Build AI teams, not just agents. Hard rails, soft power, shared mission.
This report summarizes scanner evidence for zts212653/clowder-ai, a TypeScript project with 3,353 GitHub stars. SynthScan examined 2,403,361 lines of code across 10833 source files, recording 7157 pattern matches distributed across 19 syntactic categories. The legacy adjusted pattern signal is 4.9 (Low pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Can maintainers explain intent, assumptions, and trade-offs? 5470 finding(s).
Are imports declared and package/API names verified? 161 finding(s).
Are wrappers, guards, and repeated structures necessary? 6155 finding(s).
Which changes need focused human review? 7157 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 7157 distinct pattern matches across 19 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | desktop/renderer-link-policy.js | 6 | function createVersionedRendererUrl(appUrl, version) { | CODE |
| LOW⚡ | desktop/renderer-link-policy.js | 15 | function createRendererLinkOrigins({ appOrigin, apiOrigin, previewGatewayPort }) { | CODE |
| LOW⚡ | desktop/renderer-link-policy.js | 24 | async function resolveRendererLinkOrigins({ appOrigin, apiOrigin, loadPreviewGatewayStatus }) { | CODE |
| LOW | desktop/renderer-link-policy.js | 44 | function isAllowedRendererDownload(url, apiOrigin) { | CODE |
| LOW | desktop/update-network-diagnostics.js | 44 | function attachRedirectDiagnostics(request, dbg) { | CODE |
| LOW | desktop/desktop-update-menu.js | 10 | function createManualUpdateHandler({ getUpdatePrompt, getUpdater }) { | CODE |
| LOW | desktop/desktop-update-menu.js | 66 | function installMacApplicationMenu({ app, Menu, onManualUpdate, showAbout }) { | CODE |
| LOW | desktop/desktop-update-runtime.js | 7 | function createDesktopUpdateRuntime({ | CODE |
| LOW | desktop/project-root.js | 12 | function resolveProjectRootFromDir(startDir) { | CODE |
| LOW | desktop/main.js | 38 | function createBaseRendererLinkOrigins() { | CODE |
| LOW | desktop/main.js | 80 | async function refreshRendererLinkOrigins() { | CODE |
| LOW | desktop/service-manager.test.js | 129 | fs.symlinkSync = function symlinkSyncWithProbeCount(src, dst, type) { | CODE |
| LOW | desktop/service-manager.test.js | 133 | fs.readFileSync = function readFileSyncWithOnePluginProbeFailure(filePath, ...args) { | CODE |
| LOW | desktop/mac-install-location.js | 3 | function ensureValidMacInstallLocation({ app, dialog }) { | CODE |
| LOW | desktop/update-manager.test.js | 135 | function conditionalRefreshFailureNet() { | CODE |
| LOW | …rchitecture/message-delivery-handling-handoff-audit.md | 956 | async function terminalizePreAdmissionFailure(entry, failure) { | CODE |
| LOW | scripts/intake-from-opensource.sh | 892 | function isDeclaredInDecisionTable(file) { | CODE |
| LOW | scripts/services/test_whisper_worker.py | 21 | def _service_dependency_stubs(): | CODE |
| LOW | scripts/services/test_whisper_worker.py | 120 | async def test_qwen_load_first_and_consecutive_inference_share_one_worker(self): | CODE |
| LOW | scripts/services/test_whisper_worker.py | 169 | async def test_qwen_deep_health_and_transcribe_operations_are_serialized(self): | CODE |
| LOW | scripts/services/test_whisper_worker.py | 227 | async def test_qwen_load_failure_closes_worker_for_clean_retry(self): | CODE |
| LOW | scripts/services/test_whisper_worker.py | 258 | async def test_whisper_backend_keeps_default_to_thread_dispatch(self): | CODE |
| LOW | scripts/services/test_whisper_worker.py | 268 | async def test_shutdown_is_idempotent_and_rejects_new_qwen_work(self): | CODE |
| LOW | scripts/services/tts-api.py | 62 | def require_mlx_audio_runtime() -> None: | CODE |
| LOW | scripts/services/tts-api.py | 665 | async def synthesize_stream_endpoint(request: Request, req: SpeechRequest): | CODE |
| LOW | scripts/services/test_tts_runtime.py | 152 | async def test_health_advertises_the_stream_route_contract(self) -> None: | CODE |
| LOW | scripts/services/test_tts_runtime.py | 159 | async def test_reuses_one_loaded_model_across_synthesis_requests(self) -> None: | CODE |
| LOW | scripts/services/test_tts_runtime.py | 200 | async def test_streams_clone_chunks_and_a_complete_wav(self) -> None: | CODE |
| LOW | scripts/services/test_tts_runtime.py | 239 | async def test_exposes_native_clone_stream_as_ndjson(self) -> None: | CODE |
| LOW | scripts/services/test_tts_runtime.py | 275 | async def test_keeps_warmup_and_native_stream_on_one_mlx_thread(self) -> None: | CODE |
| LOW | scripts/services/test_tts_runtime.py | 328 | async def test_keeps_every_native_stream_yield_on_the_same_worker_thread(self) -> None: | CODE |
| LOW | scripts/services/test_tts_runtime.py | 378 | async def test_disconnect_closes_clone_stream_and_releases_model_lock(self) -> None: | CODE |
| LOW | scripts/services/test_tts_runtime.py | 417 | async def test_stream_failure_emits_a_structured_error_line(self) -> None: | CODE |
| LOW | scripts/services/test_embed_runtime_policy.py | 28 | async def test_simultaneous_arrivals_cannot_overbook_capacity(self) -> None: | CODE |
| LOW | scripts/services/test_embed_runtime_policy.py | 66 | async def test_capacity_is_bounded_while_one_request_is_active(self) -> None: | CODE |
| LOW | scripts/services/test_embed_runtime_policy.py | 101 | async def test_expired_waiter_never_enters_encode_section(self) -> None: | CODE |
| LOW | scripts/services/test_embed_runtime_policy.py | 135 | async def test_disconnected_waiter_never_enters_encode_section(self) -> None: | CODE |
| LOW | scripts/services/test_embed_runtime_policy.py | 176 | async def test_exception_inside_admitted_work_releases_the_encoder(self) -> None: | CODE |
| LOW | scripts/services/test_embed_runtime_policy.py | 193 | async def test_cancelled_waiter_releases_its_queue_reservation(self) -> None: | CODE |
| LOW | scripts/services/test_embed_runtime_policy.py | 251 | def test_applies_allocator_limits_and_uses_os_footprint_delta_as_hard_gate( | CODE |
| LOW | scripts/services/test_embed_runtime_policy.py | 274 | def test_health_metrics_keep_allocator_and_os_scopes_distinct(self) -> None: | CODE |
| LOW | scripts/services/test_embed_runtime_policy.py | 296 | def test_required_os_footprint_must_exist_at_startup(self) -> None: | CODE |
| LOW | scripts/services/test_embed_runtime_policy.py | 306 | def test_required_os_footprint_must_remain_available(self) -> None: | CODE |
| LOW | scripts/services/whisper-api.py | 41 | async def _close_qwen_worker_on_app_shutdown(): | CODE |
| LOW | scripts/services/embed-api.py | 102 | def _allow_sentence_transformers_fallback() -> bool: | CODE |
| LOW | scripts/services/embed-api.py | 510 | def _try_sentence_transformers() -> bool: | CODE |
| LOW | scripts/services/test_whisper_cuda.py | 44 | def test_no_cuda_and_no_torch_loads_cpu(self): | CODE |
| LOW | scripts/services/test_whisper_cuda.py | 51 | def test_cuda_initialization_failure_retries_cpu(self): | CODE |
| LOW | scripts/services/test_whisper_cuda.py | 62 | def test_cpu_failure_does_not_report_success(self): | CODE |
| LOW | scripts/services/test_whisper_cuda.py | 69 | def test_broken_optional_torch_import_still_loads_cpu(self): | CODE |
| LOW | scripts/services/test_whisper_cuda.py | 84 | def test_optional_torch_probe_failure_still_loads_cpu(self): | CODE |
| LOW | scripts/services/install-template.sh | 304 | def resolve_faster_whisper_repo_id(model_id): | CODE |
| LOW | scripts/services/embed_runtime_policy.py | 68 | def _effective_deadline_seconds(self, deadline_ms: int | None) -> float: | CODE |
| LOW | scripts/services/embed_runtime_policy.py | 198 | def read_process_footprint_bytes(pid: int | None = None) -> int | None: | CODE |
| LOW | scripts/services/embed_runtime_policy.py | 267 | def configure_before_model_load(self) -> None: | CODE |
| LOW | packages/collective-service/src/collaboration-work.ts | 29 | export function requireWorkAccountableHuman(work: CollectiveWorkRecord, humanId: string): void { | CODE |
| LOW | packages/collective-service/src/collaboration-work.ts | 64 | export function recordCollectiveWorkResult( | CODE |
| LOW | packages/collective-service/src/collaboration-work.ts | 112 | export function issueCollectiveWorkResultReceipt( | CODE |
