openclaude

Component	Sub-score	Weight	Contribution
`structure_score`	85.0	0.15	12.75
`security_score`	75.5	0.25	18.88
`testing_score`	61.0	0.20	12.20
`documentation_score`	93.7	0.15	14.05
`practices_score`	75.0	0.15	11.25
`code_quality`	67.7	0.10	6.77
Overall		1.00	75.9

critical 9-layer security secrets conf 1.00 Possible secret in src/services/api/openaiShim.ts

Detected pattern matching password_literal. Rotate the credential and move to a secret manager.

src/services/api/openaiShim.ts:221 secrets

critical 9-layer security secrets conf 1.00 Possible secret in src/utils/powershell/parser.ts

Detected pattern matching password_literal. Rotate the credential and move to a secret manager.

src/utils/powershell/parser.ts:1343 secrets

critical 9-layer security secrets conf 1.00 Possible secret in src/utils/providerProfile.ts

Detected pattern matching generic_api_key. Rotate the credential and move to a secret manager.

src/utils/providerProfile.ts:1601 secrets

critical 9-layer security secrets conf 1.00 Possible secret in src/utils/providerProfile.ts

Detected pattern matching generic_api_key. Rotate the credential and move to a secret manager.

src/utils/providerProfile.ts:1648 secrets

critical 9-layer security secrets conf 1.00 Possible secret in src/utils/urlRedaction.ts

Detected pattern matching password_literal. Rotate the credential and move to a secret manager.

src/utils/urlRedaction.ts:36 secrets

high 9-layer security owasp conf 1.00 Insecure pattern 'exec_used' in src/utils/auth.ts:678

Found a known-risky pattern (exec_used). Review and replace if possible.

src/utils/auth.ts:678 owaspexec_used

medium 9-layer frontend frontend-quality conf 1.00 `dangerouslySetInnerHTML` used in a React component — src/commands/security-review.ts:169

Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library. Why: OWASP basics. Already partially flagged by the security analyzer. Rule id: fq.dangerous-html

frontend-qualityfq.dangerous-html

medium 9-layer quality integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — src/hooks/useTasksV2.ts:69

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — src/services/api/claude.ts:1892

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — src/services/api/fetchWithProxyRetry.test.ts:48

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — src/services/mcp/client.ts:488

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — src/utils/genericProcessUtils.ts:33

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — src/utils/providerDiscovery.ts:279

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

integrityfragile-runtimerobustness

medium 9-layer cicd supply-chain conf 1.00 GitHub Actions workflow grants broad write permissions

CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions.

.github/workflows/release.yml supply-chaingithub-actionsleast-privilege

medium 9-layer security owasp conf 1.00 Insecure pattern 'dangerous_innerhtml' in src/commands/security-review.ts:169

Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible.

src/commands/security-review.ts:169 owaspdangerous_innerhtml

medium 9-layer security owasp conf 1.00 Insecure pattern 'weak_hash' in src/services/settingsSync/types.ts:30

Found a known-risky pattern (weak_hash). Review and replace if possible.

src/services/settingsSync/types.ts:30 owaspweak_hash

medium 9-layer security owasp conf 1.00 Insecure pattern 'weak_hash' in src/tools/BashTool/pathValidation.ts:549

Found a known-risky pattern (weak_hash). Review and replace if possible.

src/tools/BashTool/pathValidation.ts:549 owaspweak_hash

low 9-layer quality maintenance conf 1.00 129 TODO/FIXME markers

High count of TODO/FIXME/HACK markers — track them as issues so they're not forgotten.

maintenance

low 9-layer quality integrity conf 1.00 541 env vars used in code but missing from .env.example

Drift between code and config docs. The first few: `ALACRITTY_LOG`, `ALLOW_ANT_COMPUTER_USE_MCP`, `ANTHROPIC_AUTH_TOKEN`, `ANTHROPIC_BASE_URL`, `ANTHROPIC_BEDROCK_BASE_URL`, `ANTHROPIC_BETAS`, `ANTHROPIC_CUSTOM_HEADERS`, `ANTHROPIC_CUSTOM_MODEL_OPTION` + 533 more. Add them (with a placeholder/comme…

integrityconfig-drift

low 9-layer hardware coverage conf 1.00 Containers defined but no K8s/orchestration manifest found

Repo has Dockerfiles/compose but no Kubernetes/Nomad manifests. If the target deployment is K8s, the manifests may live in a separate ops repo.

coveragedeployment

low 9-layer hardware supply-chain conf 1.00 Docker base image is tag-pinned but not digest-pinned: node:22-slim

Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter.

