | app.py | 169 | CODE | |
| LOW | plugins/plugin_manager.py | 114 | CODE | |
| LOW | plugins/plugin_manager.py | 167 | CODE | |
| LOW | plugins/plugin_manager.py | 238 | CODE | |
| LOW | plugins/plugin_manager.py | 295 | CODE | |
| LOW | plugins/role/role.py | 44 | CODE | |
| LOW | plugins/role/role.py | 85 | CODE | |
| LOW | plugins/role/role.py | 106 | CODE | |
| LOW | plugins/role/role.py | 127 | CODE | |
| LOW | plugins/linkai/midjourney.py | 81 | CODE | |
| LOW | plugins/linkai/midjourney.py | 106 | CODE | |
| LOW | plugins/linkai/midjourney.py | 270 | CODE | |
| LOW | plugins/linkai/utils.py | 33 | CODE | |
| LOW | plugins/dungeon/dungeon.py | 64 | CODE | |
| LOW | plugins/cow_cli/cow_cli.py | 457 | CODE | |
| LOW | plugins/cow_cli/cow_cli.py | 951 | CODE | |
| LOW | plugins/cow_cli/cow_cli.py | 1005 | CODE | |
| LOW | plugins/cow_cli/cow_cli.py | 1353 | CODE | |
| LOW | plugins/godcmd/godcmd.py | 214 | CODE | |
| LOW | plugins/banwords/banwords.py | 24 | CODE | |
| LOW | plugins/banwords/lib/WordsSearch.py | 78 | CODE | |
| LOW | plugins/banwords/lib/WordsSearch.py | 186 | CODE | |
| LOW | plugins/banwords/lib/WordsSearch.py | 229 | CODE | |
| LOW | plugins/keyword/keyword.py | 47 | CODE | |
| LOW | plugins/tool/tool.py | 49 | CODE | |
| LOW | bridge/agent_bridge.py | 207 | CODE | |
| LOW | bridge/agent_bridge.py | 272 | CODE | |
| LOW | bridge/agent_bridge.py | 398 | CODE | |
| LOW | bridge/agent_bridge.py | 709 | CODE | |
| LOW | bridge/agent_bridge.py | 1074 | CODE | |
| LOW | bridge/agent_bridge.py | 1390 | CODE | |
| LOW | bridge/agent_bridge.py | 1400 | CODE | |
| LOW | bridge/agent_initializer.py | 163 | CODE | |
| LOW | bridge/agent_initializer.py | 212 | CODE | |
| LOW | bridge/agent_initializer.py | 399 | CODE | |
| LOW | bridge/agent_initializer.py | 508 | CODE | |
| LOW | bridge/agent_initializer.py | 633 | CODE | |
| LOW | bridge/agent_initializer.py | 731 | CODE | |
| LOW | bridge/agent_event_handler.py | 35 | CODE | |
| LOW | bridge/bridge.py | 134 | CODE | |
| LOW | tests/test_web_sse_replay.py | 44 | CODE | |
| LOW | tests/test_models_handler.py | 143 | CODE | |
| LOW | tests/test_models_handler.py | 168 | CODE | |
| LOW | tests/test_evolution.py | 557 | CODE | |
| LOW | tests/test_evolution.py | 718 | CODE | |
| LOW | agent/registry.py | 273 | CODE | |
| LOW | agent/tools/tool_manager.py | 136 | CODE | |
| LOW | agent/tools/tool_manager.py | 206 | CODE | |
| LOW | agent/tools/tool_manager.py | 260 | CODE | |
| LOW | agent/tools/tool_manager.py | 472 | CODE | |
| LOW | agent/tools/write/write.py | 44 | CODE | |
| LOW | agent/tools/web_fetch/web_fetch.py | 198 | CODE | |
| LOW | agent/tools/web_fetch/web_fetch.py | 267 | CODE | |
| LOW | agent/tools/web_fetch/web_fetch.py | 346 | CODE | |
| 291 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH⚡ | tests/test_bash_exit_codes.py | 39 | chain = 'find / -iname "*x*" 2>/dev/null; echo "---"; find ~ -iname "*y*" 2>/dev/null' | CODE |
| HIGH | agent/tools/bash/bash.py | 591 | corrections.append("chain commands with && instead of ;") | STRING |
| HIGH⚡ | agent/tools/browser/browser_service.py | 134 | return t ? t : null; | CODE |
| HIGH⚡ | agent/tools/browser/browser_service.py | 136 | if (node.nodeType !== Node.ELEMENT_NODE) return null; | CODE |
| HIGH⚡ | agent/tools/browser/browser_service.py | 138 | if (SKIP.has(tag)) return null; | CODE |
| HIGH⚡ | agent/tools/browser/browser_service.py | 139 | if (!visible(node)) return null; | CODE |
| HIGH⚡ | agent/tools/browser/browser_service.py | 144 | if (r !== null) { | CODE |
| HIGH⚡ | agent/tools/browser/browser_service.py | 145 | if (typeof r === "string") children.push(r); | CODE |
| HIGH⚡ | agent/tools/browser/browser_service.py | 146 | else children.push(r); | CODE |
| HIGH⚡ | agent/tools/browser/browser_service.py | 155 | if (children.length === 0) return null; | CODE |
| HIGH⚡ | agent/tools/browser/browser_service.py | 161 | if (nativeInteractive || implicitInteractive) { | CODE |
| HIGH⚡ | agent/tools/browser/browser_service.py | 171 | if (!directText && children.length === 0) { | CODE |