| LOW | packages/collective-service/src/collaboration-work.ts | 183 | export function collaborationActorFromEvent(event: CollectiveEventEnvelope): CollectiveCollaborationActor { | CODE |
| LOW | …llective-service/src/collaboration-agent-acceptance.ts | 17 | export function acceptCollectiveWorkAsAgent( | CODE |
| 4569 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | cat-cafe-skills/manifest.yaml | 10 | # ─── 开发流程链 ───────────────────────────────────────── | COMMENT |
| MEDIUM | cat-cafe-skills/manifest.yaml | 1632 | # ─── 降级为 refs/（不再是独立 skill） ───────────────── | COMMENT |
| MEDIUM | cat-cafe-skills/manifest.yaml | 1675 | # ─── 三条铁律（仅此三条） ────────────────────────────── | COMMENT |
| MEDIUM | cat-cafe-skills/manifest.yaml | 1684 | # ─── lint 规则 ────────────────────────────────────────── | COMMENT |
| MEDIUM | desktop/update-downloader.js | 36 | // ── Journal persistence ──────────────────────────────────────────────── | COMMENT |
| MEDIUM | desktop/update-downloader.js | 114 | // ── File integrity verification ──────────────────────────────────────── | COMMENT |
| MEDIUM | desktop/update-downloader.test.js | 24 | // ── Journal persistence ──────────────────────────────────────────────── | COMMENT |
| MEDIUM | desktop/update-downloader.test.js | 116 | // ── checkUpgradeResult ───────────────────────────────────────────────── | COMMENT |
| MEDIUM | desktop/update-downloader.test.js | 173 | // ── verifyFileIntegrity ──────────────────────────────────────────────── | COMMENT |
| MEDIUM | desktop/update-downloader.test.js | 219 | // ── updatesDir ───────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | desktop/update-checker.js | 21 | // ── Semver parsing & comparison ──────────────────────────────────────── | COMMENT |
| MEDIUM | desktop/update-checker.js | 102 | // ── Asset name resolution ────────────────────────────────────────────── | COMMENT |
| MEDIUM | desktop/update-checker.js | 132 | // ── Asset four-tuple extraction ──────────────────────────────────────── | COMMENT |
| MEDIUM | desktop/update-checker.js | 153 | // ── Update target selection ──────────────────────────────────────────── | COMMENT |
| MEDIUM | desktop/update-checker.js | 242 | // ── Settings persistence ─────────────────────────────────────────────── | COMMENT |
| MEDIUM | desktop/update-installer.test.js | 14 | // ── Mock helpers ─────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | desktop/update-installer.test.js | 45 | // ── downloadAsset ────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | desktop/generate-desktop-config.test.js | 54 | // ── F273: Plugin packaging source path regression (F204 migration) ────── | COMMENT |
| MEDIUM | desktop/update-installer-fetch.test.js | 8 | // ── Mock helpers ─────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | desktop/update-installer-fetch.test.js | 78 | // ── fetchReleases ───────────────────────────────────────────────────── | COMMENT |
| MEDIUM | desktop/update-manager.test.js | 17 | // ── Mock spawn ──────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | desktop/update-manager.test.js | 234 | // ── Windows launcher ────────────────────────────────────────────────── | COMMENT |
| MEDIUM | desktop/update-manager.test.js | 283 | // ── macOS launcher ──────────────────────────────────────────────────── | COMMENT |
| MEDIUM | desktop/update-manager.test.js | 310 | // ── Journal preservation on launcher failure (P1 regression) ────────── | COMMENT |
| MEDIUM | desktop/scripts/build-mac.sh | 30 | # ─── Args ─────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | desktop/scripts/build-mac.sh | 47 | # ─── Paths + helpers ──────────────────────────────────────────────────── | COMMENT |
| MEDIUM | desktop/scripts/build-mac.sh | 64 | # ─── Step 1: Build web app ────────────────────────────────────────────── | COMMENT |
| MEDIUM | desktop/scripts/build-mac.sh | 78 | # ─── Step 2: pnpm deploy runtime packages ────────────────────────────── | COMMENT |
| MEDIUM | desktop/scripts/build-mac.sh | 108 | # ─── Step 3: Bundle Node.js portable (both archs) ────────────────────── | COMMENT |
| MEDIUM | desktop/scripts/build-mac.sh | 151 | # ─── Step 4: Build Redis portable (both archs) ───────────────────────── | COMMENT |
| MEDIUM | desktop/scripts/build-mac.sh | 199 | # ─── Step 5: (macOS skips CLI tarball bundling) ────────────────────────── | COMMENT |
| MEDIUM | desktop/scripts/build-mac.sh | 207 | # ─── Step 6a: Generate icon.icns from icon.png (one-time) ────────────── | COMMENT |
| MEDIUM | desktop/scripts/build-mac.sh | 227 | # ─── Step 6b: electron-builder + hdiutil — produces DMG per arch ────── | COMMENT |
| MEDIUM | docs/architecture/2026-05-05-architecture-views.md | 774 | ┌─ D. 构建冷启动包（Session #2+ 专用）─▼────────────────────────┐ | CODE |
| MEDIUM | scripts/setup.sh | 3 | # ============================================================ | COMMENT |
| MEDIUM | scripts/setup.sh | 8 | # ============================================================ | COMMENT |
| MEDIUM | scripts/setup.sh | 58 | # ── Step 1: Check prerequisites ───────────────────────────── | COMMENT |
| MEDIUM | scripts/setup.sh | 120 | # ── Step 2: Install packages ──────────────────────────────── | COMMENT |
| MEDIUM | scripts/setup.sh | 132 | # ── Step 3: Choose optional features ──────────────────────── | COMMENT |
| MEDIUM | scripts/setup.sh | 329 | # ── Step 4: Generate .env ─────────────────────────────────── | COMMENT |
| MEDIUM⚡ | scripts/setup.sh | 346 | # ── Core 核心 ──────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | scripts/setup.sh | 353 | # ── API Gateway Proxy 反向代理 ─────────────────────────────── | COMMENT |
| MEDIUM⚡ | scripts/setup.sh | 361 | # ── Voice Input (ASR) 语音输入 ─────────────────────────────── | COMMENT |
| MEDIUM⚡ | scripts/setup.sh | 370 | # ── Voice Input (ASR) 语音输入 ─────────────────────────────── | COMMENT |
| MEDIUM⚡ | scripts/setup.sh | 378 | # ── Voice Output (TTS) 语音输出 ────────────────────────────── | COMMENT |
| MEDIUM⚡ | scripts/setup.sh | 385 | # ── Voice Output (TTS) 语音输出 ────────────────────────────── | COMMENT |
| MEDIUM⚡ | scripts/setup.sh | 393 | # ── Speech Correction 语音纠正 ─────────────────────────────── | COMMENT |
| MEDIUM⚡ | scripts/setup.sh | 400 | # ── Speech Correction 语音纠正 ─────────────────────────────── | COMMENT |
| MEDIUM⚡ | scripts/setup.sh | 408 | # ── Semantic Retrieval 语义检索（Embedding）──────────────── | COMMENT |
| MEDIUM⚡ | scripts/setup.sh | 416 | # ── Semantic Retrieval 语义检索（Embedding）──────────────── | COMMENT |
| MEDIUM⚡ | scripts/setup.sh | 425 | # ── Step 4b: Install sidecar venvs (--install-missing) ────── | COMMENT |
| MEDIUM | scripts/setup.sh | 491 | # ── Step 5: Summary ───────────────────────────────────────── | COMMENT |
| MEDIUM | scripts/logs-health.sh | 6 | # ─── Config ────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | scripts/logs-health.sh | 32 | # ─── Helpers ───────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | scripts/logs-health.sh | 95 | # ─── Error rate ────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | scripts/logs-health.sh | 128 | # ─── Main ──────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | scripts/logs-health.sh | 146 | # ─── Config summary ───────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | scripts/install.sh | 134 | # ── Interactive arrow-key selectors (single-select & multi-select) ──────── | COMMENT |
| MEDIUM | scripts/install.sh | 651 | # ── [1/8] Environment detection ──────────────────────────── | COMMENT |
| MEDIUM | scripts/install.sh | 768 | # ── [2/8] Install system dependencies ────────────────────── | COMMENT |
| 1428 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| CRITICAL | …mponents/content-review/ContentModificationLanding.tsx | 292 | return `${context ? `${context.targetName} · ${context.threadTitle}` : '尚未接责的修改请求'} · ${item.record.payload.intent.bod | CODE |
| CRITICAL | packages/shared/src/types/entrusted-work-actions.ts | 72 | const entrustedWorkTimeFactV1Schema = entrustedWorkV1Schema.shape.time.shape.businessDeadline.unwrap(); | CODE |
| CRITICAL | packages/api/test/messages-delivery-mode.test.js | 376 | deps.socketManager.emitToUser.mock.calls.filter((call) => call.arguments[1] === 'thread_updated').length, | CODE |