Dockerfile:2 supply-chaindockerpinned-dependencies

low 9-layer hardware supply-chain conf 1.00 Docker base image is tag-pinned but not digest-pinned: node:22-slim

Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter.

Dockerfile:31 supply-chaindockerpinned-dependencies

low 9-layer software dead-code-candidate conf 1.00 File has no detected symbols: python/tests/conftest.py

Source file with no class/function declarations — possible config, dead code, or scratch file.

dead-code-candidate

low 9-layer software dead-code-candidate conf 1.00 File has no detected symbols: scripts/externals.ts

Source file with no class/function declarations — possible config, dead code, or scratch file.

dead-code-candidate

low 9-layer software dead-code-candidate conf 1.00 File has no detected symbols: scripts/feature-flags-source-guard.test.ts

Source file with no class/function declarations — possible config, dead code, or scratch file.

dead-code-candidate

low 9-layer software dead-code-candidate conf 1.00 File has no detected symbols: scripts/generate-integrations-artifacts.ts

Source file with no class/function declarations — possible config, dead code, or scratch file.

dead-code-candidate

low 9-layer software dead-code-candidate conf 1.00 File has no detected symbols: scripts/no-telemetry-growthbook-stub.test.ts

Source file with no class/function declarations — possible config, dead code, or scratch file.

dead-code-candidate

low 9-layer software dead-code-candidate conf 1.00 File has no detected symbols: scripts/provider-discovery.ts

Source file with no class/function declarations — possible config, dead code, or scratch file.

dead-code-candidate

low 9-layer software dead-code-candidate conf 1.00 File has no detected symbols: scripts/system-check.test.ts

Source file with no class/function declarations — possible config, dead code, or scratch file.

dead-code-candidate

low 9-layer software dead-code-candidate conf 1.00 File has no detected symbols: scripts/verify-no-phone-home.ts

Source file with no class/function declarations — possible config, dead code, or scratch file.

dead-code-candidate

low 9-layer software dead-code-candidate conf 1.00 File has no detected symbols: src/global.d.ts

Source file with no class/function declarations — possible config, dead code, or scratch file.

dead-code-candidate

low 9-layer software dead-code-candidate conf 1.00 File has no detected symbols: src/integrations/brands/claude.ts

Source file with no class/function declarations — possible config, dead code, or scratch file.

dead-code-candidate

low 9-layer software dead-code-candidate conf 1.00 File has no detected symbols: src/integrations/brands/deepseek.ts

Source file with no class/function declarations — possible config, dead code, or scratch file.

dead-code-candidate

low 9-layer software dead-code-candidate conf 1.00 File has no detected symbols: src/integrations/brands/gemini.ts

Source file with no class/function declarations — possible config, dead code, or scratch file.

dead-code-candidate

low 9-layer software dead-code-candidate conf 1.00 File has no detected symbols: src/integrations/brands/glm.ts

Source file with no class/function declarations — possible config, dead code, or scratch file.

dead-code-candidate

low 9-layer software dead-code-candidate conf 1.00 File has no detected symbols: src/integrations/brands/gpt.ts

Source file with no class/function declarations — possible config, dead code, or scratch file.

dead-code-candidate

low 9-layer software dead-code-candidate conf 1.00 File has no detected symbols: src/integrations/brands/kimi.ts

Source file with no class/function declarations — possible config, dead code, or scratch file.

dead-code-candidate

low 9-layer software dead-code-candidate conf 1.00 File has no detected symbols: src/integrations/brands/llama.ts

Source file with no class/function declarations — possible config, dead code, or scratch file.

dead-code-candidate

low 9-layer software dead-code-candidate conf 1.00 File has no detected symbols: src/integrations/brands/minimax.ts

Source file with no class/function declarations — possible config, dead code, or scratch file.

dead-code-candidate

low 9-layer software dead-code-candidate conf 1.00 File has no detected symbols: src/integrations/brands/mistral.ts

Source file with no class/function declarations — possible config, dead code, or scratch file.

dead-code-candidate

low 9-layer software dead-code-candidate conf 1.00 File has no detected symbols: src/integrations/brands/nemotron.ts

Source file with no class/function declarations — possible config, dead code, or scratch file.

dead-code-candidate

low 9-layer software dead-code-candidate conf 1.00 File has no detected symbols: src/integrations/brands/openai-compatible-alias.ts

Source file with no class/function declarations — possible config, dead code, or scratch file.

dead-code-candidate

low 9-layer software dead-code-candidate conf 1.00 File has no detected symbols: src/integrations/brands/qwen.ts

Source file with no class/function declarations — possible config, dead code, or scratch file.

