high System graph quality Integrity conf 1.00 Blocking `urllib.request.urlopen(...)` inside `async def _acknowledge_delight` — src/openbiliclaw/integrations/openclaw/cli.py:232

Sync I/O inside an async function blocks the event loop. While `urllib.request.urlopen(...)` is running, *all* other coroutines on this loop are paused — silent throughput collapse under concurrency. Use the async equivalent (`httpx.AsyncClient`, `asyncio.sleep`, `aiofiles`) or wrap with `await asy…

src/openbiliclaw/integrations/openclaw/cli.py:232 Sync io in asyncPerformance

high System graph api Wiring conf 1.00 Dangling fetch: GET https://api.github.com/repos/${STAR_REPO_SLUG} (extension/popup/popup.js:2052)

`extension/popup/popup.js:2052` calls `GET https://api.github.com/repos/${STAR_REPO_SLUG}` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/https:/api.github.com/repos/<p>` If this points at an external API, prefix it…

Dangling fetchFetch

high System graph api Wiring conf 1.00 Dangling fetch: GET https://api.github.com/repos/${STAR_REPO_SLUG} (src/openbiliclaw/web/desktop/assets/js/app.js:297)

`src/openbiliclaw/web/desktop/assets/js/app.js:297` calls `GET https://api.github.com/repos/${STAR_REPO_SLUG}` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/https:/api.github.com/repos/<p>` If this points at an ext…

Dangling fetchFetch

high System graph api Wiring conf 1.00 Dangling fetch: GET https://www.douyin.com/aweme/v1/web/hot/search/list/ (extension/tests/dy-fetch-tap.test.ts:326)

`extension/tests/dy-fetch-tap.test.ts:326` calls `GET https://www.douyin.com/aweme/v1/web/hot/search/list/` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/https:/www.douyin.com/aweme/v1/web/hot/search/list` If this …

Dangling fetchFetch

high System graph api Wiring conf 1.00 Dangling fetch: GET https://www.douyin.com/aweme/v2/web/module/feed/ (extension/tests/dy-fetch-tap.test.ts:325)

`extension/tests/dy-fetch-tap.test.ts:325` calls `GET https://www.douyin.com/aweme/v2/web/module/feed/` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/https:/www.douyin.com/aweme/v2/web/module/feed` If this points a…

Dangling fetchFetch

high System graph security auth conf 1.00 FastAPI POST `auth_login` without auth dependency — src/openbiliclaw/api/auth.py:423

`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.

src/openbiliclaw/api/auth.py:423 securityAuth fastapi unauth mutation

high System graph security auth conf 1.00 FastAPI POST `auth_logout` without auth dependency — src/openbiliclaw/api/auth.py:469

`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.

src/openbiliclaw/api/auth.py:469 securityAuth fastapi unauth mutation

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — extension/src/background/service-worker.ts:97

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — extension/src/content/douyin.ts:987

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — extension/src/main/dy-fetch-tap.ts:528

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — src/openbiliclaw/web/desktop/assets/js/app.js:1376

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — src/openbiliclaw/web/js/views/saved.js:30

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph security Agent instructions conf 1.00 Agent instruction contains unpinned remote install: skills/browse/SKILL.md

Remote install commands in agent instructions are a supply-chain risk, especially when an agent can execute shell commands.

skills/browse/SKILL.md:34 Supply chainSkill file

medium System graph quality Placeholder conf 1.00 Critical user flow still appears backed by mock or placeholder data

A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded.

Mock dataCritical flowGenerated repo pattern

medium System graph hardware Security conf 1.00 Dockerfile runs as root: Dockerfile

No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image.

Container

medium System graph cicd CI/CD security conf 1.00 GitHub Actions workflow grants broad write permissions

CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions.

.github/workflows/release-extension.yml CI/CD securitySupply chainGithub actions

medium System graph cicd CI/CD security conf 1.00 GitHub Actions workflow grants broad write permissions

CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions.