| HIGH⚡ | agent/tools/browser/browser_service.py | 187 | obj.name = node.name || undefined; | CODE |
| HIGH⚡ | agent/tools/browser/browser_service.py | 187 | obj.name = node.name || undefined; | CODE |
| HIGH⚡ | agent/tools/browser/browser_service.py | 188 | obj.value = node.value || undefined; | CODE |
| HIGH⚡ | agent/tools/browser/browser_service.py | 188 | obj.value = node.value || undefined; | CODE |
| HIGH⚡ | agent/tools/browser/browser_service.py | 189 | obj.placeholder = node.placeholder || undefined; | CODE |
| HIGH⚡ | agent/tools/browser/browser_service.py | 189 | obj.placeholder = node.placeholder || undefined; | CODE |
| HIGH | agent/tools/browser/browser_service.py | 82 | if (role && CLICKABLE_ROLES.has(role)) return true; | CODE |
| HIGH | agent/tools/browser/browser_service.py | 109 | if (ariaLabel && ariaLabel.trim()) return true; | CODE |
| HIGH | agent/tools/browser/browser_service.py | 111 | if (title && title.trim()) return true; | CODE |
| HIGH | agent/tools/browser/browser_service.py | 211 | if (children.length === 1 && typeof children[0] === "string") { | CODE |
| HIGH | agent/tools/browser/browser_service.py | 1127 | const el = window.__cowRefMap && window.__cowRefMap[{ref}]; | CODE |
| HIGH | agent/tools/browser/browser_service.py | 1155 | const el = window.__cowRefMap && window.__cowRefMap[{ref}]; | CODE |
| HIGH | agent/tools/browser/browser_service.py | 1184 | const el = window.__cowRefMap && window.__cowRefMap[{ref}]; | CODE |
| HIGH | agent/tools/browser/browser_service.py | 1185 | if (!el || el.tagName.toLowerCase() !== "select") | CODE |
| HIGH | channel/web/web_channel.py | 6604 | """Bind a session to a project directory, or clear it (project_dir=null).""" | STRING |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | models/openai_compatible_bot.py | 0 | convert tools from claude format to dashscope format claude format: {name, description, input_schema} dashscope format: | STRING |
| HIGH | models/zhipuai/zhipuai_bot.py | 0 | convert tools from claude format to dashscope format claude format: {name, description, input_schema} dashscope format: | STRING |
| HIGH | models/dashscope/dashscope_bot.py | 0 | convert tools from claude format to dashscope format claude format: {name, description, input_schema} dashscope format: | STRING |
| HIGH | models/moonshot/moonshot_bot.py | 0 | convert tools from claude format to openai format. claude: {name, description, input_schema} openai: {type: "function", | STRING |
| HIGH | models/doubao/doubao_bot.py | 0 | convert tools from claude format to openai format. claude: {name, description, input_schema} openai: {type: "function", | STRING |
| HIGH | models/deepseek/deepseek_bot.py | 0 | convert tools from claude format to openai format. claude: {name, description, input_schema} openai: {type: "function", | STRING |
| HIGH | models/baidu/baidu_wenxin_session.py | 0 | returns the number of tokens used by a list of messages. | STRING |
| HIGH | models/minimax/minimax_session.py | 0 | returns the number of tokens used by a list of messages. | STRING |
| HIGH | models/chatgpt/chat_gpt_session.py | 0 | returns the number of tokens used by a list of messages. | STRING |
| HIGH | models/linkai/link_ai_bot.py | 0 | get api configuration for openai-compatible base class | STRING |
| HIGH | models/chatgpt/chat_gpt_bot.py | 0 | get api configuration for openai-compatible base class | STRING |
| HIGH | models/openai/open_ai_bot.py | 0 | get api configuration for openai-compatible base class | STRING |
| HIGH | channel/discord/discord_channel.py | 0 | fast-path: /cancel calls cancel_session directly without going through agent. | STRING |
| HIGH | channel/telegram/telegram_channel.py | 0 | fast-path: /cancel calls cancel_session directly without going through agent. | STRING |
| HIGH | channel/slack/slack_channel.py | 0 | fast-path: /cancel calls cancel_session directly without going through agent. | STRING |
| HIGH | channel/discord/discord_channel.py | 0 | split long text preferring line breaks to keep markdown structure intact. | STRING |