dead-code-candidate

low 9-layer software dead-code-candidate conf 1.00 File has no detected symbols: src/integrations/brands/xai.ts

Source file with no class/function declarations — possible config, dead code, or scratch file.

dead-code-candidate

low 9-layer software dead-code-candidate conf 1.00 File has no detected symbols: src/integrations/brands/xiaomi-mimo.ts

Source file with no class/function declarations — possible config, dead code, or scratch file.

dead-code-candidate

low 9-layer software dead-code-candidate conf 1.00 File has no detected symbols: src/integrations/compatibility.test.ts

Source file with no class/function declarations — possible config, dead code, or scratch file.

dead-code-candidate

low 9-layer software dead-code-candidate conf 1.00 File has no detected symbols: src/integrations/descriptors.ts

Source file with no class/function declarations — possible config, dead code, or scratch file.

dead-code-candidate

low 9-layer software dead-code-candidate conf 1.00 File has no detected symbols: src/integrations/generated/integrationArtifacts.generated.ts

Source file with no class/function declarations — possible config, dead code, or scratch file.

dead-code-candidate

low 9-layer software dead-code-candidate conf 1.00 File has no detected symbols: src/integrations/index.test.ts

Source file with no class/function declarations — possible config, dead code, or scratch file.

dead-code-candidate

low 9-layer software dead-code-candidate conf 1.00 File has no detected symbols: src/integrations/models/claude.ts

Source file with no class/function declarations — possible config, dead code, or scratch file.

dead-code-candidate

low 9-layer software dead-code-candidate conf 1.00 File has no detected symbols: src/integrations/models/deepseek.ts

Source file with no class/function declarations — possible config, dead code, or scratch file.

dead-code-candidate

low 9-layer software dead-code-candidate conf 1.00 File has no detected symbols: src/integrations/models/llama.ts

Source file with no class/function declarations — possible config, dead code, or scratch file.

dead-code-candidate

low 9-layer software dead-code-candidate conf 1.00 File has no detected symbols: src/integrations/models/minimax.ts

Source file with no class/function declarations — possible config, dead code, or scratch file.

dead-code-candidate

low 9-layer software dead-code-candidate conf 1.00 File has no detected symbols: src/integrations/models/nemotron.ts

Source file with no class/function declarations — possible config, dead code, or scratch file.

dead-code-candidate

low 9-layer software dead-code-candidate conf 1.00 File has no detected symbols: src/integrations/models/xai.ts

Source file with no class/function declarations — possible config, dead code, or scratch file.

dead-code-candidate

low 9-layer software dead-code-candidate conf 1.00 File has no detected symbols: src/integrations/models/xiaomi-mimo.ts

Source file with no class/function declarations — possible config, dead code, or scratch file.

dead-code-candidate

low 9-layer software dead-code-candidate conf 1.00 File has no detected symbols: src/integrations/routeMetadata.test.ts

Source file with no class/function declarations — possible config, dead code, or scratch file.

dead-code-candidate

low 9-layer software dead-code-candidate conf 1.00 File has no detected symbols: src/projectOnboardingState.test.ts

Source file with no class/function declarations — possible config, dead code, or scratch file.

dead-code-candidate

low 9-layer software dead-code-candidate conf 1.00 File has no detected symbols: src/tools.lsp.test.ts

Source file with no class/function declarations — possible config, dead code, or scratch file.

dead-code-candidate

low 9-layer software dead-code-candidate conf 1.00 File has no detected symbols: tests/sdk/casing.test.ts

Source file with no class/function declarations — possible config, dead code, or scratch file.

dead-code-candidate

low 9-layer software dead-code-candidate conf 1.00 File has no detected symbols: tests/sdk/generated-types.test.ts

Source file with no class/function declarations — possible config, dead code, or scratch file.

dead-code-candidate

low 9-layer software dead-code-candidate conf 1.00 File has no detected symbols: tests/sdk/query-concurrency.test.ts

Source file with no class/function declarations — possible config, dead code, or scratch file.

dead-code-candidate

low 9-layer software dead-code-candidate conf 1.00 File has no detected symbols: tests/sdk/sdk-context-isolation.test.ts

Source file with no class/function declarations — possible config, dead code, or scratch file.

dead-code-candidate

low 9-layer software dead-code-candidate conf 1.00 File has no detected symbols: tests/sdk/sdk-v2-lifecycle.test.ts

Source file with no class/function declarations — possible config, dead code, or scratch file.

dead-code-candidate

low 9-layer software dead-code-candidate conf 1.00 File has no detected symbols: tests/sdk/session-functions.test.ts

Source file with no class/function declarations — possible config, dead code, or scratch file.