.github/workflows/release-desktop.yml CI/CD securitySupply chainGithub actions

medium System graph security security conf 1.00 Insecure pattern 'cors_wildcard' in src/openbiliclaw/api/app.py:608

Found a known-risky pattern (cors_wildcard). Review and replace if possible.

src/openbiliclaw/api/app.py:608 Cors wildcard

medium System graph security security conf 1.00 Insecure pattern 'cors_wildcard' in src/openbiliclaw/api/auth.py:367

Found a known-risky pattern (cors_wildcard). Review and replace if possible.

src/openbiliclaw/api/auth.py:367 Cors wildcard

medium System graph security security conf 1.00 Insecure pattern 'direct_innerhtml_assignment' in extension/popup/popup.js:2111

Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.

extension/popup/popup.js:2111 Direct innerhtml assignment

medium System graph security security conf 1.00 Insecure pattern 'direct_innerhtml_assignment' in src/openbiliclaw/web/desktop/assets/js/app.js:490

Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.

src/openbiliclaw/web/desktop/assets/js/app.js:490 Direct innerhtml assignment

medium System graph security security conf 1.00 Insecure pattern 'direct_innerhtml_assignment' in src/openbiliclaw/web/js/app.js:22

Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.

src/openbiliclaw/web/js/app.js:22 Direct innerhtml assignment

medium System graph security security conf 1.00 Insecure pattern 'direct_innerhtml_assignment' in src/openbiliclaw/web/js/views/chat.js:99

Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.

src/openbiliclaw/web/js/views/chat.js:99 Direct innerhtml assignment

medium System graph security security conf 1.00 Insecure pattern 'direct_innerhtml_assignment' in src/openbiliclaw/web/js/views/login.js:12

Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.

src/openbiliclaw/web/js/views/login.js:12 Direct innerhtml assignment

medium System graph security security conf 1.00 Insecure pattern 'direct_innerhtml_assignment' in src/openbiliclaw/web/js/views/profile.js:104

Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.

src/openbiliclaw/web/js/views/profile.js:104 Direct innerhtml assignment

medium System graph security security conf 1.00 Insecure pattern 'direct_innerhtml_assignment' in src/openbiliclaw/web/js/views/recommend.js:120

Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.

src/openbiliclaw/web/js/views/recommend.js:120 Direct innerhtml assignment

medium System graph security security conf 1.00 Insecure pattern 'direct_innerhtml_assignment' in src/openbiliclaw/web/js/views/saved.js:41

Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.

src/openbiliclaw/web/js/views/saved.js:41 Direct innerhtml assignment

medium System graph security security conf 1.00 Insecure pattern 'direct_innerhtml_assignment' in src/openbiliclaw/web/setup/index.html:270

Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.

src/openbiliclaw/web/setup/index.html:270 Direct innerhtml assignment

medium System graph security security conf 1.00 Insecure pattern 'direct_outerhtml_assignment' in src/openbiliclaw/web/desktop/assets/js/app.js:2546

Found a known-risky pattern (direct_outerhtml_assignment). Review and replace if possible.

src/openbiliclaw/web/desktop/assets/js/app.js:2546 Direct outerhtml assignment

medium System graph security security conf 1.00 Insecure pattern 'node_child_process' in extension/scripts/package-firefox.mjs:1

Found a known-risky pattern (node_child_process). Review and replace if possible.

extension/scripts/package-firefox.mjs:1 Node child process

medium System graph security security conf 1.00 Insecure pattern 'node_child_process' in extension/scripts/package.mjs:1

Found a known-risky pattern (node_child_process). Review and replace if possible.

extension/scripts/package.mjs:1 Node child process

medium System graph security security conf 1.00 Insecure pattern 'subprocess_shell_true' in scripts/agent_bootstrap.py:1202

Found a known-risky pattern (subprocess_shell_true). Review and replace if possible.

scripts/agent_bootstrap.py:1202 Subprocess shell true

medium System graph security security conf 1.00 Insecure pattern 'subprocess_shell_true' in src/openbiliclaw/cli.py:1367

Found a known-risky pattern (subprocess_shell_true). Review and replace if possible.

src/openbiliclaw/cli.py:1367 Subprocess shell true

medium System graph quality Integrity conf 1.00 Network/subprocess call without timeout or try/except — packaging/build.py:341

`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 Network/subprocess call without timeout or try/except — packaging/entry.py:452

`subprocess.Popen(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 Network/subprocess call without timeout or try/except — scripts/agent_bootstrap.py:1229

`subprocess.Popen(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 Network/subprocess call without timeout or try/except — src/openbiliclaw/cli.py:1343

`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 Network/subprocess call without timeout or try/except — src/openbiliclaw/llm/codex_auth.py:205

`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.

runtime safetyRobustness

medium System graph quality Placeholder conf 1.00 Placeholder or mock-heavy implementation detected

Found 78 placeholder/mock markers across 22 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data.

