{"schema_version":"2","scorer_version":"0.1.0","scoring_version":"prov-4+qual-2+sec-2","generated_at":"2026-11-14T00:21:50.915147Z","repo":{"ref":{"host":"github.com","owner":"iFurySt","name":"open-computer-use"},"default_branch":"main","clone_url":"https://github.com/iFurySt/open-computer-use.git","html_url":"https://github.com/iFurySt/open-computer-use","description":"👾 Open Computer Use – Open-Source Alternative to Codex Computer Use","stars":2963,"forks":274,"is_fork":false,"is_archived":false,"is_private":false,"size_kb":6260,"primary_language":"Swift","license_spdx":"MIT","created_at":"2026-04-17T06:51:32Z","pushed_at":"2026-11-13T15:13:46Z","security_policy_url":"https://github.com/iFurySt/open-computer-use/security/policy","distribution":{"owner_created_at":"2015-12-08T04:55:15Z","owner_type":"User","release_assets":[{"name":"CursorMotion-1.1.4.dmg","size":1572734,"download_count":6,"release_tag":"v1.1.4","url":"https://github.com/iFurySt/open-computer-use/releases/download/v1.1.4/CursorMotion-1.1.4.dmg"},{"name":"Open-Computer-Use-1.1.4-macOS-universal.app.zip","size":10896123,"download_count":43,"release_tag":"v1.1.4","url":"https://github.com/iFurySt/open-computer-use/releases/download/v1.1.4/Open-Computer-Use-1.1.4-macOS-universal.app.zip"},{"name":"open-computer-use-cli-1.1.4-linux-amd64.tar.gz","size":980448,"download_count":14,"release_tag":"v1.1.4","url":"https://github.com/iFurySt/open-computer-use/releases/download/v1.1.4/open-computer-use-cli-1.1.4-linux-amd64.tar.gz"},{"name":"open-computer-use-cli-1.1.4-linux-arm64.tar.gz","size":906795,"download_count":5,"release_tag":"v1.1.4","url":"https://github.com/iFurySt/open-computer-use/releases/download/v1.1.4/open-computer-use-cli-1.1.4-linux-arm64.tar.gz"},{"name":"open-computer-use-cli-1.1.4-windows-amd64.zip","size":1062166,"download_count":64,"release_tag":"v1.1.4","url":"https://github.com/iFurySt/open-computer-use/releases/download/v1.1.4/open-computer-use-cli-1.1.4-windows-amd64.zip"},{"name":"open-computer-use-cli-1.1.4-windows-arm64.zip","size":968403,"download_count":5,"release_tag":"v1.1.4","url":"https://github.com/iFurySt/open-computer-use/releases/download/v1.1.4/open-computer-use-cli-1.1.4-windows-arm64.zip"},{"name":"open-computer-use-skill.zip","size":16586,"download_count":25,"release_tag":"v1.1.4","url":"https://github.com/iFurySt/open-computer-use/releases/download/v1.1.4/open-computer-use-skill.zip"},{"name":"open-computer-use.skill","size":16586,"download_count":5,"release_tag":"v1.1.4","url":"https://github.com/iFurySt/open-computer-use/releases/download/v1.1.4/open-computer-use.skill"},{"name":"release-assets-manifest.json","size":1621,"download_count":13,"release_tag":"v1.1.4","url":"https://github.com/iFurySt/open-computer-use/releases/download/v1.1.4/release-assets-manifest.json"},{"name":"SHA256SUMS","size":748,"download_count":31,"release_tag":"v1.1.4","url":"https://github.com/iFurySt/open-computer-use/releases/download/v1.1.4/SHA256SUMS"},{"name":"CursorMotion-1.1.3.dmg","size":1572749,"download_count":12,"release_tag":"v1.1.3","url":"https://github.com/iFurySt/open-computer-use/releases/download/v1.1.3/CursorMotion-1.1.3.dmg"},{"name":"Open-Computer-Use-1.1.3-macOS-universal.app.zip","size":10803053,"download_count":22,"release_tag":"v1.1.3","url":"https://github.com/iFurySt/open-computer-use/releases/download/v1.1.3/Open-Computer-Use-1.1.3-macOS-universal.app.zip"},{"name":"open-computer-use-cli-1.1.3-linux-amd64.tar.gz","size":978927,"download_count":5,"release_tag":"v1.1.3","url":"https://github.com/iFurySt/open-computer-use/releases/download/v1.1.3/open-computer-use-cli-1.1.3-linux-amd64.tar.gz"},{"name":"open-computer-use-cli-1.1.3-linux-arm64.tar.gz","size":905134,"download_count":7,"release_tag":"v1.1.3","url":"https://github.com/iFurySt/open-computer-use/releases/download/v1.1.3/open-computer-use-cli-1.1.3-linux-arm64.tar.gz"},{"name":"open-computer-use-cli-1.1.3-windows-amd64.zip","size":1059888,"download_count":67,"release_tag":"v1.1.3","url":"https://github.com/iFurySt/open-computer-use/releases/download/v1.1.3/open-computer-use-cli-1.1.3-windows-amd64.zip"},{"name":"open-computer-use-cli-1.1.3-windows-arm64.zip","size":966571,"download_count":10,"release_tag":"v1.1.3","url":"https://github.com/iFurySt/open-computer-use/releases/download/v1.1.3/open-computer-use-cli-1.1.3-windows-arm64.zip"},{"name":"open-computer-use-skill.zip","size":16404,"download_count":19,"release_tag":"v1.1.3","url":"https://github.com/iFurySt/open-computer-use/releases/download/v1.1.3/open-computer-use-skill.zip"},{"name":"open-computer-use.skill","size":16404,"download_count":12,"release_tag":"v1.1.3","url":"https://github.com/iFurySt/open-computer-use/releases/download/v1.1.3/open-computer-use.skill"},{"name":"release-assets-manifest.json","size":1621,"download_count":7,"release_tag":"v1.1.3","url":"https://github.com/iFurySt/open-computer-use/releases/download/v1.1.3/release-assets-manifest.json"},{"name":"SHA256SUMS","size":748,"download_count":30,"release_tag":"v1.1.3","url":"https://github.com/iFurySt/open-computer