dead-code-candidate

low 9-layer software dead-code-candidate conf 1.00 File has no detected symbols: tests/sdk/shared-utils.test.ts

Source file with no class/function declarations — possible config, dead code, or scratch file.

dead-code-candidate

low 9-layer software dead-code-candidate conf 1.00 File has no detected symbols: tests/sdk/tool-schema-cache.test.ts

Source file with no class/function declarations — possible config, dead code, or scratch file.

dead-code-candidate

low 9-layer software dead-code-candidate conf 1.00 File has no detected symbols: vscode-extension/openclaude-vscode/src/state.test.js

Source file with no class/function declarations — possible config, dead code, or scratch file.

dead-code-candidate

low 9-layer software dead-code-candidate conf 1.00 File has no detected symbols: web/src/content.ts

Source file with no class/function declarations — possible config, dead code, or scratch file.

dead-code-candidate

low 9-layer software dead-code-candidate conf 1.00 File has no detected symbols: web/src/main.tsx

Source file with no class/function declarations — possible config, dead code, or scratch file.

dead-code-candidate

low 9-layer software dead-code-candidate conf 1.00 File has no detected symbols: web/src/vite-env.d.ts

Source file with no class/function declarations — possible config, dead code, or scratch file.

dead-code-candidate

low 9-layer software dead-code-candidate conf 1.00 File has no detected symbols: web/vite.config.ts

Source file with no class/function declarations — possible config, dead code, or scratch file.

dead-code-candidate

low 9-layer quality integrity conf 1.00 Legacy-named symbol `acct_old` in src/utils/codexCredentials.test.ts:104

Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.

integritylegacy-markerdead-code

low 9-layer quality integrity conf 1.00 Legacy-named symbol `actualOld` in src/components/FileEditToolDiff.tsx:173

Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.

integritylegacy-markerdead-code

low 9-layer quality integrity conf 1.00 Legacy-named symbol `actualOld` in src/tools/FileEditTool/UI.tsx:263

Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.

integritylegacy-markerdead-code

low 9-layer quality integrity conf 1.00 Legacy-named symbol `disabledLegacy` in src/utils/plugins/pluginLoader.test.ts:58

Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.

integritylegacy-markerdead-code

low 9-layer quality integrity conf 1.00 Legacy-named symbol `has_backup` in src/utils/config.ts:1596

Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.

integritylegacy-markerdead-code

low 9-layer quality integrity conf 1.00 Legacy-named symbol `hint_v2` in src/screens/REPL.tsx:4019

Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.

integritylegacy-markerdead-code

low 9-layer quality integrity conf 1.00 Legacy-named symbol `installed_plugins_v2` in src/services/plugins/pluginOperations.ts:518

Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.

integritylegacy-markerdead-code

low 9-layer quality integrity conf 1.00 Legacy-named symbol `installed_plugins_v2` in src/utils/plugins/installedPluginsManager.ts:83

Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.

integritylegacy-markerdead-code

low 9-layer quality integrity conf 1.00 Legacy-named symbol `isDeprecated` in src/utils/model/deprecation.ts:10

Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.

integritylegacy-markerdead-code

low 9-layer quality integrity conf 1.00 Legacy-named symbol `no_backup` in src/utils/appleTerminalBackup.ts:75

Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.

integritylegacy-markerdead-code

low 9-layer quality integrity conf 1.00 Legacy-named symbol `no_backup` in src/utils/iTermBackup.ts:36

Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.

integritylegacy-markerdead-code

low 9-layer quality integrity conf 1.00 Legacy-named symbol `profile_old` in src/commands/onboard-github/onboard-github.test.ts:66

Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.

integritylegacy-markerdead-code

low 9-layer quality integrity conf 1.00 Legacy-named symbol `provider_old` in src/commands/provider/provider.test.tsx:501

Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.

integritylegacy-markerdead-code

low 9-layer quality integrity conf 1.00 Legacy-named symbol `resolvedOld` in src/utils/plugins/marketplaceManager.ts:1892

Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.

integritylegacy-markerdead-code

low 9-layer quality integrity conf 1.00 Legacy-named symbol `tengu_bridge_repl_v2` in src/bridge/bridgeEnabled.ts:120

Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.

integritylegacy-markerdead-code

low 9-layer quality integrity conf 1.00 Legacy-named symbol `tengu_bridge_repl_v2` in src/bridge/initReplBridge.ts:409

Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.

integritylegacy-markerdead-code

low 9-layer quality integrity conf 1.00 Legacy-named symbol `tengu_bridge_repl_v2` in src/bridge/remoteBridgeCore.ts:27

Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.