Mock dataIncompleteGenerated repo pattern

low System graph hardware Coverage conf 1.00 Containers defined but no K8s/orchestration manifest found

Repo has Dockerfiles/compose but no Kubernetes/Nomad manifests. If the target deployment is K8s, the manifests may live in a separate ops repo.

Deployment

low System graph quality Debug conf 1.00 Debug logging residue appears in source files

Found 326 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup.

CleanupRepo hardeningGenerated repo pattern

low System graph hardware Supply chain conf 1.00 Docker base image is tag-pinned but not digest-pinned: python:3.11-slim

Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter.

Dockerfile:6 containersPinned dependencies

low System graph cicd CI/CD security conf 1.00 17 occurrences GitHub Action is tag-pinned rather than SHA-pinned

actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA.

5 files, 17 locations

.github/workflows/ci.yml:15, 18, 43, 46, 81, 84, 92 (7 hits)

.github/workflows/release-extension.yml:18, 21, 77, 90, 95 (5 hits)

.github/workflows/publish-chrome-webstore.yml:27, 30 (2 hits)

.github/workflows/release-desktop.yml:143, 148 (2 hits)

.github/workflows/release-backend.yml:18

CI/CD securitySupply chainGithub actions

low System graph frontend Frontend quality conf 1.00 Icon-only button without accessible name — src/openbiliclaw/web/desktop/assets/js/app.js:2250

A `<button>` whose only child is a single glyph or symbol needs `title=` or `aria-label=` so screen readers (and tooltips on hover) work. Why: P3 in CHECKLIST.md — icon-only buttons skipped a title. Rule id: fq.button.no-label

Fq button no label

low System graph frontend Frontend quality conf 1.00 Icon-only button without accessible name — src/openbiliclaw/web/js/views/profile.js:584

A `<button>` whose only child is a single glyph or symbol needs `title=` or `aria-label=` so screen readers (and tooltips on hover) work. Why: P3 in CHECKLIST.md — icon-only buttons skipped a title. Rule id: fq.button.no-label

Fq button no label

low System graph quality Agent instructions conf 1.00 Multiple root agent instruction files without precedence

The repo has multiple top-level AI-coder instruction files. Without precedence rules, different agents may follow different policies.

Governance

low System graph quality Integrity conf 1.00 Near-duplicate function bodies in 13 places

Functions with the same first-5-line body hash: src/openbiliclaw/recommendation/engine.py:complete_structured_task, src/openbiliclaw/soul/insight_analyzer.py:complete_structured_task, src/openbiliclaw/soul/consolidator.py:complete_structured_task, src/openbiliclaw/soul/profile_builder.py:complete_s…

duplicatesduplication

low System graph quality Integrity conf 1.00 16 occurrences Near-duplicate function bodies in 2 places

Functions with the same first-5-line body hash: scripts/agent_bootstrap.py:collect_human_llm_config, scripts/agent_bootstrap.py:collect_human_install_wizard This is *the* AI-coder failure mode (4× more duplication in vibe-coded repos — see https://jw.hn/ai-code-hygiene). Consolidate or document wh…

16 occurrences

repo-level (16 hits)

duplicatesduplication

low System graph quality Integrity conf 1.00 Near-duplicate function bodies in 3 places

Functions with the same first-5-line body hash: scripts/run_update_auto_optimize.py:main, scripts/run_speculation_auto_optimize.py:main, scripts/run_auto_optimize.py:main This is *the* AI-coder failure mode (4× more duplication in vibe-coded repos — see https://jw.hn/ai-code-hygiene). Consolidate …

duplicatesduplication

low System graph quality Integrity conf 1.00 Near-duplicate function bodies in 4 places

Functions with the same first-5-line body hash: src/openbiliclaw/integrations/openclaw/skill.py:action, src/openbiliclaw/integrations/openclaw/skill.py:action, src/openbiliclaw/integrations/openclaw/skill.py:action, src/openbiliclaw/integrations/openclaw/skill.py:action This is *the* AI-coder fail…

duplicatesduplication

low System graph quality Integrity conf 1.00 Near-duplicate function bodies in 5 places