| CRITICAL | packages/api/test/messages-delivery-mode.test.js | 621 | deps.socketManager.emitToUser.mock.calls.some((call) => call.arguments[1] === 'thread_updated'), | CODE |
| CRITICAL | packages/api/test/messages-delivery-mode.test.js | 865 | const terminalized = deps.invocationRecordStore.update.mock.calls.find( | CODE |
| CRITICAL | packages/api/test/messages-delivery-mode.test.js | 910 | const cancelMessages = deps.socketManager.broadcastAgentMessage.mock.calls.filter( | CODE |
| CRITICAL | packages/api/test/messages-delivery-mode.test.js | 971 | const terminalized = deps.invocationRecordStore.update.mock.calls.find( | CODE |
| CRITICAL | packages/api/test/messages-delivery-mode.test.js | 1067 | const failedUpdate = deps.invocationRecordStore.update.mock.calls.find( | CODE |
| CRITICAL | packages/api/test/messages-delivery-mode.test.js | 1072 | const completion = deps.queueProcessor.onInvocationComplete.mock.calls.find( | CODE |
| CRITICAL | packages/api/test/messages-delivery-mode.test.js | 1293 | const spawnStarted = deps.socketManager.broadcastToRoom.mock.calls.find((c) => c.arguments[1] === 'spawn_started'); | CODE |
| CRITICAL | packages/api/test/messages-delivery-mode.test.js | 1648 | const completion = deps.queueProcessor.onInvocationComplete.mock.calls.find( | CODE |
| CRITICAL | packages/api/test/messages-delivery-mode.test.js | 1681 | const completion = deps.queueProcessor.onInvocationComplete.mock.calls.find( | CODE |
| CRITICAL | packages/api/test/messages-delivery-mode.test.js | 1687 | const succeededUpdate = deps.invocationRecordStore.update.mock.calls.find( | CODE |
| CRITICAL | packages/api/test/messages-delivery-mode.test.js | 1726 | const terminalWrites = deps.invocationRecordStore.update.mock.calls.filter( | CODE |
| CRITICAL | packages/api/test/messages-delivery-mode.test.js | 1733 | const completion = deps.queueProcessor.onInvocationComplete.mock.calls.find( | CODE |
| CRITICAL | packages/api/test/messages-delivery-mode.test.js | 1762 | const terminalWrites = deps.invocationRecordStore.update.mock.calls.filter( | CODE |
| CRITICAL | packages/api/test/messages-delivery-mode.test.js | 1774 | const completion = deps.queueProcessor.onInvocationComplete.mock.calls.find( | CODE |
| CRITICAL | …api/test/queue-steer-prestart-terminal-failure.test.js | 270 | h.socketManager.emitToUser.mock.calls.some( | CODE |
| CRITICAL | packages/api/test/action-successor-queue-fence.test.js | 261 | deps.messageStore.markCanceled.mock.calls.map((call) => call.arguments[0]), | CODE |
| CRITICAL | packages/api/test/action-successor-queue-fence.test.js | 264 | const deletedEvent = deps.socketManager.emitToUser.mock.calls.find( | CODE |
| CRITICAL | packages/api/test/action-successor-queue-fence.test.js | 316 | deps.messageStore.markCanceled.mock.calls.map((call) => call.arguments[0]), | CODE |
| CRITICAL | packages/api/test/action-successor-queue-fence.test.js | 496 | deps.messageStore.markCanceled.mock.calls.map((call) => call.arguments[0]), | CODE |
| CRITICAL⚡ | packages/api/test/queue-processor.test.js | 5285 | const spawnCall = deps.socketManager.broadcastToRoom.mock.calls.find((c) => c.arguments[1] === 'spawn_started'); | CODE |
| CRITICAL⚡ | packages/api/test/queue-processor.test.js | 5293 | const earlyIntentCall = deps.socketManager.broadcastToRoom.mock.calls.find((c) => c.arguments[1] === 'intent_mode'); | CODE |
| CRITICAL⚡ | packages/api/test/queue-processor.test.js | 5299 | const intentCall = deps.socketManager.broadcastToRoom.mock.calls.find((c) => c.arguments[1] === 'intent_mode'); | CODE |
| CRITICAL | packages/api/test/queue-processor.test.js | 215 | deps.invocationRecordStore.update.mock.calls.some(({ arguments: args }) => args[1]?.status === 'failed'), | CODE |
| CRITICAL | packages/api/test/queue-processor.test.js | 372 | queueDeps.invocationRecordStore.update.mock.calls.some( | CODE |
| CRITICAL | packages/api/test/queue-processor.test.js | 381 | queueDeps.router.routeExecution.mock.calls.some((call) => call.arguments[1]?.includes(recalledSource.content)), | CODE |
| CRITICAL | packages/api/test/queue-processor.test.js | 833 | const succeededUpdate = sharedDeps.invocationRecordStore.update.mock.calls.find( | CODE |
| CRITICAL | packages/api/test/queue-processor.test.js | 860 | const succeededUpdate = sharedDeps.invocationRecordStore.update.mock.calls.find( | CODE |
| CRITICAL | packages/api/test/queue-processor.test.js | 885 | const succeededUpdate = sharedDeps.invocationRecordStore.update.mock.calls.find( | CODE |
| CRITICAL | packages/api/test/queue-processor.test.js | 914 | const failedUpdate = sharedDeps.invocationRecordStore.update.mock.calls.find( | CODE |
| CRITICAL | packages/api/test/queue-processor.test.js | 920 | sharedDeps.invocationRecordStore.update.mock.calls.some((call) => call.arguments[1]?.status === 'succeeded'), | CODE |
| CRITICAL | packages/api/test/queue-processor.test.js | 1319 | const delivered = durableDeps.socketManager.emitToUser.mock.calls.find( | CODE |
| CRITICAL | packages/api/test/queue-processor.test.js | 1493 | const delivered = durableDeps.socketManager.emitToUser.mock.calls.find( | CODE |
| CRITICAL | packages/api/test/queue-processor.test.js | 1515 | const deliveredEvents = durableDeps.socketManager.emitToUser.mock.calls.filter( | CODE |
| CRITICAL | packages/api/test/queue-processor.test.js | 2317 | const deliveredEvents = durableDeps.socketManager.emitToUser.mock.calls.filter( | CODE |
| CRITICAL | packages/api/test/queue-processor.test.js | 2323 | const textEvents = durableDeps.socketManager.broadcastAgentMessage.mock.calls.filter( | CODE |
| CRITICAL | packages/api/test/queue-processor.test.js | 3060 | durableDeps.socketManager.broadcastToRoom.mock.calls.filter( | CODE |
| CRITICAL | packages/api/test/queue-processor.test.js | 3113 | const receiptEvent = durableDeps.socketManager.broadcastToRoom.mock.calls.find( | CODE |
| CRITICAL | packages/api/test/queue-processor.test.js | 3544 | const retryCreate = durableDeps.invocationRecordStore.create.mock.calls.at(-1)?.arguments[0]; | CODE |
| CRITICAL | packages/api/test/queue-processor.test.js | 4496 | deps.messageStore.markDelivered.mock.calls.map((call) => call.arguments[0]), | CODE |
| CRITICAL | packages/api/test/queue-processor.test.js | 4500 | const deliveredCall = deps.socketManager.emitToUser.mock.calls.find( | CODE |
| CRITICAL | packages/api/test/queue-processor.test.js | 4563 | deps.socketManager.emitToUser.mock.calls.some((call) => call.arguments[1] === 'messages_delivered'), | CODE |
| CRITICAL | packages/api/test/queue-processor.test.js | 4568 | deps.socketManager.emitToUser.mock.calls.some((call) => call.arguments[1] === 'queue_updated'), | CODE |
| CRITICAL | packages/api/test/queue-processor.test.js | 4617 | const deliveredCall = deps.socketManager.emitToUser.mock.calls.find( | CODE |
| CRITICAL | packages/api/test/queue-processor.test.js | 4627 | deps.socketManager.emitToUser.mock.calls.some((call) => call.arguments[1] === 'queue_updated'), | CODE |
| CRITICAL | packages/api/test/queue-processor.test.js | 4649 | deps.socketManager.emitToUser.mock.calls.some((call) => call.arguments[1] === 'messages_delivered'), | CODE |
| CRITICAL | packages/api/test/queue-processor.test.js | 4723 | customDeps.messageStore.markDelivered.mock.calls.some((call) => call.arguments[0] === 'msg-queued'), | CODE |
| CRITICAL | packages/api/test/queue-processor.test.js | 4772 | customDeps.messageStore.markDelivered.mock.calls.some((call) => call.arguments[0] === 'msg-codex-queued'), | CODE |
| CRITICAL | packages/api/test/queue-processor.test.js | 4828 | customDeps.messageStore.markDelivered.mock.calls.some((call) => call.arguments[0] === 'msg-old-seen'), | CODE |
| CRITICAL | packages/api/test/queue-processor.test.js | 4862 | const pausedCall = deps.socketManager.emitToUser.mock.calls.find((c) => c.arguments[1] === 'queue_paused'); | CODE |
| CRITICAL | packages/api/test/queue-processor.test.js | 4875 | const pausedCall = deps.socketManager.emitToUser.mock.calls.find((c) => c.arguments[1] === 'queue_paused'); | CODE |
| CRITICAL | packages/api/test/queue-processor.test.js | 4913 | const pausedCall = deps.socketManager.emitToUser.mock.calls.find((c) => c.arguments[1] === 'queue_paused'); | CODE |