| HIGH | channel/telegram/telegram_channel.py | 0 | split long text preferring line breaks to keep markdown structure intact. | STRING |
| HIGH | channel/slack/slack_channel.py | 0 | split long text preferring line breaks to keep markdown structure intact. | STRING |
| HIGH | channel/discord/discord_message.py | 0 | local download directory, aligned with other channels (workspace tmp). | STRING |
| HIGH | channel/telegram/telegram_message.py | 0 | local download directory, aligned with other channels (workspace tmp). | STRING |
| HIGH | channel/slack/slack_message.py | 0 | local download directory, aligned with other channels (workspace tmp). | STRING |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | config.py | 283 | # Set enabled to false to withhold the subagent tool entirely. | COMMENT |
| LOW⚡ | run.sh | 25 | # Check if using Bash | COMMENT |
| LOW | run.sh | 1034 | # Check if service is running | COMMENT |
| LOW | run.sh | 1039 | # Check if cow CLI is available | COMMENT |
| LOW | bridge/agent_bridge.py | 938 | # Check if there are files to send (from send/read tool) | COMMENT |
| LOW | agent/tools/tool_manager.py | 146 | # Check if __all__ is defined | COMMENT |
| LOW | agent/tools/write/write.py | 89 | # Write file | COMMENT |
| LOW | agent/tools/read/read.py | 157 | # Check if file exists. Both misses below name the tool that answers | COMMENT |
| LOW⚡ | agent/tools/read/read.py | 178 | # Check if readable | COMMENT |
| LOW⚡ | agent/tools/read/read.py | 186 | # Check if image - return metadata for sending | COMMENT |
| LOW⚡ | agent/tools/read/read.py | 190 | # Check if video/audio/binary/archive - return metadata only | COMMENT |
| LOW⚡ | agent/tools/read/read.py | 198 | # Check if PDF | COMMENT |
| LOW⚡ | agent/tools/read/read.py | 202 | # Check if Office document (.docx, .xlsx, .pptx, etc.) | COMMENT |
| LOW | agent/tools/read/read.py | 418 | # Read file (utf-8-sig strips BOM automatically on Windows) | COMMENT |
| LOW | agent/tools/scheduler/scheduler_tool.py | 354 | # Check if it's relative time (e.g., "+5s", "+10m", "+1h", "+1d") | COMMENT |
| LOW | agent/tools/utils/truncate.py | 100 | # Check if no truncation is needed | COMMENT |
| LOW | agent/tools/utils/truncate.py | 116 | # Check if first line alone exceeds byte limit | COMMENT |
| LOW | agent/tools/utils/truncate.py | 195 | # Check if no truncation is needed | COMMENT |
| LOW | agent/tools/bash/bash.py | 313 | # Check if we need to save full output to temp file | STRING |
| LOW⚡ | agent/tools/edit/edit.py | 85 | # Check if file exists | COMMENT |
| LOW⚡ | agent/tools/edit/edit.py | 89 | # Check if readable/writable | COMMENT |
| LOW⚡ | agent/tools/edit/edit.py | 94 | # Read file | COMMENT |
| LOW | agent/tools/edit/edit.py | 194 | # Write file | COMMENT |
| LOW | agent/tools/send/send.py | 65 | # Check if file exists | COMMENT |
| LOW | agent/tools/send/send.py | 69 | # Check if readable | COMMENT |
| LOW | agent/memory/chunker.py | 85 | # Check if adding this line would exceed limit | COMMENT |
| LOW | agent/protocol/agent_stream.py | 881 | # Check if this is a file to send | COMMENT |
| LOW | agent/protocol/agent_stream.py | 1293 | # Check if this is a context overflow error. Use the single | COMMENT |
| LOW | agent/protocol/agent_stream.py | 1438 | # Check if error is rate limit (429) | COMMENT |
| LOW | agent/protocol/agent_stream.py | 1441 | # Check if error is retryable (timeout, connection, server busy, etc.) | COMMENT |
| LOW | agent/prompt/workspace.py | 45 | # Check if this is a brand new workspace (AGENT.md not yet created). | COMMENT |
| LOW | agent/skills/config.py | 235 | # Check if value is truthy | COMMENT |
| LOW | models/openai_compatible_bot.py | 264 | # Check if already in OpenAI format | COMMENT |
| LOW | models/openai_compatible_bot.py | 328 | # Check if this is a tool result message (user role with tool_result blocks) | COMMENT |
| LOW | models/openai_compatible_bot.py | 362 | # Check if this is an assistant message with tool_use blocks | COMMENT |
| LOW | models/zhipuai/zhipuai_bot.py | 462 | # Check if already in ZhipuAI/OpenAI format | COMMENT |