Functions with the same first-5-line body hash: src/openbiliclaw/sources/twitter_adapter.py:fetch, src/openbiliclaw/sources/protocol.py:fetch, src/openbiliclaw/sources/bilibili_adapter.py:fetch, src/openbiliclaw/sources/xiaohongshu_adapter.py:fetch This is *the* AI-coder failure mode (4× more dupl…

duplicatesduplication

low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `_maybe_create_runtime_database_backup` in src/openbiliclaw/cli.py:726

Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.

old markerDead code

low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `_maybe_create_runtime_database_backup` in tests/test_cli.py:527

Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.

old markerDead code

low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `acct_old` in tests/test_codex_auth.py:104

Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.

old markerDead code

low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `BV_legacy` in tests/test_franchise_key_e2e.py:74

Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.

old markerDead code

low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `db_backup` in src/openbiliclaw/storage/maintenance.py:31

Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.

old markerDead code

low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `embedding_cache_legacy` in src/openbiliclaw/llm/embedding.py:101

Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.

old markerDead code

low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `exec_old` in tests/test_discovery_keywords.py:243

Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.

old markerDead code

low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `from_legacy` in src/openbiliclaw/soul/engine.py:301

Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.

old markerDead code

low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `from_legacy` in src/openbiliclaw/soul/profile.py:632

Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.

old markerDead code

low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `from_legacy` in src/openbiliclaw/soul/profile_builder.py:130

Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.

old markerDead code

low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `get_pool_candidates_needing_copy` in src/openbiliclaw/storage/database.py:3187

Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.

old markerDead code

low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `norm_old` in src/openbiliclaw/eval/optimizer.py:576

Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.

old markerDead code

low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `precompute_pool_copy` in src/openbiliclaw/api/runtime_context.py:918

Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.

old markerDead code

low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `precompute_pool_copy` in src/openbiliclaw/recommendation/engine.py:199

Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.

old markerDead code

low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `precompute_pool_copy` in src/openbiliclaw/runtime/refresh.py:239

Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.

old markerDead code

low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `precompute_pool_copy` in src/openbiliclaw/runtime/task_registry.py:115

Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.

old markerDead code

low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `precompute_pool_copy` in tests/test_api_app.py:288

Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.

old markerDead code

low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `precompute_pool_copy` in tests/test_refresh_runtime.py:420

Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.

old markerDead code

low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `test_apply_overrides_empty_is_pure_copy` in tests/test_overrides.py:83

Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.

old markerDead code

low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `test_database_get_delight_candidate_requires_ready_copy` in tests/test_delight_scorer.py:300

Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.

old markerDead code

low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `test_get_pool_candidates_skips_rows_without_precomputed_copy` in tests/test_storage.py:1586

Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.

old markerDead code

low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `test_keeps_yielded_word_even_when_old` in tests/test_keyword_yield.py:118

Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.

old markerDead code

low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `test_migrate_noop_when_nothing_legacy` in tests/test_packaging_entry.py:253

Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.

old markerDead code

low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `test_referenced_needed_cover_kept_even_when_old` in tests/test_image_cache.py:150

Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.

old markerDead code

low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `test_reshuffle_recommendations_hides_missing_precomputed_copy` in tests/test_recommendation_engine.py:1070

Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.

old markerDead code

low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `test_twitter_engagement_scoring_v1` in tests/test_event_satisfaction.py:155

Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.

old markerDead code

low System graph software Dead code conf 1.00 Possibly dead Python function: apply_confirmation_answers_to_args

No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.

scripts/agent_bootstrap.py:751

low System graph software Dead code conf 1.00 Possibly dead Python function: auth_guard

No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.

src/openbiliclaw/api/auth.py:306

low System graph software Dead code conf 1.00 Possibly dead Python function: clear_cookie

No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.

src/openbiliclaw/bilibili/auth.py:155

low System graph software Dead code conf 1.00 Possibly dead Python function: clear_cookie

No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.

src/openbiliclaw/sources/douyin_auth.py:70

low System graph software Dead code conf 1.00 Possibly dead Python function: describe_all

No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.

src/openbiliclaw/agent/skill.py:96

low System graph software Dead code conf 1.00 Possibly dead Python function: detect_docker_missing_secrets

No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.