| CRITICAL | packages/api/test/queue-processor.test.js | 5048 | const broadcasts = deps.socketManager.broadcastAgentMessage.mock.calls.map((call) => call.arguments[0]); | CODE |
| CRITICAL | packages/api/test/queue-processor.test.js | 5064 | const canceledUpdate = deps.invocationRecordStore.update.mock.calls.find( | CODE |
| CRITICAL | packages/api/test/queue-processor.test.js | 5133 | durableDeps.invocationRecordStore.update.mock.calls.some((call) => call.arguments[1]?.status === 'canceled'), | CODE |
| CRITICAL | packages/api/test/queue-processor.test.js | 5258 | const intentCall = deps.socketManager.broadcastToRoom.mock.calls.find((c) => c.arguments[1] === 'intent_mode'); | CODE |
| CRITICAL | packages/api/test/queue-processor.test.js | 6585 | const intentCall = failDeps.socketManager.broadcastToRoom.mock.calls.find((c) => c.arguments[1] === 'intent_mode'); | CODE |
| CRITICAL | packages/api/test/queue-processor.test.js | 6596 | const intentCall = deps.socketManager.broadcastToRoom.mock.calls.find((c) => c.arguments[1] === 'intent_mode'); | CODE |
| 45 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | cat-cafe-skills/feat-lifecycle/SKILL.md | 52 | ### Step 0: 关联检测（内部 + 社区 issue 都必须做）🔴 | COMMENT |
| LOW | cat-cafe-skills/vision-rescue/SKILL.md | 48 | ### Step 1: 识别——我在绝境里吗？ | COMMENT |
| LOW | cat-cafe-skills/vision-rescue/SKILL.md | 57 | ### Step 2: 回到第一真相源 | COMMENT |
| LOW⚡ | cat-cafe-skills/vision-rescue/SKILL.md | 71 | ### Step 3: 找外部声音 | COMMENT |
| LOW⚡ | cat-cafe-skills/vision-rescue/SKILL.md | 81 | ### Step 4: 喊伙伴 | COMMENT |
| LOW⚡ | cat-cafe-skills/vision-rescue/SKILL.md | 91 | ### Step 5: 拒绝投降（除非 operator signoff） | COMMENT |
| LOW | cat-cafe-skills/worktree/SKILL.md | 59 | # Step 1: 检查是否有未提交的文档变更 | COMMENT |
| LOW | cat-cafe-skills/worktree/SKILL.md | 63 | # Step 2: 检查 main 与 remote 双向同步 | COMMENT |
| LOW | cat-cafe-skills/thread-orchestration/SKILL.md | 45 | ### Step 1: 拆解 — 识别独立可交付单元 | COMMENT |
| LOW | cat-cafe-skills/thread-orchestration/SKILL.md | 56 | ### Step 2: 提议 Thread — 每个子任务一个提议（用户审批后才创建） | COMMENT |
| LOW | cat-cafe-skills/thread-orchestration/SKILL.md | 119 | ### Step 3: 选猫 — 按任务和当前成员分配角色 | COMMENT |
| LOW | cat-cafe-skills/thread-orchestration/SKILL.md | 148 | ### Step 4: 并行执行 — Worktree 隔离 | COMMENT |
| LOW | cat-cafe-skills/thread-orchestration/SKILL.md | 160 | ### Step 5: 交付 — 直接消费依赖，整项完成回流 | COMMENT |
| LOW | cat-cafe-skills/opensource-ops/SKILL.md | 39 | ## Step 1: Grounding（落地 provider-neutral subject 与 author） | COMMENT |
| LOW | cat-cafe-skills/opensource-ops/SKILL.md | 61 | ## Step 2: 身份与 custody 判断（fail-closed） | COMMENT |
| LOW | cat-cafe-skills/opensource-ops/SKILL.md | 81 | ## Step 3: Maintainer 五问（仓库中立版） | COMMENT |
| LOW | cat-cafe-skills/opensource-ops/SKILL.md | 112 | ## Step 4: 反向溯源（reverse provenance） | COMMENT |
| LOW | cat-cafe-skills/opensource-ops/SKILL.md | 153 | ## Step 5: 工具落点与协作 | COMMENT |
| LOW | cat-cafe-skills/opensource-ops/SKILL.md | 178 | ## Step 6: 回报（reportingMode） | COMMENT |
| LOW | cat-cafe-skills/guide-authoring/SKILL.md | 46 | ### Step 1: 场景识别 | COMMENT |
| LOW | cat-cafe-skills/guide-authoring/SKILL.md | 69 | ### Step 2: 步骤拆分 + YAML 编排 | COMMENT |
| LOW | cat-cafe-skills/guide-authoring/SKILL.md | 115 | ### Step 3: 元素标签标注 | COMMENT |
| LOW | cat-cafe-skills/guide-authoring/SKILL.md | 139 | ### Step 4: 注册到 Guide Registry | COMMENT |
| LOW | cat-cafe-skills/guide-authoring/SKILL.md | 158 | ### Step 5: CI 契约测试 | COMMENT |
| LOW | cat-cafe-skills/guide-authoring/SKILL.md | 165 | ### Step 6: 端到端验证 | COMMENT |
| LOW | cat-cafe-skills/refs/chatgpt-browser-automation.md | 25 | ### Step 1: 注入文本 | COMMENT |
| LOW | cat-cafe-skills/refs/chatgpt-browser-automation.md | 38 | ### Step 2: 发送 | COMMENT |
| LOW | cat-cafe-skills/refs/chatgpt-browser-automation.md | 49 | ### Step 3: 等待回复完成 | COMMENT |
| LOW | cat-cafe-skills/refs/chatgpt-browser-automation.md | 66 | ### Step 4: 复制回复 | COMMENT |
| LOW | cat-cafe-skills/refs/chatgpt-browser-automation.md | 77 | ### Step 5: 读取剪贴板 | COMMENT |
| LOW | cat-cafe-skills/refs/repo-inbox.md | 35 | ### Step 1: Read — 读原始对象 | COMMENT |
| LOW⚡ | cat-cafe-skills/refs/repo-inbox.md | 107 | ### Step 2: Ground — 基础合法性 | COMMENT |
| LOW⚡ | cat-cafe-skills/refs/repo-inbox.md | 117 | ### Step 3: Gate — 主人翁五问 | COMMENT |
| LOW⚡ | cat-cafe-skills/refs/repo-inbox.md | 123 | ### Step 4: Route — 按 Verdict 路由 | COMMENT |
| LOW | cat-cafe-skills/refs/repo-inbox.md | 223 | ### Step 5: Record — 收口 | COMMENT |
| LOW | cat-cafe-skills/refs/claude-ai-browser-automation.md | 17 | ### Step 1: 打开新对话或已有对话 | COMMENT |
| LOW | cat-cafe-skills/refs/claude-ai-browser-automation.md | 23 | ### Step 2: 激活 Research 模式 | COMMENT |
| LOW | cat-cafe-skills/refs/claude-ai-browser-automation.md | 36 | ### Step 3: 填写提示词 & 发送 | COMMENT |
| LOW | cat-cafe-skills/refs/claude-ai-browser-automation.md | 48 | ### Step 4: 等待 Research 完成 | COMMENT |
| LOW | cat-cafe-skills/refs/claude-ai-browser-automation.md | 62 | ### Step 5: 打开报告文章 | COMMENT |
| LOW | cat-cafe-skills/refs/claude-ai-browser-automation.md | 69 | ### Step 6: 下载报告（关键步骤！✅ 超级简单） | COMMENT |
| LOW | cat-cafe-skills/cross-thread-sync/SKILL.md | 31 | ## Step 1: 发现（谁在平行工作？） | COMMENT |
| LOW | cat-cafe-skills/cross-thread-sync/SKILL.md | 86 | ## Step 2: 通知（3+2 升级制） | COMMENT |
| LOW | cat-cafe-skills/cross-thread-sync/SKILL.md | 129 | ## Step 3: 争用协调（共享文件冲突预防） | COMMENT |
| LOW | cat-cafe-skills/cross-thread-sync/SKILL.md | 164 | ## Step 4: 处置与终结 | COMMENT |
| LOW | cat-cafe-skills/pencil-design/SKILL.md | 42 | ### Step 1: 分析现有 UI | COMMENT |
| LOW | cat-cafe-skills/pencil-design/SKILL.md | 54 | ### Step 2: 判断设计类型 | COMMENT |
| LOW | cat-cafe-skills/pencil-design/SKILL.md | 62 | ### Step 3: 风格验证 | COMMENT |
| LOW⚡ | desktop/update-checker.js | 190 | // Step 3: sort descending | COMMENT |
| LOW⚡ | desktop/update-checker.js | 197 | // Step 4: find first valid (highest complete release) | COMMENT |
| LOW | docs/configuration/startup.md | 102 | # Step 1: Install dependencies | COMMENT |
| LOW | docs/configuration/startup.md | 106 | # Step 2: Start services | COMMENT |
| LOW | docs/configuration/startup.zh-CN.md | 102 | # Step 1: Install dependencies | COMMENT |
| LOW | docs/configuration/startup.zh-CN.md | 106 | # Step 2: Start services | COMMENT |
| LOW⚡ | docs/features/F040-backlog-reorganization.md | 420 | ### Step 1: 创建 `feat-completion` skill（P1，~30min） | COMMENT |
| LOW⚡ | docs/features/F040-backlog-reorganization.md | 426 | ### Step 2: 沉淀 ADR（P2，~20min） | COMMENT |
| LOW⚡ | docs/features/F040-backlog-reorganization.md | 434 | ### Step 3: 更新 lessons-learned（P2，~10min） | COMMENT |
| LOW⚡ | docs/features/F040-backlog-reorganization.md | 440 | ### Step 4: 同步三猫指引（P2，~15min） | COMMENT |
| LOW⚡ | docs/features/F040-backlog-reorganization.md | 447 | ### Step 5: 验收（P3，可延后） | COMMENT |
| LOW⚡ | …/web/src/stores/__tests__/chatStore-multi-slot.test.ts | 87 | // Step 1: Parent intent_mode registers all cats | COMMENT |
| 230 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | desktop/update-checker.js | 190 | // Step 3: sort descending | COMMENT |
| LOW⚡ | desktop/update-checker.js | 197 | // Step 4: find first valid (highest complete release) | COMMENT |
| LOW⚡ | …/web/src/stores/__tests__/chatStore-multi-slot.test.ts | 87 | // Step 1: Parent intent_mode registers all cats | COMMENT |
| LOW⚡ | …/web/src/stores/__tests__/chatStore-multi-slot.test.ts | 93 | // Step 2: Callback intent_mode for gemini with new invocationId. | COMMENT |
| LOW | …/web/src/stores/__tests__/chatStore-multi-slot.test.ts | 111 | // Step 3: Gemini finishes — removing inv-B leaves no gemini orphan | COMMENT |
| LOW⚡ | …ckages/web/src/stores/__tests__/bubble-reducer.test.ts | 2135 | // Step 1: A inv-A1 stream + content | COMMENT |
| LOW⚡ | …ckages/web/src/stores/__tests__/bubble-reducer.test.ts | 2144 | // Step 2: B inv-B1 stream + content | COMMENT |
| LOW⚡ | …ckages/web/src/stores/__tests__/bubble-reducer.test.ts | 2153 | // Step 3: A inv-A2 (NEW invocation) stream + content | COMMENT |
| LOW | …ckages/web/src/stores/__tests__/bubble-reducer.test.ts | 2347 | // Step 1: stream_started — reducer 创建 canonical `msg-T1R-codex-assistant_text` | COMMENT |
| LOW | …ckages/web/src/stores/__tests__/bubble-reducer.test.ts | 2364 | // Step 2: tool_event — 应该 append 到 step 1 的 bubble (assistant_text container) | COMMENT |