| LOW | models/zhipuai/zhipuai_bot.py | 501 | # Check if this is a tool result message (user role with tool_result blocks) | COMMENT |
| LOW | models/zhipuai/zhipuai_bot.py | 512 | # Check if this is an assistant message with tool_use blocks | COMMENT |
| LOW | models/dashscope/dashscope_bot.py | 576 | # Check if already in DashScope/OpenAI format | COMMENT |
| LOW | models/dashscope/dashscope_bot.py | 646 | # Check if this is a tool result message (user role with tool_result blocks) | COMMENT |
| LOW | models/dashscope/dashscope_bot.py | 657 | # Check if this is an assistant message with tool_use blocks | COMMENT |
| LOW | models/chatgpt/chat_gpt_bot.py | 180 | # Check if file exists | COMMENT |
| LOW | channel/channel.py | 75 | # Check if agent mode is enabled | COMMENT |
| LOW | channel/dingtalk/dingtalk_channel.py | 727 | # Check if msg exists (for scheduled tasks, msg might be None) | COMMENT |
| LOW⚡ | channel/feishu/feishu_channel.py | 2012 | # Check if it's a local file path (file:// protocol) | COMMENT |
| LOW | channel/feishu/feishu_channel.py | 895 | # Check if we can reply to an existing message (need msg_id) | COMMENT |
| LOW | channel/feishu/feishu_channel.py | 1763 | # Check if it's a local file path (file:// protocol) | COMMENT |
| LOW | channel/web/web_channel.py | 2846 | # Check if password was cleared: if there was a password before clearing, | COMMENT |
| LOW | channel/wecom_bot/wecom_bot_channel.py | 453 | # Check if this is a response to a pending request | COMMENT |
| LOW | skills/skill-creator/scripts/init_skill.py | 208 | # Check if directory already exists | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | config.py | 261 | # Optional native multi-agent registry. When empty or omitted, CowAgent | COMMENT |
| MEDIUM | config.py | 111 | "qwen_node_id": "", # id used by workflow-orchestration models; keep it an empty string if qwen_node_id is unused | CODE |
| MEDIUM | bridge/agent_bridge.py | 241 | # reasoning trace, but still benefit from the higher answer | COMMENT |
| MEDIUM | bridge/agent_bridge.py | 308 | # reasoning trace, but still benefit from the higher answer | COMMENT |
| MEDIUM | bridge/agent_bridge.py | 1222 | # Thinking-only models need their reasoning trace in stored | COMMENT |
| MEDIUM | tests/test_agent_trim_new_messages.py | 35 | # 2. trim oldest turns if this run overflows the context window | COMMENT |
| MEDIUM⚡ | tests/test_evolution.py | 94 | # Test scaffolding | COMMENT |
| MEDIUM | tests/test_knowledge_service.py | 307 | (root / "concepts/rag.md").write_text("# RAG", encoding="utf-8") | CODE |
| MEDIUM | agent/tools/mcp/tool_retrieval.py | 116 | # embedding model; ranking across dims is meaningless. | COMMENT |
| MEDIUM⚡ | agent/memory/embedding/provider.py | 69 | # default_model : default embedding model name | COMMENT |
| MEDIUM | agent/memory/embedding/factory.py | 20 | # Track whether the embedding model log has been printed in this process, | COMMENT |
| MEDIUM⚡ | agent/protocol/agent_stream.py | 2177 | # Get context window from agent (based on model) | COMMENT |
| MEDIUM | agent/protocol/agent.py | 357 | # Reserve ~10% of context window, with min 10K and max 200K | COMMENT |
| MEDIUM | agent/prompt/workspace.py | 159 | # Truncate MEMORY.md to protect context window (frozen snapshot) | COMMENT |
| MEDIUM | cli/commands/backup.py | 482 | # multi-agent restore. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | config.py | 261 | # Optional native multi-agent registry. When empty or omitted, CowAgent | COMMENT |
| LOW | docker/entrypoint.sh | 1 | #!/bin/bash | COMMENT |
| LOW | plugins/tool/README.md | 121 | ###### 发送短信 | COMMENT |
| LOW | desktop/electron-builder.win.js | 101 | async function customSign(configuration) { | COMMENT |
| LOW | desktop/src/renderer/src/product/types.ts | 1 | // ============================================================ | COMMENT |
| LOW | desktop/src/renderer/src/product/types.ts | 21 | COMMENT | |
| LOW | desktop/src/renderer/src/product/types.ts | 61 | hideProviderSelect?: boolean | COMMENT |
| LOW | desktop/src/renderer/src/theme/themes.ts | 1 | // ============================================================ | COMMENT |