scripts/agent_bootstrap.py:2711

low System graph software Dead code conf 1.00 Possibly dead Python function: generate_personal_topic

No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.

src/openbiliclaw/recommendation/engine.py:1559

low System graph software Dead code conf 1.00 Possibly dead Python function: kick_douyin_task_dispatcher

No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.

src/openbiliclaw/sources/douyin_plugin_search.py:323

low System graph software Dead code conf 1.00 Possibly dead Python function: llm_concurrency_from_config

No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.

src/openbiliclaw/config.py:1196

low System graph software Dead code conf 1.00 Possibly dead Python function: load_record

No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.

src/openbiliclaw/sources/douyin_auth.py:55

low System graph software Dead code conf 1.00 Possibly dead Python function: pool_count

No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.

src/openbiliclaw/recommendation/curator.py:282

low System graph software Dead code conf 1.00 Possibly dead Python function: read_secret_no_echo

No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.

scripts/agent_bootstrap.py:375

low System graph software Dead code conf 1.00 Possibly dead Python function: register_skill

No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.

src/openbiliclaw/agent/orchestrator.py:57

low System graph software Dead code conf 1.00 Possibly dead Python function: run_discovery_cycle

No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.

src/openbiliclaw/agent/orchestrator.py:77

low System graph software Dead code conf 1.00 Possibly dead Python function: score_candidates_async

No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.

src/openbiliclaw/recommendation/curator.py:405

low System graph software Dead code conf 1.00 Possibly dead Python function: xhs_bootstrap_note_key

No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.

src/openbiliclaw/sources/xhs_tasks.py:55

low System graph software Dead code conf 1.00 Possibly dead Python function: yt_bootstrap_item_key

No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.

src/openbiliclaw/sources/yt_tasks.py:112

low System graph quality Provenance conf 1.00 Shallow git history limits provenance confidence

The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence.

Git historyGenerated repo pattern

low System graph frontend Frontend quality conf 1.00 Stray `console.log` in TS/JS — extension/src/background/cookie-sync.ts:229

Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak

Fq console leak

low System graph frontend Frontend quality conf 1.00 Stray `console.log` in TS/JS — extension/src/background/service-worker.ts:629

Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak

Fq console leak

low System graph frontend Frontend quality conf 1.00 Stray `console.log` in TS/JS — extension/src/content/bilibili.ts:15

Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak

Fq console leak

low System graph frontend Frontend quality conf 1.00 Stray `console.log` in TS/JS — extension/src/content/x.ts:93

Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak

Fq console leak

low System graph frontend Frontend quality conf 1.00 Stray `console.log` in TS/JS — extension/src/content/xiaohongshu.ts:224

Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak

Fq console leak

low System graph api Wiring conf 1.00 Unused endpoint: DELETE /api/favorites/{bvid}

`src/openbiliclaw/api/app.py` declares `DELETE /api/favorites/{bvid}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: DELETE /api/watch-later/{bvid}

`src/openbiliclaw/api/app.py` declares `DELETE /api/watch-later/{bvid}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: GET /api/activity-feed

`src/openbiliclaw/api/app.py` declares `GET /api/activity-feed` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: GET /api/auth/status

`src/openbiliclaw/api/auth.py` declares `GET /api/auth/status` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: GET /api/chat/turns

`src/openbiliclaw/api/app.py` declares `GET /api/chat/turns` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: GET /api/chat/turns/{turn_id}

`src/openbiliclaw/api/app.py` declares `GET /api/chat/turns/{turn_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: GET /api/cognition-updates/pending

`src/openbiliclaw/api/app.py` declares `GET /api/cognition-updates/pending` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: GET /api/delight/pending

`src/openbiliclaw/api/app.py` declares `GET /api/delight/pending` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: GET /api/delight/pending-batch

`src/openbiliclaw/api/app.py` declares `GET /api/delight/pending-batch` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: GET /api/favorites

`src/openbiliclaw/api/app.py` declares `GET /api/favorites` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: GET /api/favorites/{bvid}

`src/openbiliclaw/api/app.py` declares `GET /api/favorites/{bvid}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: GET /api/health

`src/openbiliclaw/api/app.py` declares `GET /api/health` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: GET /api/image-proxy

`src/openbiliclaw/api/app.py` declares `GET /api/image-proxy` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: GET /api/init-status