| LOW | …ckages/web/src/stores/__tests__/bubble-reducer.test.ts | 2383 | // Step 3: stream_chunk — 应该 append content 到同一 bubble，不触发 canonical-split | COMMENT |
| LOW | …tores/__tests__/bubble-projection-alpha-replay.test.ts | 44 | // Step 1: stream record exists in store | COMMENT |
| LOW | …tores/__tests__/bubble-projection-alpha-replay.test.ts | 56 | // Step 2: callback_final event with exact-key match would normally overwrite stream content | COMMENT |
| LOW | …components/memory/__tests__/CollectionCatalog.test.tsx | 78 | // Step 1: click header → detail appears | COMMENT |
| LOW⚡ | …components/memory/__tests__/CollectionCatalog.test.tsx | 92 | // Step 2: click inside detail area → detail stays (no collapse) | COMMENT |
| LOW⚡ | …components/memory/__tests__/CollectionCatalog.test.tsx | 101 | // Step 3: click header again → collapse | COMMENT |
| LOW⚡ | …nents/__tests__/HubObservabilityTab-deep-link.test.tsx | 73 | // Step 1: first deep-link. | COMMENT |
| LOW⚡ | …nents/__tests__/HubObservabilityTab-deep-link.test.tsx | 79 | // Step 2: simulate the user clicking the '总览' subtab button so internal | COMMENT |
| LOW⚡ | …nents/__tests__/HubObservabilityTab-deep-link.test.tsx | 89 | // Step 3: second deep-link with SAME initialSubTab value but new nonce. | COMMENT |
| LOW⚡ | …omponents/__tests__/chat-input-game-send-guard.test.ts | 94 | // Step 1: render with idle upload — menu can open | COMMENT |
| LOW⚡ | …omponents/__tests__/chat-input-game-send-guard.test.ts | 99 | // Step 2: open game menu | COMMENT |
| LOW⚡ | …omponents/__tests__/chat-input-game-send-guard.test.ts | 102 | // Step 3: drill into modes (layer 1 → layer 2) | COMMENT |
| LOW⚡ | …omponents/__tests__/chat-input-game-send-guard.test.ts | 109 | // Step 4: re-render with uploading status (menu stays open, upload started) | COMMENT |
| LOW⚡ | …omponents/__tests__/chat-input-game-send-guard.test.ts | 114 | // Step 5: click a mode — should NOT call onSend because upload is blocking | COMMENT |
| LOW | …c/components/__tests__/first-run-quest-wizard.test.tsx | 203 | // Step 1: select template | COMMENT |
| LOW⚡ | …c/components/__tests__/first-run-quest-wizard.test.tsx | 214 | // Step 2: select client | COMMENT |
| LOW⚡ | …c/components/__tests__/first-run-quest-wizard.test.tsx | 222 | // Step 3: profile auto-selected, select model, test, then create | COMMENT |
| LOW | …es/web/src/components/rich/CommunityIssueDraftCard.tsx | 106 | // Step 1: Create draft (server-side idempotent — returns existing if retry) | COMMENT |
| LOW | …es/web/src/components/rich/CommunityIssueDraftCard.tsx | 147 | // Step 2: Publish | COMMENT |
| LOW⚡ | …ges/web/src/__tests__/game-thread-loading-race.test.ts | 34 | // Step 1: /game sent → loading set on source thread (currently active = flat state) | COMMENT |
| LOW⚡ | …ges/web/src/__tests__/game-thread-loading-race.test.ts | 39 | // Step 2: game:thread_created arrives → navigate to game thread | COMMENT |
| LOW⚡ | …ges/web/src/__tests__/game-thread-loading-race.test.ts | 48 | // Step 3: HTTP response arrives → cleanup uses thread-scoped API | COMMENT |
| LOW | …sts__/useAgentMessages-sequential-slot-cleanup.test.ts | 193 | // Step 1: Codex finishes (non-final) | COMMENT |
| LOW | …sts__/useAgentMessages-sequential-slot-cleanup.test.ts | 208 | // Step 2: Opus finishes (final) | COMMENT |
| LOW | …/hooks/__tests__/useAgentMessages-bubble-merge.test.ts | 890 | // Step 1: stream chunk creates the bubble bound to inv-done. | COMMENT |
| LOW | …/hooks/__tests__/useAgentMessages-bubble-merge.test.ts | 907 | // Step 2: done event finalizes the bubble and populates finalizedStreamRef. | COMMENT |
| LOW | …/hooks/__tests__/useAgentMessages-bubble-merge.test.ts | 920 | // Step 3: stale tool_use arrives for the completed invocation (reordered / retry). | COMMENT |
| LOW | …s/__tests__/useAgentMessages-thinking-metadata.test.ts | 50 | // Step 1: thinking creates placeholder (metadata may be present if msg carries it; | COMMENT |
| LOW | …s/__tests__/useAgentMessages-thinking-metadata.test.ts | 68 | // Step 2: text chunk arrives with metadata → merge onto placeholder | COMMENT |
| LOW | …s/__tests__/useAgentMessages-thinking-metadata.test.ts | 79 | // Step 3: invocation_usage arrives → setMessageUsage should succeed (not no-op) | COMMENT |
| LOW | …/__tests__/useAgentMessages-catchup-ref-desync.test.ts | 231 | // Step 1: Create active stream → activeRefs + sawStreamDataRef populated | COMMENT |
| LOW⚡ | …/__tests__/useAgentMessages-catchup-ref-desync.test.ts | 255 | // Step 2: done → finalizedStreamRef populated | COMMENT |
| LOW⚡ | …/__tests__/useAgentMessages-catchup-ref-desync.test.ts | 264 | // Step 3: resetRefs (simulates what thread switch or catch-up cleanup would do) | COMMENT |
| LOW⚡ | …/__tests__/useAgentMessages-catchup-ref-desync.test.ts | 271 | // Step 4: Wipe store messages (simulates fetchHistory replace) + start new invocation | COMMENT |
| LOW | …/__tests__/useAgentMessages-catchup-ref-desync.test.ts | 304 | // Step 1: Stream + done → finalizedStreamRef set | COMMENT |
| LOW⚡ | …/__tests__/useAgentMessages-catchup-ref-desync.test.ts | 333 | // Step 2: resetRefs clears finalizedStreamRef | COMMENT |
| LOW⚡ | …/__tests__/useAgentMessages-catchup-ref-desync.test.ts | 340 | // Step 3: A callback arrives for a NEW invocation. | COMMENT |
| LOW | packages/mcp-server/test/callback-tools.test.js | 1523 | // Step 1: enqueue by forcing transient failures. | COMMENT |
| LOW | packages/mcp-server/test/callback-tools.test.js | 1535 | // Step 2: recover network and verify replay + current post both sent. | COMMENT |
| LOW⚡ | packages/api/test/tmux-agent-spawner.test.js | 525 | // Step 1: consume the __tmuxPaneCreated event (generator now suspended | COMMENT |
| LOW⚡ | packages/api/test/tmux-agent-spawner.test.js | 532 | // Step 2: kick off the next iteration — this synchronously resumes the | COMMENT |
| LOW⚡ | packages/api/test/tmux-agent-spawner.test.js | 537 | // Step 3: yield a macrotask so the generator has definitely settled at | COMMENT |
| LOW⚡ | packages/api/test/tmux-agent-spawner.test.js | 541 | // Step 4: release the shell. Timer + watcher are already armed, so the | COMMENT |
| LOW⚡ | packages/api/test/tmux-agent-spawner.test.js | 547 | // Step 5: drain the rest of the stream. | COMMENT |
| LOW⚡ | packages/api/test/plugin-schedule-activate.test.js | 380 | // Step 1: enable plugin with a schedule resource | COMMENT |
| LOW⚡ | packages/api/test/plugin-schedule-activate.test.js | 387 | // Step 2: disable with a DIFFERENT resource list (simulates plugin.yaml change) | COMMENT |
| LOW⚡ | packages/api/test/plugin-schedule-activate.test.js | 484 | // Step 1: enable plugin with a schedule resource named 'my-poller' | COMMENT |
| LOW⚡ | packages/api/test/plugin-schedule-activate.test.js | 492 | // Step 2: re-enable with the SAME name but type=mcp (type transition) | COMMENT |
| LOW | packages/api/test/connector-action-endpoint.test.js | 536 | // Step 1: QR confirmed — inject token via adapter | COMMENT |
| LOW | packages/api/test/connector-action-endpoint.test.js | 561 | // Step 2: Disconnect — handler clears token, sets activate: false | COMMENT |
| 174 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | CONTRIBUTING.md | 21 | COMMENT | |
| LOW | cat-cafe-skills/manifest.yaml | 1 | # Clowder AI Skills Manifest — 路由单一真相源 | COMMENT |
| LOW | cat-cafe-skills/eval-design/SKILL.md | 81 | # 配对时用差值 CI 半宽），与该目标的剩余空间、consumer | COMMENT |
| LOW | cat-cafe-skills/hyperfocus-brake/sanitizer.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | cat-cafe-skills/merge-gate/SKILL.md | 321 | COMMENT | |
| LOW | cat-cafe-skills/merge-gate/SKILL.md | 341 | # | COMMENT |
| LOW | cat-cafe-skills/merge-gate/SKILL.md | 361 | # 详见 ../.cat-cafe-shared-refs/pr-template.md「云端 Review 触发 Comment 模板」 | COMMENT |
| LOW | cat-cafe-skills/merge-gate/SKILL.md | 401 | echo "✅ Hotfix cross-cat review: Author=$PR_AUTHOR, Approved by=$REVIEWERS" | COMMENT |
| LOW | cat-cafe-skills/merge-gate/SKILL.md | 421 | # 7. Squash merge（GitHub 处理，禁止本地 squash！） | COMMENT |
| LOW | .claude/hooks/f24-pre-compact.sh | 1 | #!/bin/bash | COMMENT |
| LOW | .claude/hooks/f24-post-compact-bootstrap.sh | 1 | #!/bin/bash | COMMENT |