| LOW | desktop/src/renderer/src/hooks/useBackend.ts | 1 | import { useState, useEffect, useCallback, useRef } from 'react' | COMMENT |
| LOW | desktop/src/renderer/src/store/onboardingStore.ts | 1 | import { create } from 'zustand' | COMMENT |
| LOW | desktop/src/main/updater.ts | 41 | // A bundled app-config may point the updater at a different feed origin. When | COMMENT |
| LOW | desktop/src/main/index.ts | 21 | // Kept in sync with COW_DATA_DIR in python-manager.ts so the desktop shell | COMMENT |
| LOW | desktop/src/main/index.ts | 441 | ipcMain.handle('window-close', () => mainWindow?.close()) | COMMENT |
| LOW | desktop/src/main/index.ts | 501 | setUpdateLanguage(lang) | COMMENT |
| LOW | desktop/src/main/python-manager.ts | 21 | COMMENT | |
| LOW | desktop/src/main/python-manager.ts | 81 | private backendPath: string | COMMENT |
| LOW | desktop/src/main/python-manager.ts | 101 | private healthTimer: ReturnType<typeof setInterval> | null = null | COMMENT |
| LOW | desktop/src/main/python-manager.ts | 861 | // Wall-clock deadline rather than an attempt counter: if the machine | COMMENT |
| LOW | desktop/src/main/themes.ts | 1 | import { app, ipcMain } from 'electron' | COMMENT |
| LOW | agent/tools/browser/browser_service.py | 441 | COMMENT | |
| LOW | agent/memory/embedding/provider.py | 61 | # --------------------------------------------------------------------------- | COMMENT |
| LOW | agent/chat/service.py | 321 | # We cannot simply slice at original_length (it exceeds the | COMMENT |
| LOW | agent/chat/service.py | 481 | # Markdown links for files the send tool uploaded, held until the turn's | COMMENT |
| LOW | agent/protocol/agent_stream.py | 41 | # MAX_REASONING_STREAM_CHARS so that storage / stream / display all match. | COMMENT |
| LOW | agent/protocol/agent_stream.py | 1201 | tools_schema.append({ | COMMENT |
| LOW | agent/protocol/agent.py | 601 | # If executor cleared its messages (context overflow / message format error), | COMMENT |
| LOW | models/openai/open_ai_bot.py | 161 | # which calls /chat/completions via our shared HTTP client. The previous | COMMENT |
| LOW | models/openai/openai_http_client.py | 361 | }, | COMMENT |
| LOW | channel/feishu/feishu_channel.py | 1341 | # current_text 只承载当前正在流式渲染的那张卡片的内容;message_end / agent_end | COMMENT |
| LOW | channel/web/web_channel.py | 3221 | "qianfan": [const.ERNIE_45_TURBO_VL], | COMMENT |
| LOW | channel/web/web_channel.py | 3241 | const.DOUBAO_SEED_2_1_PRO, | COMMENT |
| LOW | channel/web/static/js/console.js | 8461 | COMMENT | |
| LOW | channel/web/static/js/console.js | 11601 | const action = task.action || {}; | COMMENT |
| LOW | voice/xunfei/xunfei_tts.py | 1 | # -*- coding:utf-8 -*- | COMMENT |
| LOW | voice/xunfei/xunfei_asr.py | 1 | # -*- coding:utf-8 -*- | COMMENT |
| LOW | voice/xunfei/xunfei_voice.py | 1 | ##################################################################### | COMMENT |
| LOW | voice/xunfei/xunfei_voice.py | 61 | # 识别本地文件 | COMMENT |
| LOW | .github/workflows/release.yml | 1 | name: Release Desktop | COMMENT |
| LOW | .github/workflows/release.yml | 181 | env: | COMMENT |
| LOW | .github/workflows/release.yml | 201 | # vice versa. electron-builder reads a single CSC_LINK/CSC_KEY_PASSWORD | COMMENT |
| LOW | .github/workflows/release.yml | 221 | # Never let electron-builder publish: our publish target is a generic | COMMENT |
| LOW | .github/workflows/release.yml | 381 | VER: ${{ steps.ver.outputs.version }} | COMMENT |
| LOW | .github/workflows/release-overlay-win7.yml | 1 | name: Release Desktop Overlay (Win7 legacy) | COMMENT |
| LOW | .github/workflows/release-overlay-win7.yml | 21 | # cdn.link-ai.tech/linkai-desktop/. Standard win and Win7 win are both the | COMMENT |
| LOW | .github/workflows/release-overlay-win7.yml | 41 | # IMPORTANT for end users: Win7 must have SP1 + update KB2533623 (or the rollup | COMMENT |
| LOW | .github/workflows/release-overlay-win7.yml | 201 | echo "signtool.exe not found in downloaded archive" >&2 | COMMENT |
| LOW | .github/workflows/release-win7.yml | 1 | name: Release Desktop (Win7 legacy) | COMMENT |