integritylegacy-markerdead-code

low 9-layer quality integrity conf 1.00 Legacy-named symbol `tengu_copy` in src/commands/copy/copy.tsx:194

Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.

integritylegacy-markerdead-code

low 9-layer quality integrity conf 1.00 Legacy-named symbol `tengu_otk_slot_v1` in src/query.ts:1273

Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.

integritylegacy-markerdead-code

low 9-layer quality integrity conf 1.00 Legacy-named symbol `tengu_otk_slot_v1` in src/services/api/claude.ts:3411

Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.

integritylegacy-markerdead-code

low 9-layer quality integrity conf 1.00 Legacy-named symbol `tengu_otk_slot_v1` in src/services/compact/autoCompact.test.ts:44

Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.

integritylegacy-markerdead-code

low 9-layer quality integrity conf 1.00 Legacy-named symbol `unlinkIfOld` in src/utils/cleanup.ts:134

Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.

integritylegacy-markerdead-code

low 9-layer quality integrity conf 1.00 Legacy-named symbol `work_v1` in src/bridge/pollConfig.ts:66

Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.

integritylegacy-markerdead-code

low 9-layer quality tests conf 1.00 Low test-to-source ratio

272 tests / 2187 src (ratio 0.12).

tests

low 9-layer quality integrity conf 1.00 Near-duplicate function bodies in 4 places

Functions with the same first-5-line body hash: python/ollama_provider.py:ollama_chat, python/ollama_provider.py:ollama_chat_stream, python/atomic_chat_provider.py:atomic_chat, python/atomic_chat_provider.py:atomic_chat_stream This is *the* AI-coder failure mode (4× more duplication in vibe-coded …

integrityduplicatedry

low 9-layer software dead-code conf 1.00 Possibly dead Python function: atomic_chat_stream

No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.

python/atomic_chat_provider.py:94 dead-code

low 9-layer software dead-code conf 1.00 Possibly dead Python function: ollama_chat_stream

No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.

python/ollama_provider.py:130 dead-code

low 9-layer frontend frontend-quality conf 1.00 Stray `console.log` in TS/JS — scripts/build.ts:416

Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak

frontend-qualityfq.console-leak

low 9-layer frontend frontend-quality conf 1.00 Stray `console.log` in TS/JS — scripts/generate-integrations-artifacts.ts:14

Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak

frontend-qualityfq.console-leak

low 9-layer frontend frontend-quality conf 1.00 Stray `console.log` in TS/JS — scripts/generate-sdk-types.ts:428

Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak

frontend-qualityfq.console-leak

low 9-layer frontend frontend-quality conf 1.00 Stray `console.log` in TS/JS — scripts/grpc-cli.ts:49

Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak

frontend-qualityfq.console-leak

low 9-layer frontend frontend-quality conf 1.00 Stray `console.log` in TS/JS — scripts/no-telemetry-plugin.ts:138

Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak

frontend-qualityfq.console-leak

low 9-layer frontend frontend-quality conf 1.00 Stray `console.log` in TS/JS — scripts/provider-bootstrap.ts:186

Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak

frontend-qualityfq.console-leak

low 9-layer frontend frontend-quality conf 1.00 Stray `console.log` in TS/JS — scripts/provider-launch.ts:124

Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak

frontend-qualityfq.console-leak

low 9-layer frontend frontend-quality conf 1.00 Stray `console.log` in TS/JS — scripts/provider-recommend.ts:98

Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak

frontend-qualityfq.console-leak

low 9-layer frontend frontend-quality conf 1.00 Stray `console.log` in TS/JS — scripts/render-coverage-heatmap.ts:389

Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak

frontend-qualityfq.console-leak

low 9-layer frontend frontend-quality conf 1.00 Stray `console.log` in TS/JS — scripts/start-grpc.ts:14

Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak

frontend-qualityfq.console-leak

low 9-layer frontend frontend-quality conf 1.00 Stray `console.log` in TS/JS — scripts/system-check.ts:605

Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak

frontend-qualityfq.console-leak

low 9-layer frontend frontend-quality conf 1.00 Stray `console.log` in TS/JS — scripts/validate-externals.ts:44

Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak

frontend-qualityfq.console-leak

low 9-layer frontend frontend-quality conf 1.00 Stray `console.log` in TS/JS — scripts/verify-no-phone-home.ts:26

Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak

frontend-qualityfq.console-leak

low 9-layer frontend frontend-quality conf 1.00 Stray `console.log` in TS/JS — src/bridge/bridgeMain.ts:1949

Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak

frontend-qualityfq.console-leak

low 9-layer frontend frontend-quality conf 1.00 Stray `console.log` in TS/JS — src/cli/handlers/agents.ts:63

Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak

frontend-qualityfq.console-leak

low 9-layer frontend frontend-quality conf 1.00 Stray `console.log` in TS/JS — src/cli/handlers/mcp.tsx:253

Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak

frontend-qualityfq.console-leak

low 9-layer frontend frontend-quality conf 1.00 Stray `console.log` in TS/JS — src/cli/handlers/plugins.ts:76

Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak

frontend-qualityfq.console-leak

low 9-layer frontend frontend-quality conf 1.00 Stray `console.log` in TS/JS — src/components/ThemePicker.tsx:50

Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak

frontend-qualityfq.console-leak

low 9-layer frontend frontend-quality conf 1.00 Stray `console.log` in TS/JS — src/entrypoints/cli.tsx:91

Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak

frontend-qualityfq.console-leak

low 9-layer frontend frontend-quality conf 1.00 Stray `console.log` in TS/JS — src/entrypoints/sdk/query.ts:1001

Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak

frontend-qualityfq.console-leak

low 9-layer frontend frontend-quality conf 1.00 Stray `console.log` in TS/JS — src/entrypoints/sdk/v2.ts:124

Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak

frontend-qualityfq.console-leak

low 9-layer frontend frontend-quality conf 1.00 Stray `console.log` in TS/JS — src/grpc/server.ts:46

Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak

frontend-qualityfq.console-leak

low 9-layer frontend frontend-quality conf 1.00 Stray `console.log` in TS/JS — src/services/plugins/pluginCliCommands.ts:109

Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak

frontend-qualityfq.console-leak

low 9-layer frontend frontend-quality conf 1.00 Stray `console.log` in TS/JS — src/setup.ts:121

Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak

frontend-qualityfq.console-leak

low 9-layer frontend frontend-quality conf 1.00 Stray `console.log` in TS/JS — src/utils/worktree.ts:1336

Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak

frontend-qualityfq.console-leak

low 9-layer frontend frontend-quality conf 1.00 Stray `console.log` in TS/JS — tests/sdk/package-consumer-types.test.ts:174

Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak

frontend-qualityfq.console-leak

low 9-layer quality complexity conf 1.00 Very large file: src/bootstrap/state.ts (1654 lines)

Files with >800 lines often hide complexity hotspots and discourage tests.

complexity

low 9-layer quality complexity conf 1.00 Very large file: src/bridge/bridgeMain.ts (2991 lines)

Files with >800 lines often hide complexity hotspots and discourage tests.

complexity

low 9-layer quality complexity conf 1.00 Very large file: src/bridge/replBridge.ts (2423 lines)

Files with >800 lines often hide complexity hotspots and discourage tests.

complexity

low 9-layer quality complexity conf 1.00 Very large file: src/cli/print.ts (5584 lines)

Files with >800 lines often hide complexity hotspots and discourage tests.

complexity

low 9-layer quality complexity conf 1.00 Very large file: src/commands/insights.ts (2932 lines)

Files with >800 lines often hide complexity hotspots and discourage tests.

complexity

low 9-layer quality complexity conf 1.00 Very large file: src/commands/plugin/ManagePlugins.tsx (2214 lines)

Files with >800 lines often hide complexity hotspots and discourage tests.

complexity

low 9-layer quality complexity conf 1.00 Very large file: src/commands/provider/provider.tsx (1818 lines)

Files with >800 lines often hide complexity hotspots and discourage tests.

complexity

low 9-layer quality complexity conf 1.00 Very large file: src/components/LogSelector.tsx (1574 lines)

Files with >800 lines often hide complexity hotspots and discourage tests.

complexity

low 9-layer quality complexity conf 1.00 Very large file: src/components/PromptInput/PromptInput.tsx (2374 lines)

Files with >800 lines often hide complexity hotspots and discourage tests.

complexity

low 9-layer quality complexity conf 1.00 Very large file: src/components/ProviderManager.test.tsx (1988 lines)

Files with >800 lines often hide complexity hotspots and discourage tests.

complexity

low 9-layer quality complexity conf 1.00 Very large file: src/components/ProviderManager.tsx (2187 lines)

Files with >800 lines often hide complexity hotspots and discourage tests.

complexity

low 9-layer quality complexity conf 1.00 Very large file: src/components/Settings/Config.tsx (1881 lines)

Files with >800 lines often hide complexity hotspots and discourage tests.

complexity

low 9-layer quality complexity conf 1.00 Very large file: src/constants/prompts.ts (909 lines)

Files with >800 lines often hide complexity hotspots and discourage tests.

complexity

low 9-layer quality complexity conf 1.00 Very large file: src/entrypoints/sdk/coreSchemas.ts (1902 lines)