| LOW | desktop/update-downloader.js | 1 | // F273: Desktop In-App Update — download & journal layer | COMMENT |
| LOW | desktop/update-checker.js | 1 | // F273: Desktop In-App Update — update checker (pure logic, no Electron deps) | COMMENT |
| LOW | desktop/app-identity.js | 1 | // Runtime application identity. | COMMENT |
| LOW | desktop/scripts/build-mac.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | desktop/scripts/build-mac.sh | 341 | file.write(png) | COMMENT |
| LOW | desktop/scripts/build-mac.sh | 421 | die "hdiutil attach failed for ${arch} (mountpoint=${mount_point})" | COMMENT |
| LOW | docs/harness-feedback/eval-domains/eval-sop.yaml | 1 | --- | COMMENT |
| LOW | …arness-feedback/eval-domains/eval-capability-tips.yaml | 1 | --- | COMMENT |
| LOW | scripts/setup.sh | 281 | echo -e " ${GREEN}✓${NC} API proxy enabled" | COMMENT |
| LOW | scripts/intake-from-opensource.sh | 1381 | # empty scope and silently degraded to whole-repo scan, hitting pre-existing | COMMENT |
| LOW | scripts/sync-skills.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | scripts/user-redis.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | scripts/install.sh | 81 | fi | COMMENT |
| LOW | scripts/start-dev.sh | 1 | #!/bin/bash | COMMENT |
| LOW | scripts/start-dev.sh | 21 | # ./scripts/start-dev.sh -- --npm-registry=URL --pip-index-url=URL --hf-endpoint=URL | COMMENT |
| LOW | scripts/preflight-shared-state.sh | 1 | #!/bin/bash | COMMENT |
| LOW | scripts/clean-stale-skill-links.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | scripts/pre-merge-check.sh | 1 | #!/bin/bash | COMMENT |
| LOW | scripts/lib/intake-gh-retry.sh | 1 | # shellcheck shell=bash | COMMENT |
| LOW | scripts/lib/quickstart-freshness.sh | 1 | # shellcheck shell=bash | COMMENT |
| LOW | scripts/services/recommendation-matrix.yaml | 1 | # ============================================================ | COMMENT |
| LOW | scripts/services/recommendation-matrix.yaml | 21 | # - name: <model-id> | COMMENT |
| LOW | scripts/services/recommendation-matrix.yaml | 721 | requirement: 'HuggingFace 上的 CausalLM 因果语言模型（纯 CPU 推理，建议 ≤3B）' | COMMENT |
| LOW | scripts/services/prereq-check.sh | 361 | # (user feedback): forcing pip to tunnel through clash verge's | COMMENT |
| LOW | scripts/services/prereq-check.sh | 381 | # Windows tooling has no OS-level fallback -- that asymmetry is | COMMENT |
| LOW | scripts/services/prereq-check.sh | 401 | # Single source of truth: prereq-check decides, downstream just | COMMENT |
| LOW | scripts/services/tts-server.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | scripts/services/embed-server.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | scripts/services/python-resolve.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | scripts/services/python-resolve.sh | 21 | # 2. uv (if user already has it) -- uv python find 3.12 reuses uv-managed | COMMENT |
| LOW | scripts/services/python-resolve.sh | 41 | COMMENT | |
| LOW | scripts/services/python-resolve.sh | 181 | _try_legacy_project_python() { | COMMENT |
| LOW | scripts/services/whisper-server.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | scripts/services/install-python.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | scripts/services/install-template.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | scripts/services/install-template.sh | 21 | # VENV_NAME (required) -- venv dir name under | COMMENT |
| LOW | scripts/services/llm-postprocess-server.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | packages/web/next-env.d.ts | 1 | /// <reference types="next" /> | COMMENT |
| LOW | packages/web/src/stores/callbackAuthStore.ts | 161 | // seen (snapshot 30s lag). But this was over-engineered against the | COMMENT |
| LOW | packages/web/src/stores/callbackAuthStore.ts | 181 | }); | COMMENT |
| LOW | packages/web/src/stores/bubble-invariants.ts | 41 | // Active path `ensureActiveAssistantMessage` creates the canonical | COMMENT |
| LOW | packages/web/src/stores/bubble-reducer.ts | 201 | // (1) 同 (actor, turn, kind) 严格匹配 — ADR-033 kind 共存场景 | COMMENT |
| LOW | packages/web/src/stores/bubble-reducer.ts | 341 | // 在 reducer 是 no-op（lifecycle 在 caller 用 cat status / slot cleanup 等 side-effect | COMMENT |
| LOW | packages/web/src/stores/bubble-reducer.ts | 441 | next.push(m); | COMMENT |
| LOW | packages/web/src/stores/bubble-reducer.ts | 601 | if (m.catId !== event.actorId) continue; | COMMENT |
| LOW | …ckages/web/src/stores/__tests__/bubble-reducer.test.ts | 1721 | currentMessages, | COMMENT |
| LOW | packages/web/src/components/CliDiagnosticsPanel.tsx | 101 | // Tier 4 — cognitive / context limit | COMMENT |
| LOW | …nents/__tests__/HubObservabilityTab-deep-link.test.tsx | 61 | // FAIL. Sequence: | COMMENT |
| LOW | packages/web/src/hooks/preview-auto-open-delivery.ts | 101 | return { status: 'skipped', eventId, reason: 'client_inactive' }; | COMMENT |
| 184 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | docs/features/F124-apple-ecosystem-voice-interaction.md | 173 | - [Xcode 26.3 unlocks the power of agentic coding — Apple Newsroom](https://www.apple.com/newsroom/2026/02/xcode-26-poin | CODE |
| MEDIUM | docs/features/F124-apple-ecosystem-voice-interaction.md | 174 | - [Apple releases Xcode 26.3 — 9to5Mac](https://9to5mac.com/2026/02/26/apple-releases-xcode-26-3-with-support-for-agenti | CODE |
| MEDIUM | docs/features/F213-stale-mcp-config-cleanup.md | 284 | PR #1894 (5-round P1 chain) 保留 close 状态作为 "lookup-based scaffolding antipattern" 教学案例，commits `b7d618436` → `878bb144d` | CODE |
| MEDIUM | docs/features/F044-channel-activity-system.md | 252 | 私密频道消息的 token 算谁的？Ragdoll在 `#ragdoll-hq` 发了 20 条策略讨论，进不进公开频道的 context window？ | CODE |
| MEDIUM | docs/features/F308-full-sync-durable-fast-train.md | 100 | ### Phase B — Safe orchestration | COMMENT |
| MEDIUM | docs/features/F129-pack-system-multi-agent-mod.md | 25 | ### 核心洞察：shared-rules 是 multi-agent 的分水岭 | COMMENT |
| MEDIUM | docs/decisions/021-f129-pack-system-architecture.md | 26 | ### 关键洞察：shared-rules 是 multi-agent 的分水岭 | COMMENT |
| MEDIUM | scripts/intake-from-opensource.sh | 177 | # These files often carry route wiring, dependency injection, auth/callback, | COMMENT |
| MEDIUM | scripts/lib/sync-skills-helpers.sh | 3 | # flags, keeping the CLI orchestration small without changing write boundaries. | COMMENT |
| MEDIUM | packages/web/src/components/hub-cat-editor.model.ts | 53 | /** clowder-ai#1208: single context window cap; empty = Auto. */ | COMMENT |
| MEDIUM | packages/web/src/hooks/useCatData.ts | 63 | /** clowder-ai#1208: explicit context window cap. undefined=Auto, positive int=Manual. */ | COMMENT |
| MEDIUM | packages/shared/src/types/cat.ts | 89 | /** clowder-ai#1208: explicit member-level context window cap (tokens). | COMMENT |
| MEDIUM | packages/shared/src/types/cat-breed.ts | 85 | * clowder-ai#1208: explicit member-level context window cap (tokens). | COMMENT |
| MEDIUM | packages/shared/src/types/pack.ts | 41 | // ─── Guardrails (guardrails.yaml) ──────────────────────────────────── | COMMENT |
| MEDIUM | packages/shared/src/schemas/pack.ts | 53 | // ─── Guardrails (guardrails.yaml) ──────────────────────────────────── | COMMENT |
| MEDIUM | packages/api/test/api-fetcher.test.js | 74 | url: 'https://example.com/agentic-workflows', | CODE |
| MEDIUM | packages/api/test/api-fetcher.test.js | 93 | assert.equal(result.articles[0].url, 'https://example.com/agentic-workflows'); | CODE |
| MEDIUM | packages/api/test/invoke-single-cat.test.js | 3610 | // step_finish event (per LLM call inside opencode agentic loop) carries | COMMENT |
| MEDIUM | …kages/api/test/issue-1381-codex-context-window.test.js | 21 | describe('issue #1381: Codex exec_json native/effective context window feedback loop', () => { | CODE |
| MEDIUM | packages/api/test/cats-routes-runtime-crud.test.js | 556 | // #1208: changing context window via top-level contextWindow field | COMMENT |
| MEDIUM | packages/api/test/cats-routes-runtime-crud.test.js | 623 | // #1208: model switch + context window via top-level contextWindow | COMMENT |
| MEDIUM | packages/api/test/system-prompt-builder.test.js | 2037 | // Core governance (L0 家规) must come before pack guardrails | COMMENT |