| LOW | .github/workflows/release-win7.yml | 121 | echo "SIGNTOOL_PATH=$(cygpath -w "$exe")" >> "$GITHUB_ENV" | COMMENT |
| LOW | .github/workflows/release-overlay.yml | 1 | name: Release Desktop Overlay | COMMENT |
| LOW | .github/workflows/release-overlay.yml | 21 | # filenames built from productName) is redacted too. Don't add steps that dump | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | bridge/bridge.py | 121 | return v != "" and v not in ("YOUR API KEY", "YOUR_API_KEY") | CODE |
| HIGH | agent/memory/embedding/provider.py | 225 | if not self.api_key or self.api_key in ["", "YOUR API KEY", "YOUR_API_KEY"]: | CODE |
| HIGH | agent/memory/embedding/provider.py | 353 | if not self.api_key or self.api_key in ["", "YOUR API KEY", "YOUR_API_KEY"]: | CODE |
| HIGH⚡ | agent/memory/embedding/factory.py | 45 | if openai_api_key and openai_api_key not in ["", "YOUR API KEY", "YOUR_API_KEY"]: | CODE |
| HIGH⚡ | agent/memory/embedding/factory.py | 61 | if linkai_api_key and linkai_api_key not in ["", "YOUR API KEY", "YOUR_API_KEY"]: | CODE |
| HIGH | agent/memory/embedding/factory.py | 172 | if value in ["", "YOUR API KEY", "YOUR_API_KEY"]: | CODE |
| HIGH | channel/web/web_channel.py | 1159 | if val and val not in ("YOUR API KEY", "YOUR_API_KEY"): | CODE |
| HIGH | channel/web/web_channel.py | 3300 | return bool(value) and value not in ("", "YOUR API KEY", "YOUR_API_KEY") | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | bridge/agent_bridge.py | 43 | # Create a temporary mixin class that combines the bot with OpenAI compatibility | COMMENT |
| MEDIUM⚡ | tests/test_security_ssrf_path_traversal.py | 147 | # Create a minimal SkillManager mock with custom_dir set. | COMMENT |
| MEDIUM | agent/tools/tool_manager.py | 176 | # Create a temporary instance to get the name | COMMENT |
| MEDIUM | agent/tools/tool_manager.py | 240 | # Create a temporary instance to get the name | COMMENT |
| MEDIUM | agent/tools/tool_manager.py | 730 | # Create a new instance | COMMENT |
| MEDIUM | agent/tools/tool_manager.py | 754 | # Create a temporary instance to get schema | COMMENT |
| MEDIUM | agent/tools/scheduler/integration.py | 297 | # Create a unique session_id for this scheduled task to avoid polluting user's conversation | COMMENT |
| MEDIUM | agent/tools/bash/bash.py | 291 | # Create a mock result with helpful error message | STRING |
| MEDIUM | agent/memory/summarizer.py | 872 | # Create main MEMORY.md in workspace root (always needed for bootstrap) | COMMENT |
| MEDIUM | agent/chat/service.py | 238 | # Create a copy of messages for this execution | COMMENT |
| MEDIUM | agent/protocol/agent.py | 572 | # Create a copy of messages for this execution to avoid concurrent modification | COMMENT |
| MEDIUM | agent/prompt/workspace.py | 60 | # Create the memory subdirectory | COMMENT |
| MEDIUM | channel/web/web_channel.py | 4227 | # Creating a new provider — api_base is mandatory. | COMMENT |
| MEDIUM | channel/wechatmp/passive_reply.py | 18 | # This class is instantiated once per query | COMMENT |
| MEDIUM | channel/wechatmp/active_reply.py | 16 | # This class is instantiated once per query | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | run.sh | 1260 | # Step 0: choose the install/UI language. Everything after this is localized. | COMMENT |
| LOW | agent/tools/vision/vision.py | 247 | # Step 1: preferred provider — explicit `tools.vision.provider` | COMMENT |
| LOW | agent/tools/vision/vision.py | 258 | # Step 2: auto-discovery chain as fallback | COMMENT |
| LOW⚡ | agent/memory/storage.py | 777 | # Step 2: Trigram FTS5 — CJK/mixed queries, plus fallback when unicode61 | COMMENT |
| LOW⚡ | agent/memory/storage.py | 787 | # Step 3: LIKE fallback — last resort (FTS5 unavailable, or CJK tokens | COMMENT |
| LOW | agent/memory/storage.py | 762 | # Step 1: Standard FTS5 (unicode61) — pure ASCII queries only. | COMMENT |
| LOW⚡ | agent/protocol/agent_stream.py | 398 | # Step 2: append a stable "interrupted" marker so the LLM sees a | COMMENT |
| LOW⚡ | agent/protocol/agent_stream.py | 2140 | # Step 0: Truncate large tool results in historical turns (30K -> 10K) | COMMENT |