-use/releases/download/v1.1.3/SHA256SUMS"},{"name":"1.0.750.zip","size":13458495,"download_count":9,"release_tag":"reference-bundles","url":"https://github.com/iFurySt/open-computer-use/releases/download/reference-bundles/1.0.750.zip"},{"name":"1.0.755.zip","size":13467875,"download_count":20,"release_tag":"reference-bundles","url":"https://github.com/iFurySt/open-computer-use/releases/download/reference-bundles/1.0.755.zip"},{"name":"SHA256SUMS","size":156,"download_count":4,"release_tag":"reference-bundles","url":"https://github.com/iFurySt/open-computer-use/releases/download/reference-bundles/SHA256SUMS"},{"name":"CursorMotion-1.1.2.dmg","size":1572726,"download_count":30,"release_tag":"v1.1.2","url":"https://github.com/iFurySt/open-computer-use/releases/download/v1.1.2/CursorMotion-1.1.2.dmg"},{"name":"Open-Computer-Use-1.1.2-macOS-universal.app.zip","size":10390167,"download_count":136,"release_tag":"v1.1.2","url":"https://github.com/iFurySt/open-computer-use/releases/download/v1.1.2/Open-Computer-Use-1.1.2-macOS-universal.app.zip"},{"name":"open-computer-use-cli-1.1.2-linux-amd64.tar.gz","size":975472,"download_count":49,"release_tag":"v1.1.2","url":"https://github.com/iFurySt/open-computer-use/releases/download/v1.1.2/open-computer-use-cli-1.1.2-linux-amd64.tar.gz"},{"name":"open-computer-use-cli-1.1.2-linux-arm64.tar.gz","size":901844,"download_count":40,"release_tag":"v1.1.2","url":"https://github.com/iFurySt/open-computer-use/releases/download/v1.1.2/open-computer-use-cli-1.1.2-linux-arm64.tar.gz"},{"name":"open-computer-use-cli-1.1.2-windows-amd64.zip","size":1051383,"download_count":167,"release_tag":"v1.1.2","url":"https://github.com/iFurySt/open-computer-use/releases/download/v1.1.2/open-computer-use-cli-1.1.2-windows-amd64.zip"},{"name":"open-computer-use-cli-1.1.2-windows-arm64.zip","size":959320,"download_count":26,"release_tag":"v1.1.2","url":"https://github.com/iFurySt/open-computer-use/releases/download/v1.1.2/open-computer-use-cli-1.1.2-windows-arm64.zip"},{"name":"open-computer-use-skill.zip","size":14715,"download_count":63,"release_tag":"v1.1.2","url":"https://github.com/iFurySt/open-computer-use/releases/download/v1.1.2/open-computer-use-skill.zip"},{"name":"open-computer-use.skill","size":14715,"download_count":24,"release_tag":"v1.1.2","url":"https://github.com/iFurySt/open-computer-use/releases/download/v1.1.2/open-computer-use.skill"},{"name":"release-assets-manifest.json","size":1621,"download_count":22,"release_tag":"v1.1.2","url":"https://github.com/iFurySt/open-computer-use/releases/download/v1.1.2/release-assets-manifest.json"},{"name":"SHA256SUMS","size":748,"download_count":78,"release_tag":"v1.1.2","url":"https://github.com/iFurySt/open-computer-use/releases/download/v1.1.2/SHA256SUMS"},{"name":"CursorMotion-1.1.1.dmg","size":1572806,"download_count":10,"release_tag":"v1.1.1","url":"https://github.com/iFurySt/open-computer-use/releases/download/v1.1.1/CursorMotion-1.1.1.dmg"},{"name":"Open-Computer-Use-1.1.1-macOS-universal.app.zip","size":10328261,"download_count":96,"release_tag":"v1.1.1","url":"https://github.com/iFurySt/open-computer-use/releases/download/v1.1.1/Open-Computer-Use-1.1.1-macOS-universal.app.zip"},{"name":"open-computer-use-cli-1.1.1-linux-amd64.tar.gz","size":974752,"download_count":31,"release_tag":"v1.1.1","url":"https://github.com/iFurySt/open-computer-use/releases/download/v1.1.1/open-computer-use-cli-1.1.1-linux-amd64.tar.gz"},{"name":"open-computer-use-cli-1.1.1-linux-arm64.tar.gz","size":901221,"download_count":29,"release_tag":"v1.1.1","url":"https://github.com/iFurySt/open-computer-use/releases/download/v1.1.1/open-computer-use-cli-1.1.1-linux-arm64.tar.gz"},{"name":"open-computer-use-cli-1.1.1-windows-amd64.zip","size":1051396,"download_count":37,"release_tag":"v1.1.1","url":"https://github.com/iFurySt/open-computer-use/releases/download/v1.1.1/open-computer-use-cli-1.1.1-windows-amd64.zip"},{"name":"open-computer-use-cli-1.1.1-windows-arm64.zip","size":959428,"download_count":30,"release_tag":"v1.1.1","url":"https://github.com/iFurySt/open-computer-use/releases/download/v1.1.1/open-computer-use-cli-1.1.1-windows-arm64.zip"},{"name":"open-computer-use-skill.zip","size":14317,"download_count":13,"release_tag":"v1.1.1","url":"https://github.com/iFurySt/open-computer-use/releases/download/v1.1.1/open-computer-use-skill.zip"},{"name":"open-computer-use.skill","size":14317,"download_count":5,"release_tag":"v1.1.1","url":"https://github.com/iFurySt/open-computer-use/releases/download/v1.1.1/open-computer-use.skill"},{"name":"release-assets-manifest.json","size":1627,"download_count":5,"release_tag":"v1.1.1","url":"https://github.com/iFurySt/open-computer-use/releases/download/v1.1.1/release-assets-manifest.json"},{"name":"SHA256SUMS","size":748,"download_count":13,"release_tag":"v1.1.1","url":"https://github.com/iFurySt/open-computer-use/releases/download/v1.1.1/SHA256SUMS"},{"name":"CursorMotion-1.1.0.dmg","size":1572828,"download_count":16,"release_tag":"v1.1.0","url":"https://github.com/iFurySt/open-computer-use/releases/download/v1.1.0/CursorMotion-1.1.0.dmg"},{"name":"Open-Computer-Use-1.1.0-macOS-universal.app.zip","size":10240989,"download_count":34,"release_tag":"v1.1.0","url":"https://github.com/iFurySt/open-computer-use/releases/download/v1.1.0/Open-Computer-Use-1.1.0-macOS-universal.app.zip"},{"name":"open-computer-use-cli-1.1.0-linux-amd64.tar.gz","size":974752,"download_count":6,"release_tag":"v1.1.0","url":"https://github.com/iFurySt/open-computer-use/releases/download/v1.1.0/open-computer-use-cli-1.1.0-linux-amd64.tar.gz"},{"name":"open-computer-use-cli-1.1.0-linux-arm64.tar.gz","size":901221,"download_count":4,"release_tag":"v1.1.0","url":"https://github.com/iFurySt/open-computer-use/releases/download/v1.1.0/open-computer-use-cli-1.1.0-linux-arm64.tar.gz"},{"name":"open-computer-use-cli-1.1.0-windows-amd64.zip","size":1051389,"download_count":36,"release_tag":"v1.1.0","url":"https://github.com/iFurySt/open-computer-use/releases/download/v1.1.0/open-computer-use-cli-1.1.0-windows-amd64.zip"},{"name":"open-computer-use-cli-1.1.0-windows-arm64.zip","size":959422,"download_count":9,"release_tag":"v1.1.0","url":"https://github.com/iFurySt/open-computer-use/releases/download/v1.1.0/open-computer-use-cli-1.1.0-windows-arm64.zip"},{"name":"open-computer-use-skill.zip","size":14317,"download_count":12,"release_tag":"v1.1.0","url":"https://github.com/iFurySt/open-computer-use/releases/download/v1.1.0/open-computer-use-skill.zip"},{"name":"open-computer-use.skill","size":14317,"download_count":7,"release_tag":"v1.1.0","url":"https://github.com/iFurySt/open-computer-use/releases/download/v1.1.0/open-computer-use.skill"},{"name":"release-assets-manifest.json","size":1627,"download_count":5,"release_tag":"v1.1.0","url":"https://github.com/iFurySt/open-computer-use/releases/download/v1.1.0/release-assets-manifest.json"},{"name":"SHA256SUMS","size":748,"download_count":12,"release_tag":"v1.1.0","url":"https://github.com/iFurySt/open-computer-use/releases/download/v1.1.0/SHA256SUMS"},{"name":"CursorMotion-1.0.0.dmg","size":1572838,"download_count":13,"release_tag":"v1.0.0","url":"https://github.com/iFurySt/open-computer-use/releases/download/v1.0.0/CursorMotion-1.0.0.dmg"},{"name":"Open-Computer-Use-1.0.0-macOS-universal.app.zip","size":2081291,"download_count":27,"release_tag":"v1.0.0","url":"https://github.com/iFurySt/open-computer-use/releases/download/v1.0.0/Open-Computer-Use-1.0.0-macOS-universal.app.zip"},{"name":"open-computer-use-cli-1.0.0-linux-amd64.tar.gz","size":974681,"download_count":10,"release_tag":"v1.0.0","url":"https://github.com/iFurySt/open-computer-use/releases/download/v1.0.0/open-computer-use-cli-1.0.0-linux-amd64.tar.gz"},{"name":"open-computer-use-cli-1.0.0-linux-arm64.tar.gz","size":901129,"download_count":9,"release_tag":"v1.0.0","url":"https://github.com/iFurySt/open-computer-use/releases/download/v1.0.0/open-computer-use-cli-1.0.0-linux-arm64.tar.gz"},{"name":"open-computer-use-cli-1.0.0-windows-amd64.zip","size":1051275,"download_count":35,"release_tag":"v1.0.0","url":"https://github.com/iFurySt/open-computer-use/releases/download/v1.0.0/open-computer-use-cli-1.0.0-windows-amd64.zip"},{"name":"open-computer-use-cli-1.0.0-windows-arm64.zip","size":959283,"download_count":11,"release_tag":"v1.0.0","url":"https://github.com/iFurySt/open-computer-use/releases/download/v1.0.0/open-computer-use-cli-1.0.0-windows-arm64.zip"},{"name":"open-computer-use-skill.zip","size":13698,"download_count":19,"release_tag":"v1.0.0","url":"https://github.com/iFurySt/open-computer-use/releases/download/v1.0.0/open-computer-use-skill.zip"},{"name":"open-computer-use.skill","size":13698,"download_count":10,"release_tag":"v1.0.0","url":"https://github.com/iFurySt/open-computer-use/releases/download/v1.0.0/open-computer-use.skill"},{"name":"release-assets-manifest.json","size":1626,"download_count":13,"release_tag":"v1.0.0","url":"https://github.com/iFurySt/open-computer-use/releases/download/v1.0.0/release-assets-manifest.json"},{"name":"SHA256SUMS","size":748,"download_count":29,"release_tag":"v1.0.0","url":"https://github.com/iFurySt/open-computer-use/releases/download/v1.0.0/SHA256SUMS"},{"name":"CursorMotion-0.3.6.dmg","size":1572823,"download_count":18,"release_tag":"v0.3.6","url":"https://github.com/iFurySt/open-computer-use/releases/download/v0.3.6/CursorMotion-0.3.6.dmg"},{"name":"Open-Computer-Use-0.3.6-macOS-universal.app.zip","size":1994242,"download_count":241,"release_tag":"v0.3.6","url":"https://github.com/iFurySt/open-computer-use/releases/download/v0.3.6/Open-Computer-Use-0.3.6-macOS-universal.app.zip"},{"name":"open-computer-use-cli-0.3.6-linux-amd64.tar.gz","size":972363,"download_count":13,"release_tag":"v0.3.6","url":"https://github.com/iFurySt/open-computer-use/releases/download/v0.3.6/open-computer-use-cli-0.3.6-linux-amd64.tar.gz"},{"name":"open-computer-use-cli-0.3.6-linux-arm64.tar.gz","size":899368,"download_count":16,"release_tag":"v0.3.6","url":"https://github.com/iFurySt/open-computer-use/releases/download/v0.3.6/open-computer-use-cli-0.3.6-linux-arm64.tar.gz"},{"name":"open-computer-use-cli-0.3.6-windows-amd64