Files with >800 lines often hide complexity hotspots and discourage tests.

complexity

low 9-layer quality complexity conf 1.00 Very large file: src/entrypoints/sdk/coreTypes.generated.ts (2355 lines)

Files with >800 lines often hide complexity hotspots and discourage tests.

complexity

low 9-layer quality complexity conf 1.00 Very large file: src/hooks/useTypeahead.tsx (1392 lines)

Files with >800 lines often hide complexity hotspots and discourage tests.

complexity

low 9-layer quality complexity conf 1.00 Very large file: src/ink/ink.tsx (1752 lines)

Files with >800 lines often hide complexity hotspots and discourage tests.

complexity

low 9-layer quality complexity conf 1.00 Very large file: src/ink/render-node-to-output.ts (1495 lines)

Files with >800 lines often hide complexity hotspots and discourage tests.

complexity

low 9-layer quality complexity conf 1.00 Very large file: src/main.tsx (4677 lines)

Files with >800 lines often hide complexity hotspots and discourage tests.

complexity

low 9-layer quality complexity conf 1.00 Very large file: src/native-ts/yoga-layout/index.ts (2578 lines)

Files with >800 lines often hide complexity hotspots and discourage tests.

complexity

low 9-layer quality complexity conf 1.00 Very large file: src/query.ts (1914 lines)

Files with >800 lines often hide complexity hotspots and discourage tests.

complexity

low 9-layer quality complexity conf 1.00 Very large file: src/QueryEngine.ts (1430 lines)

Files with >800 lines often hide complexity hotspots and discourage tests.

complexity

low 9-layer quality complexity conf 1.00 Very large file: src/screens/REPL.tsx (5066 lines)

Files with >800 lines often hide complexity hotspots and discourage tests.

complexity

low 9-layer quality complexity conf 1.00 Very large file: src/services/api/claude.ts (3434 lines)

Files with >800 lines often hide complexity hotspots and discourage tests.

complexity

low 9-layer quality complexity conf 1.00 Very large file: src/services/api/openaiShim.test.ts (5689 lines)

Files with >800 lines often hide complexity hotspots and discourage tests.

complexity

low 9-layer quality complexity conf 1.00 Very large file: src/services/api/openaiShim.ts (2586 lines)

Files with >800 lines often hide complexity hotspots and discourage tests.

complexity

low 9-layer quality complexity conf 1.00 Very large file: src/services/compact/compact.ts (1712 lines)

Files with >800 lines often hide complexity hotspots and discourage tests.

complexity

low 9-layer quality complexity conf 1.00 Very large file: src/services/mcp/auth.ts (2507 lines)

Files with >800 lines often hide complexity hotspots and discourage tests.

complexity

low 9-layer quality complexity conf 1.00 Very large file: src/services/mcp/client.ts (3410 lines)

Files with >800 lines often hide complexity hotspots and discourage tests.

complexity

low 9-layer quality complexity conf 1.00 Very large file: src/services/mcp/config.ts (1578 lines)

Files with >800 lines often hide complexity hotspots and discourage tests.

complexity

low 9-layer quality complexity conf 1.00 Very large file: src/services/tools/toolExecution.ts (1697 lines)

Files with >800 lines often hide complexity hotspots and discourage tests.

complexity

low 9-layer quality complexity conf 1.00 Very large file: src/tools/AgentTool/AgentTool.tsx (1412 lines)

Files with >800 lines often hide complexity hotspots and discourage tests.

complexity

low 9-layer quality complexity conf 1.00 Very large file: src/tools/BashTool/bashPermissions.ts (2635 lines)

Files with >800 lines often hide complexity hotspots and discourage tests.

complexity

low 9-layer quality complexity conf 1.00 Very large file: src/tools/BashTool/bashSecurity.ts (2612 lines)

Files with >800 lines often hide complexity hotspots and discourage tests.

complexity

low 9-layer quality complexity conf 1.00 Very large file: src/tools/BashTool/readOnlyValidation.ts (1924 lines)

Files with >800 lines often hide complexity hotspots and discourage tests.

complexity

low 9-layer quality complexity conf 1.00 Very large file: src/tools/PowerShellTool/pathValidation.ts (2049 lines)

Files with >800 lines often hide complexity hotspots and discourage tests.

complexity

low 9-layer quality complexity conf 1.00 Very large file: src/tools/PowerShellTool/powershellPermissions.ts (1648 lines)

Files with >800 lines often hide complexity hotspots and discourage tests.

complexity

low 9-layer quality complexity conf 1.00 Very large file: src/tools/PowerShellTool/readOnlyValidation.ts (1823 lines)