| LOW⚡ | agent/protocol/agent_stream.py | 2143 | # Step 1: 识别完整轮次 | COMMENT |
| LOW⚡ | agent/protocol/agent_stream.py | 2149 | # Step 2: 轮次限制 - 超出时移除前一半,保留后一半 | COMMENT |
| LOW⚡ | agent/protocol/agent_stream.py | 2176 | # Step 3: Token 限制 - 保留完整轮次 | COMMENT |
| LOW | agent/protocol/agent_stream.py | 366 | # Step 1: close any orphaned tool_use in the trailing assistant | COMMENT |
| LOW⚡ | channel/web/static/js/console.js | 1680 | // Step 1: replace markdown-it anchor tags whose href points to a video file. | COMMENT |
| LOW⚡ | channel/web/static/js/console.js | 1685 | // Step 2: replace any remaining bare video URLs in text nodes (not inside HTML tags). | COMMENT |
| LOW⚡ | channel/web/static/js/console.js | 1703 | // Step 1: anchor whose href points to an image file -> replace with <img> preview. | COMMENT |
| LOW⚡ | channel/web/static/js/console.js | 1708 | // Step 2: bare image URLs left in text nodes (rare — markdown-it's linkify usually catches them). | COMMENT |
| LOW | skills/skill-creator/SKILL.md | 135 | ### Step 1: Understanding the Skill with Concrete Examples | COMMENT |
| LOW | skills/skill-creator/SKILL.md | 152 | ### Step 2: Planning the Reusable Skill Contents | COMMENT |
| LOW | skills/skill-creator/SKILL.md | 185 | ### Step 3: Initialize the Skill | COMMENT |
| LOW | skills/skill-creator/SKILL.md | 220 | ### Step 4: Edit the Skill | COMMENT |
| LOW | skills/skill-creator/SKILL.md | 370 | ### Step 5: Validate (Optional) | COMMENT |
| LOW | skills/skill-creator/SKILL.md | 392 | ### Step 6: Iterate | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | plugins/banwords/lib/WordsSearch.py | 10 | __all__ = ['WordsSearch'] | CODE |
| LOW | bridge/agent_bridge.py | 112 | def set_session_override(self, provider: Optional[str], model: Optional[str]) -> None: | CODE |
| LOW | agent/registry.py | 244 | def set_default(self, agent_id: str) -> None: | CODE |
| LOW | agent/registry.py | 322 | def set_agent_registry(registry: Optional[AgentRegistry]) -> None: | CODE |
| LOW | agent/routing.py | 168 | def set_agent_router(router: Optional[AgentRouter]) -> None: | CODE |
| LOW | agent/tools/__init__.py | 129 | __all__ = [ | CODE |
| LOW | agent/tools/write/__init__.py | 3 | __all__ = ['Write'] | CODE |
| LOW | agent/tools/web_search/__init__.py | 3 | __all__ = ["WebSearch"] | CODE |
| LOW | agent/tools/memory/__init__.py | 10 | __all__ = ['MemorySearchTool', 'MemoryGetTool'] | CODE |
| LOW | agent/tools/search_files/__init__.py | 3 | __all__ = ['SearchFiles'] | CODE |
| LOW | agent/tools/read/__init__.py | 3 | __all__ = ['Read'] | CODE |
| LOW | agent/tools/scheduler/__init__.py | 7 | __all__ = ["SchedulerTool"] | CODE |
| LOW | agent/tools/evolution_undo/__init__.py | 3 | __all__ = ["EvolutionUndoTool"] | CODE |
| LOW | agent/tools/utils/__init__.py | 33 | __all__ = [ | CODE |
| LOW | agent/tools/mcp/__init__.py | 4 | __all__ = ["McpClient", "McpClientRegistry", "McpTool"] | CODE |
| LOW | agent/tools/mcp/mcp_client.py | 45 | def set_reload_callback(fn) -> None: | CODE |
| LOW | agent/tools/bash/bash.py | 103 | def set_cwd(self, cwd: str) -> None: | STRING |
| LOW | agent/tools/bash/__init__.py | 3 | __all__ = ['Bash'] | CODE |
| LOW | agent/tools/edit/__init__.py | 3 | __all__ = ['Edit'] | CODE |
| LOW | agent/tools/browser/__init__.py | 3 | __all__ = ["BrowserTool"] | CODE |
| LOW | agent/tools/env_config/__init__.py | 3 | __all__ = ['EnvConfig'] | CODE |
| LOW | agent/tools/agent_delegate/__init__.py | 5 | __all__ = ["AgentDelegateTool", "DelegationPolicy"] | CODE |
| LOW | agent/tools/ls/__init__.py | 3 | __all__ = ['Ls'] | CODE |
| LOW | agent/tools/send/__init__.py | 3 | __all__ = ['Send'] | CODE |
| LOW | agent/tools/subagent/__init__.py | 3 | __all__ = ["SubagentTool", "format_results"] | CODE |
| LOW | agent/memory/config.py | 139 | def set_global_memory_config(config: Optional[MemoryConfig]) -> None: | CODE |
| LOW | agent/memory/__init__.py | 33 | __all__ = [ | CODE |
| LOW | agent/memory/embedding/__init__.py | 30 | __all__ = [ | CODE |
| LOW | agent/chat/__init__.py | 3 | __all__ = ["ChatService"] | CODE |