| MEDIUM | packages/api/test/memory/embed-eval.test.js | 48 | // This is expected — the scaffold validates the test infra is wired | COMMENT |
| MEDIUM | packages/api/test/memory/embed-eval.test.js | 55 | // For now, the scaffold proves the test runner picks up the file. | COMMENT |
| MEDIUM | packages/api/test/memory/event-memory-store.test.js | 324 | ins.run('evt_legacy_2', 'dup'); // same (thread_a, msg_1, scaffold) — a legacy duplicate | CODE |
| MEDIUM | packages/api/src/domains/packs/PackSecurityGuard.ts | 95 | // 3. Validate guardrails.yaml | COMMENT |
| MEDIUM | packages/api/src/domains/packs/PackSecurityGuard.ts | 113 | // 9. Scan guardrails for relaxation attempts | COMMENT |
| MEDIUM | packages/api/src/domains/packs/PackSecurityGuard.ts | 243 | // No guardrails — ok | COMMENT |
| MEDIUM | packages/api/src/config/cat-config-loader.ts | 151 | /** clowder-ai#1208: explicit context window cap. undefined=Auto, positive int=Manual. */ | COMMENT |
| MEDIUM | packages/api/src/config/runtime-cat-catalog.ts | 47 | /** clowder-ai#1208: explicit context window cap (tokens). undefined = Auto. */ | COMMENT |
| MEDIUM | packages/api/src/config/runtime-cat-catalog.ts | 80 | /** clowder-ai#1208: explicit context window cap. null to remove, undefined to skip. */ | COMMENT |
| MEDIUM | packages/api/src/routes/cats.ts | 168 | /** clowder-ai#1208: explicit context window cap. undefined=Auto, positive int=Manual. | COMMENT |
| MEDIUM | packages/api/src/routes/cats.ts | 683 | // #1208 Items 4+6: resolved context window info + client capability for Hub display. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | …s/harness-feedback/eval-domains/eval-anchor-first.yaml | 30 | # Findings route to F236 owner (opus-47 as the registered harness-eval cell owner). | COMMENT |
| MEDIUM | docs/harness-feedback/eval-domains/eval-friction.yaml | 30 | # Actionable friction findings route to the harness-eval owner (Phase D wires | COMMENT |
| MEDIUM | docs/harness-feedback/eval-domains/eval-friction.yaml | 34 | # would be an unwakeable handoff. Use opus-47 — registered + the harness-eval cell | COMMENT |
| MEDIUM | docs/harness-feedback/eval-domains/eval-sop.yaml | 14 | # See: docs/features/F192-socio-technical-harness-eval.md (sunset/re-enable journal) | COMMENT |
| MEDIUM | …-domains/community-fixtures/custom-domain-example.yaml | 10 | # See: packages/api/src/infrastructure/harness-eval/community-eval-domain.ts | COMMENT |
| MEDIUM | packages/web/src/components/CliDiagnosticsPanel.tsx | 120 | // clowder-ai#1324/#1325 (@codex-terra review): the harness's MANAGED argv drifted from the | COMMENT |
| MEDIUM | packages/mcp-server/test/callback-retry.test.js | 56 | // robust if a future caller passes a plain AbortController signal. | COMMENT |
| MEDIUM | …ckages/mcp-server/governance/mcp-surface-baseline.json | 6577 | "description": "Declare a bounded ball hold: keep the ball while waiting for a short, predictable condition, then | CODE |
| MEDIUM | packages/api/test/cli-diagnostics.test.js | 25 | // clowder-ai#1324 / #848: the harness's argv and the installed CLI version drift apart. | COMMENT |
| MEDIUM | packages/api/test/cli-diagnostics.test.js | 56 | test('#1325: a rejected USER flag must NOT be attributed to harness argv drift', () => { | CODE |
| MEDIUM | packages/api/test/gemini-agent-service.test.js | 296 | test('#1325: operator --agent-file reaches Gemini argv without harness-drift attribution', async () => { | CODE |
| MEDIUM | packages/api/test/staging-content.test.js | 289 | // History: born unconditional in PR #2005 (c3f6812ad, "harness 改动按 | COMMENT |
| MEDIUM | packages/api/test/b1c-2-build-delta-payload.test.js | 308 | // contract precisely when the receiver needs robust parsing most. | COMMENT |
| MEDIUM | …rness-eval/design-gate-episode-source-provider.test.js | 29 | `---\ndescription_author: codex-sol\n---\n# Plan\n## Finish line\nArchitecture cell: harness-eval\nMap delta: none\n | CODE |
| MEDIUM | …rness-eval/design-gate-episode-source-provider.test.js | 181 | `---\ndescription_author: codex-sol\n---\n# Plan\n## Finish line\nArchitecture cell: harness-eval\n## Unrelated evid | CODE |
| MEDIUM | …ains/cats/services/cloud-bridge/build-delta-payload.ts | 141 | // the cloud cat side, exactly when the receiver needs robust parsing most.) | COMMENT |
| MEDIUM⚡ | …s/cats/services/agents/providers/ClaudeAgentService.ts | 207 | * #1542: write the harness-injected PreCompact registration to a temp settings | COMMENT |
| MEDIUM | …mains/cats/services/frustration/FrustrationDetector.ts | 32 | // clowder-ai#1324/#1325: the harness's managed argv drifted from the installed CLI | COMMENT |
| MEDIUM | packages/api/src/utils/cli-diagnostics.ts | 147 | // clowder-ai#1324 (refs #848): harness argv vs installed CLI version drifted apart. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | cat-cafe-skills/hyperfocus-brake/sanitizer.test.sh | 51 | result=$(sanitize "user@example.com") | CODE |
| LOW | …ckages/web/src/stores/__tests__/bubble-reducer.test.ts | 1081 | it('uses local-only id when canonicalInvocationId missing, not "placeholder" magic (P2)', () => { | CODE |
| LOW | …ckages/web/src/stores/__tests__/bubble-reducer.test.ts | 1096 | expect(id).not.toContain('placeholder'); | CODE |
| LOW | …web/src/components/__tests__/vote-config-modal.test.ts | 20 | expect(html).toContain('placeholder'); | CODE |
| LOW | …es/web/src/components/__tests__/task-composer.test.tsx | 12 | expect(html).toContain('placeholder'); | CODE |
| LOW | …ages/shared/src/types/cloud-bridge-outbound-receipt.ts | 27 | 'placeholder', | CODE |
| LOW | …ages/shared/src/types/cloud-bridge-outbound-receipt.ts | 120 | return ['empty', 'contentEditable', 'proseMirror', 'placeholder', 'virtualKeyboard', 'trailingBreak'].every( | CODE |
| LOW | packages/api/test/f296-installed-layout.test.js | 35 | test('placeholder', () => {}); | CODE |
| LOW | packages/api/test/callback-start-vote.test.js | 176 | headers: { 'x-invocation-id': 'fake-id', 'x-callback-token': 'fake-token' }, | CODE |
| LOW | packages/api/test/telegram-adapter.test.js | 393 | const msgId = await adapter.sendPlaceholder('2002', 'placeholder'); | CODE |
| LOW | packages/api/test/write-vignette-persistence.test.js | 37 | execSync('git config user.email "test@test.com"', { cwd: workspaceDir, stdio: 'pipe' }); | CODE |
| LOW | packages/api/test/adapter-send-media.test.js | 11 | const adapter = new TelegramAdapter('fake-token', { | CODE |
| LOW | packages/api/test/adapter-send-media.test.js | 52 | const adapter = new TelegramAdapter('fake-token', { | CODE |
| LOW | packages/api/test/adapter-send-media.test.js | 84 | const adapter = new TelegramAdapter('fake-token', { | CODE |
| LOW | packages/api/test/adapter-send-media.test.js | 117 | const adapter = new TelegramAdapter('fake-token', { | CODE |
| LOW | packages/api/test/adapter-send-media.test.js | 153 | const adapter = new TelegramAdapter('fake-token', { | CODE |
| LOW | packages/api/test/streaming-outbound-hook.test.js | 103 | assert.ok(!text.includes('placeholder'), `Receipt should not be a raw placeholder, got: ${text}`); | CODE |
| LOW | packages/api/test/callback-bootcamp-env-check.test.js | 56 | callbackToken: 'fake-token', | CODE |
| LOW | …ckages/api/test/connector-phase-b4-integration.test.js | 59 | sent.push({ chatId, text, type: 'placeholder', msgId }); | CODE |
| LOW | …ckages/api/test/connector-phase-b4-integration.test.js | 198 | assert.equal(adapter.sent[0].type, 'placeholder'); | CODE |
| LOW | packages/api/test/invoke-single-cat-preflight.test.js | 55 | execSync('git config user.email "test@test.com"', { cwd: dir, stdio: 'ignore' }); | CODE |
| LOW | …i/test/f296-b3b3-provider-boundary-integration.test.js | 103 | prompt: 'placeholder', | CODE |
| LOW | …i/test/f296-b3b3-provider-boundary-integration.test.js | 209 | prompt: 'placeholder', | CODE |
| LOW | …ages/api/test/invoke-single-cat-turn-execution.test.js | 220 | prompt: 'placeholder', | CODE |
| LOW | packages/api/test/write-vignette.test.js | 218 | execSync('git config user.email "test@test.com"', { cwd: gitDir, stdio: 'pipe' }); | CODE |
| LOW | packages/api/test/bg-carrier-streaming.test.js | 570 | const finalAnswer = 'The file contains 42 lines of Lorem ipsum.'; | CODE |