.zip","size":993710,"download_count":169,"release_tag":"v0.3.6","url":"https://github.com/iFurySt/open-computer-use/releases/download/v0.3.6/open-computer-use-cli-0.3.6-windows-amd64.zip"},{"name":"open-computer-use-cli-0.3.6-windows-arm64.zip","size":906141,"download_count":75,"release_tag":"v0.3.6","url":"https://github.com/iFurySt/open-computer-use/releases/download/v0.3.6/open-computer-use-cli-0.3.6-windows-arm64.zip"},{"name":"open-computer-use-skill.zip","size":12564,"download_count":37,"release_tag":"v0.3.6","url":"https://github.com/iFurySt/open-computer-use/releases/download/v0.3.6/open-computer-use-skill.zip"},{"name":"open-computer-use.skill","size":12564,"download_count":13,"release_tag":"v0.3.6","url":"https://github.com/iFurySt/open-computer-use/releases/download/v0.3.6/open-computer-use.skill"},{"name":"release-assets-manifest.json","size":1625,"download_count":18,"release_tag":"v0.3.6","url":"https://github.com/iFurySt/open-computer-use/releases/download/v0.3.6/release-assets-manifest.json"},{"name":"SHA256SUMS","size":748,"download_count":44,"release_tag":"v0.3.6","url":"https://github.com/iFurySt/open-computer-use/releases/download/v0.3.6/SHA256SUMS"},{"name":"CursorMotion-0.3.5.dmg","size":1572784,"download_count":42,"release_tag":"v0.3.5","url":"https://github.com/iFurySt/open-computer-use/releases/download/v0.3.5/CursorMotion-0.3.5.dmg"},{"name":"CursorMotion-0.3.4.dmg","size":1572811,"download_count":16,"release_tag":"v0.3.4","url":"https://github.com/iFurySt/open-computer-use/releases/download/v0.3.4/CursorMotion-0.3.4.dmg"}]}},"commit_sha":"e25be21caa0ea489316f6be6635d2a4766c4cd0b","profile":{"lines_by_language":{"Swift":40028,"Go":7461,"Python":7058,"JavaScript":5937,"PowerShell":4389,"Shell":3365,"C":415,"Objective-C":379},"files_by_category":{"docs":451,"source":251,"test":97,"config":17,"binary":16,"other":9,"generated":1},"source_lines":58251,"test_lines":10781},"pillars":{"ai_provenance":{"score":10.1,"confidence":0.95,"coverage":1.0,"label":"explicit","breakdown":{"attributed_share":0.1012,"suspected_share":0.2132,"estimated_share":0.1012,"ai_artifacts":2.0,"flagged_work_units":4.0,"flagged_releases":1.0},"summary":"Explicit AI attribution on 10% of first-party code added; an estimated 10% including velocity signals."},"quality":{"score":62.4,"confidence":0.9,"coverage":1.0,"label":"weak","breakdown":{"complexity":58.4,"duplication":43.3,"lint":76.3,"testing":74.3,"docs":80.0,"type_safety":0.0,"process":null},"summary":"Code quality is weak: test-to-source ratio 0.19, CI runs tests; 18% of function code in complex or long functions; 14% duplicated lines. Weakest area: type safety."},"security":{"score":79.4,"confidence":0.85,"coverage":1.0,"label":"adequate","breakdown":{"secrets":93.6,"sast":90.5,"dependencies":100.0,"ci_actions":39.9,"posture":40.0,"scorecard":null},"summary":"Security posture is adequate: 18 high-severity SAST findings; 6 high-severity workflow issues. Weakest area: ci actions."}},"analyzer_results":[{"analyzer":"sec-scorecard","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no published OpenSSF Scorecard result for this repo"},{"analyzer":"sec-registry","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no registry dependencies declared"},{"analyzer":"ai-attribution","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"commits":308.0,"attributed_commits":33.0,"attributed_commit_share":0.10714285714285714,"effective_loc":76329.0,"attributed_loc":7721.0,"attributed_loc_share":0.10115421399468093,"tools_detected":2.0},"findings":[],"evidence":[{"kind":"attribution-summary","description":"OpenAI Codex: 26 attributed commits, 7,123 lines added","ref":null,"url":null,"weight":1.0},{"kind":"attribution-summary","description":"Claude Code: 7 attributed commits, 598 lines added","ref":null,"url":null,"weight":1.0},{"kind":"attributed-commit","description":"OpenAI Codex: PR branch 'codex/issue66-session-discovery'","ref":"02b7fe7899d1f2527a7728bf3f32c4258ebd8d95","url":"https://github.com/iFurySt/open-computer-use/commit/02b7fe7899d1f2527a7728bf3f32c4258ebd8d95","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"7c40742499743208e25aa65b001ffb020f41c3b3","url":"https://github.com/iFurySt/open-computer-use/commit/7c40742499743208e25aa65b001ffb020f41c3b3","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: PR branch 'codex/require-release-notarization'","ref":"63145fc394142218b52ce0c5fa4ae720ef36d40c","url":"https://github.com/iFurySt/open-computer-use/commit/63145fc394142218b52ce0c5fa4ae720ef36d40c","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: PR branch 'codex/visible-tree-budget'","ref":"bf7c12db88f9877671d33befed483e8ceefbfe66","url":"https://github.com/iFurySt/open-computer-use/commit/bf7c12db88f9877671d33befed483e8ceefbfe66","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: PR branch 'codex/pr138-review'","ref":"6505cbc092914431493e6d6ccc1a7d849ac73f11","url":"https://github.com/iFurySt/open-computer-use/commit/6505cbc092914431493e6d6ccc1a7d849ac73f11","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: PR branch 