Files with >800 lines often hide complexity hotspots and discourage tests.

complexity

low 9-layer quality complexity conf 1.00 Very large file: src/utils/attachments.ts (4017 lines)

Files with >800 lines often hide complexity hotspots and discourage tests.

complexity

low 9-layer quality complexity conf 1.00 Very large file: src/utils/auth.ts (2027 lines)

Files with >800 lines often hide complexity hotspots and discourage tests.

complexity

low 9-layer quality complexity conf 1.00 Very large file: src/utils/bash/ast.ts (2679 lines)

Files with >800 lines often hide complexity hotspots and discourage tests.

complexity

low 9-layer quality complexity conf 1.00 Very large file: src/utils/bash/bashParser.ts (4436 lines)

Files with >800 lines often hide complexity hotspots and discourage tests.

complexity

low 9-layer quality complexity conf 1.00 Very large file: src/utils/bash/commands.ts (1339 lines)

Files with >800 lines often hide complexity hotspots and discourage tests.

complexity

low 9-layer quality complexity conf 1.00 Very large file: src/utils/config.ts (1918 lines)

Files with >800 lines often hide complexity hotspots and discourage tests.

complexity

low 9-layer quality complexity conf 1.00 Very large file: src/utils/hooks.ts (5265 lines)

Files with >800 lines often hide complexity hotspots and discourage tests.

complexity

low 9-layer quality complexity conf 1.00 Very large file: src/utils/messages.ts (5524 lines)

Files with >800 lines often hide complexity hotspots and discourage tests.

complexity

low 9-layer quality complexity conf 1.00 Very large file: src/utils/nativeInstaller/installer.ts (1712 lines)

Files with >800 lines often hide complexity hotspots and discourage tests.

complexity

low 9-layer quality complexity conf 1.00 Very large file: src/utils/permissions/filesystem.ts (1799 lines)

Files with >800 lines often hide complexity hotspots and discourage tests.

complexity

low 9-layer quality complexity conf 1.00 Very large file: src/utils/permissions/permissions.ts (1487 lines)

Files with >800 lines often hide complexity hotspots and discourage tests.

complexity

low 9-layer quality complexity conf 1.00 Very large file: src/utils/permissions/permissionSetup.ts (1533 lines)

Files with >800 lines often hide complexity hotspots and discourage tests.

complexity

low 9-layer quality complexity conf 1.00 Very large file: src/utils/permissions/yoloClassifier.ts (1603 lines)

Files with >800 lines often hide complexity hotspots and discourage tests.

complexity

low 9-layer quality complexity conf 1.00 Very large file: src/utils/plugins/marketplaceManager.ts (2644 lines)

Files with >800 lines often hide complexity hotspots and discourage tests.

complexity

low 9-layer quality complexity conf 1.00 Very large file: src/utils/plugins/pluginLoader.ts (3579 lines)

Files with >800 lines often hide complexity hotspots and discourage tests.

complexity

low 9-layer quality complexity conf 1.00 Very large file: src/utils/plugins/schemas.ts (1681 lines)

Files with >800 lines often hide complexity hotspots and discourage tests.

complexity

low 9-layer quality complexity conf 1.00 Very large file: src/utils/powershell/parser.ts (1804 lines)

Files with >800 lines often hide complexity hotspots and discourage tests.

complexity

low 9-layer quality complexity conf 1.00 Very large file: src/utils/providerProfiles.test.ts (2043 lines)

Files with >800 lines often hide complexity hotspots and discourage tests.

complexity

low 9-layer quality complexity conf 1.00 Very large file: src/utils/sessionStorage.ts (5357 lines)

Files with >800 lines often hide complexity hotspots and discourage tests.

complexity

low 9-layer quality complexity conf 1.00 Very large file: src/utils/shell/readOnlyCommandValidation.ts (1893 lines)

Files with >800 lines often hide complexity hotspots and discourage tests.

complexity

low 9-layer quality complexity conf 1.00 Very large file: src/utils/swarm/inProcessRunner.ts (1552 lines)

Files with >800 lines often hide complexity hotspots and discourage tests.

complexity

low 9-layer quality complexity conf 1.00 Very large file: src/utils/teleport.tsx (1225 lines)

Files with >800 lines often hide complexity hotspots and discourage tests.

complexity

low 9-layer quality complexity conf 1.00 Very large file: src/utils/worktree.ts (1583 lines)

Files with >800 lines often hide complexity hotspots and discourage tests.

complexity

info 9-layer quality integrity conf 1.00 Commented-code block (10 lines) in src/services/api/sessionIngress.ts:335