| LOW | …kages/api/test/feat-trajectory-real-git-runner.test.js | 202 | assert.strictEqual(extractCatHandle('user@example.com'), null); | CODE |
| LOW | packages/api/test/callback-native-test-grant.test.js | 29 | if (invocationId !== 'inv' || callbackToken !== 'fake-token') return { ok: false, reason: 'invalid_token' }; | CODE |
| LOW | packages/api/test/callback-native-test-grant.test.js | 76 | headers: { 'x-invocation-id': 'inv', 'x-callback-token': 'fake-token' }, | CODE |
| LOW | packages/api/test/callback-native-test-grant.test.js | 83 | assert.ok(!live.body.includes('fake-token')); | CODE |
| LOW | packages/api/test/callback-bootcamp-state.test.js | 68 | headers: { 'x-invocation-id': 'fake-id', 'x-callback-token': 'fake-token' }, | CODE |
| LOW | packages/api/test/shared-state-preflight.test.js | 31 | execSync('git config user.email "test@test.com"', { cwd: dir, stdio: 'ignore' }); | CODE |
| LOW | packages/api/test/feishu-adapter.test.js | 916 | const messageId = await adapter.sendPlaceholder('oc_chat', 'placeholder'); | CODE |
| LOW | packages/api/test/feishu-adapter.test.js | 1175 | assert.ok(bodyEl.content.includes('user@example.com'), 'email-like @-token must NOT be replaced'); | CODE |
| LOW | …api/test/harness-eval/eval-repair-approval-fixtures.js | 85 | [nextActionRef, caseAction({ supersedesProposalId: 'placeholder' })], | CODE |
| LOW | …pi/test/harness-eval/publish-verdict-freshness.test.js | 266 | snapshotRefs: ['placeholder'], | CODE |
| LOW | …pi/test/harness-eval/publish-verdict-freshness.test.js | 267 | attributionRefs: ['placeholder'], | CODE |
| LOW | packages/api/test/integration/mcp-prompt-e2e.test.js | 182 | callbackToken: 'fake-token', | CODE |
| LOW | packages/api/test/integration/history.test.js | 90 | content: 'placeholder', | CODE |
| LOW | packages/api/src/routes/quota.ts | 120 | sourceKind: 'cli' | 'browser' | 'placeholder'; | CODE |
| LOW | packages/api/src/routes/quota.ts | 351 | sourceKind: 'placeholder', | CODE |
| LOW | site/main.js | 75 | ['data-i18n-placeholder', 'placeholder'], | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | scripts/services/tts-api.py | 721 | except BaseException: | CODE |
| HIGH | scripts/services/whisper-api.py | 260 | except Exception: | CODE |
| HIGH | scripts/services/whisper-api.py | 289 | except Exception: | CODE |
| HIGH | scripts/services/whisper-api.py | 296 | except ImportError: | CODE |
| HIGH | scripts/services/embed-api.py | 482 | except ImportError: | CODE |
| HIGH | scripts/services/embed_runtime_policy.py | 168 | except asyncio.CancelledError: | CODE |
| HIGH | scripts/services/embed_runtime_policy.py | 177 | except asyncio.CancelledError: | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …duck-roadshow/pipeline/bin/microduck_control_runner.py | 322 | except Exception as error: # runner boundary emits no secret-bearing traceback | CODE |
| MEDIUM | …duck-roadshow/pipeline/bin/microduck_control_runner.py | 317 | def main() -> int: | CODE |
| LOW | scripts/check-skills-mount.sh | 59 | except Exception: | CODE |
| LOW | scripts/services/llm-postprocess-api.py | 170 | except Exception as exc: | CODE |
| LOW | scripts/services/llm-postprocess-api.py | 199 | except Exception: | CODE |
| LOW | scripts/services/llm-postprocess-api.py | 210 | except Exception: | CODE |
| LOW | scripts/services/llm-postprocess-api.py | 241 | except Exception: | CODE |
| MEDIUM | scripts/services/tts-api.py | 687 | def produce_events(): | CODE |
| LOW | scripts/services/tts-api.py | 659 | except Exception as exc: | CODE |
| LOW | scripts/services/tts-api.py | 693 | except Exception as exc: | CODE |
| LOW | scripts/services/tts-api.py | 713 | except Exception as exc: | CODE |
| LOW | scripts/services/tts-api.py | 764 | except Exception as exc: | CODE |
| LOW | scripts/services/tts-api.py | 811 | except Exception: | CODE |
| LOW | scripts/services/whisper-api.py | 180 | except Exception as exc: | CODE |
| LOW | scripts/services/whisper-api.py | 207 | except Exception as exc: | CODE |
| LOW | scripts/services/whisper-api.py | 242 | except Exception: | CODE |
| LOW | scripts/services/whisper-api.py | 260 | except Exception: | CODE |
| LOW | scripts/services/whisper-api.py | 268 | except Exception as e: | CODE |
| LOW⚡ | scripts/services/whisper-api.py | 289 | except Exception: | CODE |
| LOW⚡ | scripts/services/whisper-api.py | 298 | except Exception: | CODE |
| LOW⚡ | scripts/services/whisper-api.py | 306 | except Exception: | CODE |
| LOW | scripts/services/whisper-api.py | 317 | except Exception: | CODE |
| LOW | scripts/services/embed-api.py | 437 | except Exception as e: | CODE |
| LOW | scripts/services/embed-api.py | 506 | except Exception as e: | CODE |
| LOW | scripts/services/embed-api.py | 569 | except Exception: | CODE |
| LOW | scripts/services/install-template.sh | 236 | except Exception: | CODE |
| LOW | scripts/services/install-template.sh | 245 | except Exception as e: | CODE |
| LOW | scripts/services/install-template.sh | 266 | except Exception: | CODE |
| LOW | scripts/services/install-template.sh | 334 | except Exception as e: | CODE |
| LOW | scripts/services/embed_runtime_policy.py | 82 | except Exception: | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | desktop/scripts/build-mac.sh | 14 | # Usage: | COMMENT |
| LOW | scripts/thread-exports-autosave.sh | 6 | # Usage: | COMMENT |
| LOW | scripts/thread-exports-sync.sh | 8 | # Usage: | COMMENT |
| LOW | scripts/user-redis.sh | 6 | # Usage: | COMMENT |
| LOW | scripts/install-git-guards.sh | 7 | # Usage: | COMMENT |
| LOW | scripts/user-redis-autobackup.sh | 6 | # Usage: | COMMENT |
| LOW | scripts/find-redis-dumps.sh | 7 | # Usage: | COMMENT |
| LOW | scripts/pre-merge-check.sh | 7 | # Usage: | COMMENT |
| LOW | scripts/services/tts-server.sh | 5 | # Usage: | COMMENT |
| LOW | scripts/services/embed-server.sh | 5 | # Usage: | COMMENT |
| LOW | scripts/services/whisper-server.sh | 6 | # Usage: | COMMENT |
| LOW | scripts/services/llm-postprocess-server.sh | 7 | # Usage: | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …duck-roadshow/pipeline/bin/microduck_control_runner.py | 10 | CODE | |
| LOW | scripts/services/test_whisper_worker.py | 4 | CODE | |
| LOW | scripts/services/llm-postprocess-api.py | 8 | CODE | |
| LOW | scripts/services/tts-api.py | 26 | CODE | |
| LOW | scripts/services/test_tts_runtime.py | 1 | CODE | |
| LOW | scripts/services/test_embed_runtime_policy.py | 3 | CODE | |
| LOW | scripts/services/whisper-api.py | 4 | CODE | |
| LOW | scripts/services/embed-api.py | 9 | CODE | |
| LOW | scripts/services/dedicated_model_worker.py | 3 | CODE | |
| LOW | scripts/services/qwen_asr_backend.py | 3 | CODE | |
| LOW | scripts/services/embed_runtime_policy.py | 7 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | packages/api/test/start-dev-script.test.js | 1360 | elif compgen -G "${backupDir}/stale-aof-test-6399-*" >/dev/null; then | CODE |
| HIGH | packages/api/test/start-dev-script.test.js | 1434 | elif compgen -G "${backupDir}/stale-aof-test-6399-*" >/dev/null; then | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | cat-cafe-skills/hyperfocus-brake/state.test.sh | 232 | # Create a symlink pointing to a sensitive file | COMMENT |
| MEDIUM | assets/brand-dictionary.yaml | 3 | # This file is the machine-readable truth source for F238. It defines | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | docs/features/F127-cat-instance-management.md | 40 | | `api_key` — Claude | apiKey + baseUrl + 可选 modelOverride | `<your-api-key>` + `https://api.anthropic.com` | | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | scripts/services/tts-api.py | 461 | CODE | |
| LOW | scripts/services/test_tts_runtime.py | 328 | CODE | |
| LOW | scripts/services/embed-api.py | 360 | CODE | |
| LOW | scripts/services/embed-api.py | 510 | CODE | |
| LOW | scripts/services/embed_runtime_policy.py | 88 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | scripts/intake-from-opensource.sh | 1559 | # Check if this landed mainline commit is covered by an entries[] record | COMMENT |
| LOW | scripts/preflight-shared-state.sh | 33 | # Check if any commits on this branch touch shared state | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | scripts/services/test_tts_runtime.py | 423 | CODE |