`src/openbiliclaw/api/app.py` declares `GET /api/init-status` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: GET /api/interest-probes/pending

`src/openbiliclaw/api/app.py` declares `GET /api/interest-probes/pending` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: GET /api/notifications/pending

`src/openbiliclaw/api/app.py` declares `GET /api/notifications/pending` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: GET /api/ping

`src/openbiliclaw/api/app.py` declares `GET /api/ping` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: GET /api/profile-summary

`src/openbiliclaw/api/app.py` declares `GET /api/profile-summary` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: GET /api/profile/edit-state

`src/openbiliclaw/api/app.py` declares `GET /api/profile/edit-state` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: GET /api/recommendations

`src/openbiliclaw/api/app.py` declares `GET /api/recommendations` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: GET /api/runtime-status

`src/openbiliclaw/api/app.py` declares `GET /api/runtime-status` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: GET /api/update-status

`src/openbiliclaw/api/app.py` declares `GET /api/update-status` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: GET /api/watch-later

`src/openbiliclaw/api/app.py` declares `GET /api/watch-later` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: GET /api/watch-later/{bvid}

`src/openbiliclaw/api/app.py` declares `GET /api/watch-later/{bvid}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: POST /api/auth/admin

`src/openbiliclaw/api/app.py` declares `POST /api/auth/admin` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: POST /api/auth/login

`src/openbiliclaw/api/auth.py` declares `POST /api/auth/login` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: POST /api/auth/logout

`src/openbiliclaw/api/auth.py` declares `POST /api/auth/logout` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: POST /api/bilibili/cookie

`src/openbiliclaw/api/app.py` declares `POST /api/bilibili/cookie` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: POST /api/chat

`src/openbiliclaw/api/app.py` declares `POST /api/chat` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: POST /api/chat/turns

`src/openbiliclaw/api/app.py` declares `POST /api/chat/turns` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: POST /api/cognition-updates/seen

`src/openbiliclaw/api/app.py` declares `POST /api/cognition-updates/seen` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: POST /api/delight/respond

`src/openbiliclaw/api/app.py` declares `POST /api/delight/respond` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: POST /api/delight/sent

`src/openbiliclaw/api/app.py` declares `POST /api/delight/sent` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: POST /api/delight/trigger

`src/openbiliclaw/api/app.py` declares `POST /api/delight/trigger` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: POST /api/events

`src/openbiliclaw/api/app.py` declares `POST /api/events` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: POST /api/favorites

`src/openbiliclaw/api/app.py` declares `POST /api/favorites` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: POST /api/init

`src/openbiliclaw/api/app.py` declares `POST /api/init` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: POST /api/init-completed

`src/openbiliclaw/api/app.py` declares `POST /api/init-completed` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: POST /api/init/cancel

`src/openbiliclaw/api/app.py` declares `POST /api/init/cancel` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: POST /api/interest-probes/trigger

`src/openbiliclaw/api/app.py` declares `POST /api/interest-probes/trigger` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: POST /api/notifications/sent

`src/openbiliclaw/api/app.py` declares `POST /api/notifications/sent` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: POST /api/profile/edit

`src/openbiliclaw/api/app.py` declares `POST /api/profile/edit` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: POST /api/recommendations/append

`src/openbiliclaw/api/app.py` declares `POST /api/recommendations/append` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: POST /api/recommendations/refresh

`src/openbiliclaw/api/app.py` declares `POST /api/recommendations/refresh` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: POST /api/recommendations/reshuffle

`src/openbiliclaw/api/app.py` declares `POST /api/recommendations/reshuffle` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: POST /api/sources/dy/cookie

`src/openbiliclaw/api/app.py` declares `POST /api/sources/dy/cookie` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: POST /api/sources/x/cookie

`src/openbiliclaw/api/app.py` declares `POST /api/sources/x/cookie` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: POST /api/update/apply

`src/openbiliclaw/api/app.py` declares `POST /api/update/apply` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: POST /api/update/check

`src/openbiliclaw/api/app.py` declares `POST /api/update/check` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: POST /api/watch-later

`src/openbiliclaw/api/app.py` declares `POST /api/watch-later` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph quality Complexity conf 1.00 Very large file: extension/popup/popup.js (6764 lines)