'codex/pr134-review'","ref":"c2c5d0e5f3e3e3270b57c85620886a1710250711","url":"https://github.com/iFurySt/open-computer-use/commit/c2c5d0e5f3e3e3270b57c85620886a1710250711","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: PR branch 'codex/fix-locked-use-cold-auth-notarization'","ref":"21a33a460943ef1c5be372ab141f59c09a37676a","url":"https://github.com/iFurySt/open-computer-use/commit/21a33a460943ef1c5be372ab141f59c09a37676a","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: PR branch 'codex/linux-selective-observation'","ref":"31a7d7da5f28d8b737c936460493efbcae453816","url":"https://github.com/iFurySt/open-computer-use/commit/31a7d7da5f28d8b737c936460493efbcae453816","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: PR branch 'codex/linux-hidden-details'","ref":"7cb8bb7cfb97fce085b8fa519c1457e5fa51cfa5","url":"https://github.com/iFurySt/open-computer-use/commit/7cb8bb7cfb97fce085b8fa519c1457e5fa51cfa5","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: PR branch 'codex/verify-release-1-1-2'","ref":"eb501f4b1fb1726d1119fed2c4d742ece1907ebd","url":"https://github.com/iFurySt/open-computer-use/commit/eb501f4b1fb1726d1119fed2c4d742ece1907ebd","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: PR branch 'codex/linux-bounded-focus'","ref":"5e1f189f86ee11806e1b2f0ecb961cd68e1a2acf","url":"https://github.com/iFurySt/open-computer-use/commit/5e1f189f86ee11806e1b2f0ecb961cd68e1a2acf","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: PR branch 'codex/release-1-1-2'","ref":"531c9d4d6e2e842f93368283ebd1d757625b73b1","url":"https://github.com/iFurySt/open-computer-use/commit/531c9d4d6e2e842f93368283ebd1d757625b73b1","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: PR branch 'codex/complete-npm-rename'","ref":"0daece0fd09457b1ca8fb37a265a76662a43d16f","url":"https://github.com/iFurySt/open-computer-use/commit/0daece0fd09457b1ca8fb37a265a76662a43d16f","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: PR branch 'codex/rename-open-computer-use'","ref":"5d948fc5846dbc74aca29e6f52991049d0de9683","url":"https://github.com/iFurySt/open-computer-use/commit/5d948fc5846dbc74aca29e6f52991049d0de9683","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: PR branch 'codex/linux-action-read-back'","ref":"1b6fd8f8354fbb6e9a5f287267383b3357060b2e","url":"https://github.com/iFurySt/open-computer-use/commit/1b6fd8f8354fbb6e9a5f287267383b3357060b2e","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: PR branch 'codex/fix-locked-use-unlock-latency'","ref":"0300d62d3238cebb176b3a7fce523890d3f8c31b","url":"https://github.com/iFurySt/open-computer-use/commit/0300d62d3238cebb176b3a7fce523890d3f8c31b","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: PR branch 'codex/macos-locked-use-pr'","ref":"89c5b64addf85160ba7caeaa4e64305ee44bc419","url":"https://github.com/iFurySt/open-computer-use/commit/89c5b64addf85160ba7caeaa4e64305ee44bc419","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: PR branch 'codex/doctor-json-permissions'","ref":"3cfe4b1e52cad6a99f5f19a7e01fb279752eb2a8","url":"https://github.com/iFurySt/open-computer-use/commit/3cfe4b1e52cad6a99f5f19a7e01fb279752eb2a8","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: PR branch 'codex/persistent-config'","ref":"2cf3eae57666636aedecf48d0502cb0ed827010d","url":"https://github.com/iFurySt/open-computer-use/commit/2cf3eae57666636aedecf48d0502cb0ed827010d","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"d9bcc74da163a82450403dfd7893a17e9341ca9e","url":"https://github.com/iFurySt/open-computer-use/commit/d9bcc74da163a82450403dfd7893a17e9341ca9e","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"5c7699244c9fce1f936619b1f2e9e05f47ae8e01","url":"https://github.com/iFurySt/open-computer-use/commit/5c7699244c9fce1f936619b1f2e9e05f47ae8e01","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"6489d9d7fbe49acd2d9077861f7b9527b5dbcc56","url":"https://github.com/iFurySt/open-computer-use/commit/6489d9d7fbe49acd2d9077861f7b9527b5dbcc56","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"fa6fe1a3f9b4a727aa1858864d709c0aa1a47509","url":"https://github.com/iFurySt/open-computer-use/commit/fa6fe1a3f9b4a727aa1858864d709c0aa1a47509","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"1add8240be3319297c2bc985870171966097b0ff","url":"https://github.com/iFurySt/open-computer-use/commit/1add8240be3319297c2bc985870171966097b0ff","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"3a4c85989b2488de3c28c9cbcc71e3093c76ade9","url":"https://github.com/iFurySt/open-computer-use/commit/3a4c85989b2488de3c28c9cbcc71e3093c76ade9","weight":0.9}],"data":{"attributed_loc_by_commit":{"611dd3ac4995b2de6d50df2f50102e7372c70ba9":3,"0fdee32fa35b141a4a9b1e4305da61a643f44f35":51,"a5c072be460d4c3265ac3b1f10712dcbc55dd697":57,"cd0b30dc229780083174afd540858c4a2537d8c4":147,"80868ccf179c3d5b930e5c335eb9a6d931a29a51":258,"b4234f4a59a35f0b1a046d323a49f0e42fe3e587":132,"fd603ba57a3ca6fb3bddf98d2efa1f8d9e03aec6":603,"4c05ee811a1d2714cf1d5ab5e37c51460442b117":115,"3a4c85989b2488de3c28c9cbcc71e3093c76ade9":15,"1add8240be3319297c2bc985870171966097b0ff":1,"fa6fe1a3f9b4a727aa1858864d709c0aa1a47509":6,"6489d9d7fbe49acd2d9077861f7b9527b5dbcc56":94,"5c7699244c9fce1f936619b1f2e9e05f47ae8e01":77,"d9bcc74da163a82450403dfd7893a17e9341ca9e":0,"2cf3eae57666636aedecf48d0502cb0ed827010d":610,"3cfe4b1e52cad6a99f5f19a7e01fb279752eb2a8":83,"89c5b64addf85160ba7caeaa4e64305ee44bc419":393,"0300d62d3238cebb176b3a7fce523890d3f8c31b":0,"1b6fd8f8354fbb6e9a5f287267383b3357060b2e":425,"5d948fc5846dbc74aca29e6f52991049d0de9683":58,"0daece0fd09457b1ca8fb37a265a76662a43d16f":0,"531c9d4d6e2e842f93368283ebd1d757625b73b1":7,"5e1f189f86ee11806e1b2f0ecb961cd68e1a2acf":208,"eb501f4b1fb1726d1119fed2c4d742ece1907ebd":0,"7cb8bb7cfb97fce085b8fa519c1457e5fa51cfa5":218,"31a7d7da5f28d8b737c936460493efbcae453816":1595,"21a33a460943ef1c5be372ab141f59c09a37676a":439,"c2c5d0e5f3e3e3270b57c85620886a1710250711":520,"6505cbc092914431493e6d6ccc1a7d849ac73f11":131,"bf7c12db88f9877671d33befed483e8ceefbfe66":753,"63145fc394142218b52ce0c5fa4ae720ef36d40c":151,"7c40742499743208e25aa65b001ffb020f41c3b3":405,"02b7fe7899d1f2527a7728bf3f32c4258ebd8d95":166},"tools":{"openai-codex":{"name":"OpenAI Codex","commits":26,"loc":7123,"first_seen":1776847565,"last_seen":1794236135},"claude-code":{"name":"Claude Code","commits":7,"loc":598,"first_seen":1780821948,"last_seen":1794037729}},"monthly":{"2026-04":{"loc":32770,"attributed_loc":648},"2026-05":{"loc":3729,"attributed_loc":718},"2026-06":{"loc":2166,"attributed_loc":22},"2026-07":{"loc":2221,"attributed_loc":0},"2026-08":{"loc":186,"attributed_loc":0},"2026-09":{"loc":3269,"attributed_loc":171},"2026-10":{"loc":24505,"attributed_loc":4687},"2026-11":{"loc":7483,"attributed_loc":1475}}},"error":null},{"analyzer":"ai-artifacts","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"artifacts":2.0,"workflow_agents":0.0,"tools_configured":2.0,"earliest_adoption":1776402042.0},"findings":[],"evidence":[{"kind":"ai-artifact","description":"CLAUDE.md (claude-code configuration)","ref":"CLAUDE.md","url":"https://github.com/iFurySt/open-computer-use/blob/e25be21caa0ea489316f6be6635d2a4766c4cd0b/CLAUDE.md","weight":0.5},{"kind":"ai-artifact","description":"AGENTS.md (generic-agent configuration)","ref":"AGENTS.md","url":"https://github.com/iFurySt/open-computer-use/blob/e25be21caa0ea489316f6be6635d2a4766c4cd0b/AGENTS.md","weight":0.5}],"data":{"artifacts":[{"tool":"claude-code","path":"CLAUDE.md","added_at":1776402042},{"tool":"generic-agent","path":"AGENTS.md","added_at":1776402042}],"workflows":[],"tools":["claude-code","generic-agent"]},"error":null},{"analyzer":"ai-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"work_units":142.0,"flagged_units":4.0,"pre_ai_era_bursts":0.0,"pre_ai_era_measured_loc":0.0,"pre_ai_era_burst_loc":0.0,"measured_loc":62282.0,"flagged_loc":16277.0,"flagged_loc_share":0.2613435663594618,"max_loc_per_hour":3849.838945827233,"median_loc_per_hour":47.75,"pr_timed_units":69.0,"excluded_import_loc":14047.0},"findings":[],"evidence":[{"kind":"velocity-burst","description":"7,304 lines of first-party code in ~1.9h (3,850 lines/hour, 5 commit session)","ref":"4a46de3ea7c7778e8fb85b0e5a4d5148838d6598","url":"https://github.com/iFurySt/open-computer-use/commit/4a46de3ea7c7778e8fb85b0e5a4d5148838d6598","weight":0.6},{"kind":"velocity-burst","description":"2,007 lines of first-party code in ~1.2h (1,612 lines/hour, 4 commit session)","ref":"7f742488c82d91c770107b782de21d96ed2e8841","url":"https://github.com/iFurySt/open-computer-use/commit/7f742488c82d91c770107b782de21d96ed2e8841","weight":0.48350658041490074},{"kind":"velocity-burst","description":"3,906 lines of first-party code in ~3.5h (1,124 lines/hour, 13 commit session)","ref":"1423fd7d13fd13cee8048567bef9a3dead7364cd","url":"https://github.com/iFurySt/open-computer-use/commit/1423fd7d13fd13cee8048567bef9a3dead7364cd","weight":0.3371547314578005},{"kind":"velocity-burst","description":"3,060 lines of first-party code in ~5.3h (579 lines/hour, 4 commit session)","ref":"724fb2a8f7b516086fd0fcee892b7ebf56debea2","url":"https://github.com/iFurySt/open-computer-use/commit/724fb2a8f7b516086fd0fcee892b7ebf56debea2","weight":0.1736079008194999}],"data":{"flagged_loc_by_commit":{"dd6cc76eeaa3f596067fdfd620cf1fa545c5c2c2":48,"a153d0e84e331408263ccbdf537499caafbc4472":1284,"f3f0d04de938e7e406779ced2c6842d80af97d6e":285,"7f742488c82d91c770107b782de21d96ed2e8841":390,"3aa5037bde048384c144e50253551be277330e93":968,"07bee810f954ff0021a44df3d973a80604f1cb0b":991,"597ce3ace4c661e8722c35c600a8eeb0de44d35e":297,"a62f980c0ec787fc3e1dbbb566ae1558870ee0fa":567,"7e0382295925f12d64463ec90d09573cc0b3e9e9":26,"7e8e8c1272d3691dc0fa69677d40586a8a193e04":8,"42ef8fc08f689905ececcec29de6b635f589ffc7":42,"46d61586e3a5d4ff39a8976ffd64295e9c32454e":140,"43c6a0ae622c05492042773c1341379223d397cd":15,"5a26e74332516e754a26616d3f45d0f249a0c6df":368,"f66df83ed29f492bdd4ef7865e9085cfdd092882":468,"680e426d30d18932d45ddaf6b6dcc0175d9d2db5":5,"1423fd7d13fd13cee8048567bef9a3dead7364cd":11,"345aff721603ce38cf8c0db7c7037c0660e22b8e":541,"33a76faa6d3e735c677b12289812711a5bcaa7cd":1927,"c98910831d3275bf252eb2211589920396b4424f":27,"22b2463dc7322b4a8bef639a9027ec23969dc5a5":3438,"4a46de3ea7c7778e8fb85b0e5a4d5148838d6598":1371,"bdbcd33525b8642cedd7d15261ca40ee31f9563d":1947,"dcd2d39ad2b6b31203105881339d74af214a1a44":549,"023eea454b996b4f6850d9575892b3343160df81":66,"724fb2a8f7b516086fd0fcee892b7ebf56debea2":498},"excluded_import_commits":["134aab7d98dbe7ad160316fd2dc924ab88029fa7","d5b23ed877168c079f4436dd03d32e95362303cf"]},"error":null},{"analyzer":"ai-release-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"releases":65.0,"flagged_releases":1.0,"max_loc_per_day":49968.0},"findings":[],"evidence":[{"kind":"release-burst","description":"v0.1.12 → v0.1.13: 8,836 lines in 0.74 days (11,922.8 lines/day)","ref":"v0.1.12...v0.1.13","url":"https://github.com/iFurySt/open-computer-use/compare/v0.1.12...v0.1.13","weight":0.4}],"data":{"releases":[{"from":"0.1.5","to":"0.1.6","loc":368,"days":0.04,"loc_per_day":8832.0,"flagged":false},{"from":"0.1.6","to":"v0.1.7","loc":468,"days":0.04,"loc_per_day":11232.0,"flagged":false},{"from":"v0.1.7","to":"v0.1.8","loc":5,"days":0.04,"loc_per_day":120.0,"flagged":false},{"from":"v0.1.8","to":"v0.1.9","loc":11,"days":0.04,"loc_per_day":264.0,"flagged":false},{"from":"v0.1.9","to":"v0.1.10","loc":239,"days":0.05,"loc_per_day":5301.6,"flagged":false},{"from":"v0.1.10","to":"v0.1.11","loc":44,"days":0.04,"loc_per_day":1056.0,"flagged":false},{"from":"v0.1.11","to":"v0.1.12","loc":2049,"days":1.87,"loc_per_day":1094.2,"flagged":false},{"from":"v0.1.12","to":"v0.1.13","loc":8836,"days":0.74,"loc_per_day":11922.8,"flagged":true},{"from":"v0.1.13","to":"v0.1.14","loc":24,"days":0.04,"loc_per_day":576.0,"flagged":false},{"from":"v0.1.14","to":"v0.1.15","loc":545,"days":0.04,"loc_per_day":13080.0,"flagged":false},{"from":"v0.1.15","to":"v0.1.16","loc":217,"days":0.04,"loc_per_day":5208.0,"flagged":false},{"from":"v0.1.16","to":"v0.1.17","loc":152,"days":0.05,"loc_per_day":2834.0,"flagged":false},{"from":"v0.1.17","to":"v0.1.18","loc":13,"days":0.04,"loc_per_day":312.0,"flagged":false},{"from":"v0.1.18","to":"v0.1.19","loc":367,"days":0.04,"loc_per_day":8808.0,"flagged":false},{"from":"v0.1.19","to":"v0.1.20","loc":33,"days":0.04,"loc_per_day":792.0,"flagged":false},{"from":"v0.1.20","to":"v0.1.21","loc":939,"days":0.73,"loc_per_day":1292.4,"flagged":false},{"from":"v0.1.21","to":"v0.1.22","loc":138,"days":0.17,"loc_per_day":822.7,"flagged":false},{"from":"v0.1.22","to":"v0.1.23","loc":829,"days":0.2,"loc_per_day":4107.9,"flagged":false},{"from":"v0.1.23","to":"v0.1.24","loc":74,"days":0.55,"loc_per_day":134.5,"flagged":false},{"from":"v0.1.24","to":"v0.1.25","loc":44,"days":0.04,"loc_per_day":1056.0,"flagged":false},{"from":"v0.1.25","to":"v0.1.26","loc":306,"days":0.04,"loc_per_day":7344.0,"flagged":false},{"from":"v0.1.26","to":"v0.1.27","loc":231,"days":0.04,"loc_per_day":5194.8,"flagged":false},{"from":"v0.1.27","to":"v0.1.28","loc":30,"days":0.04,"loc_per_day":720.0,"flagged":false},{"from":"v0.1.28","to":"v0.1.29","loc":376,"days":0.14,"loc_per_day":2605.6,"flagged":false},{"from":"v0.1.29","to":"v0.1.30","loc":2082,"days":0.04,"loc_per_day":49968.0,"flagged":false},{"from":"v0.1.30","to":"v0.1.31","loc":648,"days":0.04,"loc_per_day":15552.0,"flagged":false},{"from":"v0.1.31","to":"v0.1.32","loc":5,"days":0.04,"loc_per_day":120.0,"flagged":false},{"from":"v0.1.32","to":"v0.1.33","loc":351,"days":0.04,"loc_per_day":8424.0,"flagged":false},{"from":"v0.1.33","to":"v0.1.34","loc":2496,"days":0.7,"loc_per_day":3556.2,"flagged":false},{"from":"v0.1.34","to":"v0.1.35","loc":66,"days":0.04,"loc_per_day":1584.0,"flagged":false},{"from":"v0.1.35","to":"v0.1.36","loc":498,"days":0.04,"loc_per_day":11952.0,"flagged":false},{"from":"v0.1.36","to":"v0.1.37","loc":610,"days":12.91,"loc_per_day":47.2,"flagged":false},{"from":"v0.1.37","to":"v0.1.38","loc":22,"days":0.04,"loc_per_day":528.0,"flagged":false},{"from":"v0.1.38","to":"v0.1.39","loc":21,"days":1.21,"loc_per_day":17.4,"flagged":false},{"from":"v0.1.39","to":"v0.1.40","loc":114,"days":0.06,"loc_per_day":1966.0,"flagged":false},{"from":"v0.1.40","to":"v0.1.41","loc":338,"days":0.04,"loc_per_day":8112.0,"flagged":false},{"from":"v0.1.41","to":"v0.1.42","loc":107,"days":0.04,"loc_per_day":2568.0,"flagged":false},{"from":"v0.1.42","to":"v0.1.43","loc":81,"days":0.04,"loc_per_day":1944.0,"flagged":false},{"from":"v0.1.43","to":"v0.1.44","loc":28,"days":0.04,"loc_per_day":672.0,"flagged":false},{"from":"v0.1.44","to":"v0.1.45","loc":22,"days":0.04,"loc_per_day":528.0,"flagged":false},{"from":"v0.1.45","to":"v0.1.46","loc":17,"days":0.04,"loc_per_day":408.0,"flagged":false},{"from":"v0.1.46","to":"v0.1.47","loc":596,"days":0.69,"loc_per_day":868.6,"flagged":false},{"from":"v0.1.47","to":"v0.1.48","loc":155,"days":0.15,"loc_per_day":1038.5,"flagged":false},{"from":"v0.1.48","to":"v0.1.49","loc":268,"days":2.79,"loc_per_day":96.0,"flagged":false},{"from":"v0.1.49","to":"v0.1.50","loc":911,"days":2.15,"loc_per_day":423.1,"flagged":false},{"from":"v0.1.50","to":"v0.1.51","loc":249,"days":7.13,"loc_per_day":34.9,"flagged":false},{"from":"v0.1.51","to":"v0.1.52","loc":197,"days