| LOW | agent/workspace/__init__.py | 5 | __all__ = ["WorkspaceService", "project_store", "session_prefs"] | CODE |
| LOW | agent/protocol/task.py | 88 | def update_status(self, status: TaskStatus) -> None: | CODE |
| LOW | agent/protocol/__init__.py | 19 | __all__ = [ | CODE |
| LOW | agent/prompt/__init__.py | 8 | __all__ = [ | CODE |
| LOW | agent/evolution/__init__.py | 16 | __all__ = [ | CODE |
| LOW | agent/skills/__init__.py | 21 | __all__ = [ | CODE |
| LOW | agent/permission/__init__.py | 16 | __all__ = [ | CODE |
| LOW | agent/subagent/__init__.py | 24 | __all__ = [ | CODE |
| LOW | models/openai/openai_compat.py | 148 | __all__ = [ | CODE |
| LOW | channel/file_cache.py | 8 | logger = logging.getLogger(__name__) | CODE |
| LOW⚡ | channel/weixin/weixin_channel.py | 219 | def _update_context_token(self, user_id: str, token: str) -> None: | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | run.sh | 1260 | # Step 0: choose the install/UI language. Everything after this is localized. | COMMENT |
| LOW | agent/tools/vision/vision.py | 247 | # Step 1: preferred provider — explicit `tools.vision.provider` | COMMENT |
| LOW | agent/tools/vision/vision.py | 258 | # Step 2: auto-discovery chain as fallback | COMMENT |
| LOW⚡ | agent/memory/storage.py | 777 | # Step 2: Trigram FTS5 — CJK/mixed queries, plus fallback when unicode61 | COMMENT |
| LOW⚡ | agent/memory/storage.py | 787 | # Step 3: LIKE fallback — last resort (FTS5 unavailable, or CJK tokens | COMMENT |
| LOW | agent/memory/storage.py | 762 | # Step 1: Standard FTS5 (unicode61) — pure ASCII queries only. | COMMENT |
| LOW⚡ | agent/protocol/agent_stream.py | 398 | # Step 2: append a stable "interrupted" marker so the LLM sees a | COMMENT |
| LOW⚡ | agent/protocol/agent_stream.py | 2140 | # Step 0: Truncate large tool results in historical turns (30K -> 10K) | COMMENT |
| LOW⚡ | agent/protocol/agent_stream.py | 2143 | # Step 1: 识别完整轮次 | COMMENT |
| LOW⚡ | agent/protocol/agent_stream.py | 2149 | # Step 2: 轮次限制 - 超出时移除前一半,保留后一半 | COMMENT |
| LOW⚡ | agent/protocol/agent_stream.py | 2176 | # Step 3: Token 限制 - 保留完整轮次 | COMMENT |
| LOW | agent/protocol/agent_stream.py | 366 | # Step 1: close any orphaned tool_use in the trailing assistant | COMMENT |
| LOW⚡ | channel/web/static/js/console.js | 1680 | // Step 1: replace markdown-it anchor tags whose href points to a video file. | COMMENT |
| LOW⚡ | channel/web/static/js/console.js | 1685 | // Step 2: replace any remaining bare video URLs in text nodes (not inside HTML tags). | COMMENT |
| LOW⚡ | channel/web/static/js/console.js | 1703 | // Step 1: anchor whose href points to an image file -> replace with <img> preview. | COMMENT |
| LOW⚡ | channel/web/static/js/console.js | 1708 | // Step 2: bare image URLs left in text nodes (rare — markdown-it's linkify usually catches them). | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | config.py | 430 | # the log with a full traceback here — just return it unmasked. | COMMENT |
| LOW | agent/memory/manager.py | 215 | # No embeddings, just use None | COMMENT |
| MEDIUM | agent/memory/manager.py | 313 | # on any sibling helpers — keeps it robust against partial reloads | COMMENT |
| MEDIUM | agent/evolution/executor.py | 547 | # plus legacy watched changes used by the deterministic test harness. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | agent/memory/conversation_store.py | 1089 | CODE | |
| LOW | agent/memory/embedding/provider.py | 182 | CODE | |
| LOW | agent/protocol/agent.py | 14 | CODE | |
| LOW | agent/prompt/builder.py | 82 | CODE | |
| LOW | agent/prompt/builder.py | 37 | CODE | |
| LOW | agent/skills/loader.py | 45 | CODE | |
| LOW | models/xunfei/xunfei_spark_bot.py | 269 | CODE | |
| LOW | models/xunfei/xunfei_spark_bot.py | 183 | CODE | |
| LOW | models/openai/openai_http_client.py | 138 | CODE | |
| LOW | voice/ali/ali_api.py | 184 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | agent/tools/browser/browser_service.py | 380 | for attr in ("type", "name", "href", "alt", "role", "ariaLabel", "placeholder", "value"): | CODE |