":14.19,"loc_per_day":13.9,"flagged":false},{"from":"v0.1.52","to":"v0.1.53","loc":964,"days":7.75,"loc_per_day":124.4,"flagged":false},{"from":"v0.1.53","to":"v0.1.54","loc":15,"days":15.26,"loc_per_day":1.0,"flagged":false},{"from":"v0.1.54","to":"v0.2.0","loc":1187,"days":11.52,"loc_per_day":103.0,"flagged":false},{"from":"v0.2.0","to":"v0.2.1","loc":182,"days":12.29,"loc_per_day":14.8,"flagged":false},{"from":"v0.2.1","to":"v0.3.0","loc":1819,"days":6.87,"loc_per_day":264.8,"flagged":false},{"from":"v0.3.0","to":"v0.3.1","loc":86,"days":3.08,"loc_per_day":28.0,"flagged":false},{"from":"v0.3.1","to":"v0.3.2","loc":313,"days":29.76,"loc_per_day":10.5,"flagged":false},{"from":"v0.3.2","to":"v0.3.3","loc":42,"days":3.16,"loc_per_day":13.3,"flagged":false},{"from":"v0.3.3","to":"v0.3.4","loc":282,"days":7.31,"loc_per_day":38.6,"flagged":false},{"from":"v0.3.4","to":"v0.3.5","loc":178,"days":1.28,"loc_per_day":139.4,"flagged":false},{"from":"v0.3.5","to":"v0.3.6","loc":2767,"days":19.3,"loc_per_day":143.3,"flagged":false},{"from":"v0.3.6","to":"v1.0.0","loc":3489,"days":11.12,"loc_per_day":313.7,"flagged":false},{"from":"v1.0.0","to":"v1.1.0","loc":2222,"days":3.87,"loc_per_day":574.2,"flagged":false},{"from":"v1.1.0","to":"v1.1.1","loc":479,"days":1.45,"loc_per_day":331.2,"flagged":false},{"from":"v1.1.1","to":"v1.1.2","loc":1336,"days":1.71,"loc_per_day":783.5,"flagged":false},{"from":"v1.1.2","to":"reference-bundles","loc":3754,"days":2.35,"loc_per_day":1597.6,"flagged":false},{"from":"reference-bundles","to":"v1.1.3","loc":3207,"days":12.47,"loc_per_day":257.1,"flagged":false},{"from":"v1.1.3","to":"v1.1.4","loc":1799,"days":6.16,"loc_per_day":292.1,"flagged":false}]},"error":null},{"analyzer":"ai-stylometry","pillar":"ai_provenance","status":"ok","tool_version":null,"metrics":{"lines_scanned":58251.0,"index":0.24,"count:narrated_steps":0.0,"per_kloc:narrated_steps":0.0,"files:narrated_steps":0.0,"count:placeholder":0.0,"per_kloc:placeholder":0.0,"files:placeholder":0.0,"count:emoji_in_code":28.0,"per_kloc:emoji_in_code":0.481,"files:emoji_in_code":4.0,"count:assistant_voice":0.0,"per_kloc:assistant_voice":0.0,"files:assistant_voice":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-secrets","pillar":"security","status":"ok","tool_version":"gitleaks 8.30.1","metrics":{"secrets_current":0.0,"secrets_history":0.0,"secrets_nonprod":2.0,"secrets_low_confidence":0.0},"findings":[{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree (test/docs/example file)","path":"docs/references/codex-computer-use-reverse-engineering/packaging-and-lifecycle-integration.md","line":73,"fingerprint":"docs/references/codex-computer-use-reverse-engineering/packaging-and-lifecycle-integration.md:generic-api-key:73"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree (test/docs/example file)","path":"scripts/tests/windows-input-smoke.ps1","line":125,"fingerprint":"scripts/tests/windows-input-smoke.ps1:generic-api-key:125"}],"evidence":[],"data":{},"error":null},{"analyzer":"sec-sast","pillar":"security","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":19.0,"findings_high":18.0,"findings_medium":1.0,"findings_low":0.0,"weighted_findings":15.85,"scanned_lines":55776.0,"parse_errors":0.0},"findings":[{"rule_id":"opengrep/go.lang.security.audit.dangerous-exec-command","severity":"high","message":"Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low]","path":"scripts/computer-use-cli/app_server.go","line":141,"fingerprint":"go.lang.security.audit.dangerous-exec-command:scripts/computer-use-cli/app_server.go:141"},{"rule_id":"opengrep/go.lang.security.audit.dangerous-exec-command","severity":"high","message":"Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low]","path":"scripts/computer-use-cli/main.go","line":359,"fingerprint":"go.lang.security.audit.dangerous-exec-command:scripts/computer-use-cli/main.go:359"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"scripts/run-locked-use-native-validation.py","line":27,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:scripts/run-locked-use-native-validation.py:27"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"scripts/run-locked-use-native-validation.py","line":72,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:scripts/run-locked-use-native-validation.py:72"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"scripts/run-locked-use-native-validation.py","line":151,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:scripts/run-locked-use-native-validation.py:151"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"scripts/run-locked-use-native-validation.py","line":182,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:scripts/run-locked-use-native-validation.py:182"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"scripts/run-locked-use-native-validation.py","line":194,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:scripts/run-locked-use-native-validation.py:194"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"scripts/run-locked-use-rehearsal.py","line":21,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:scripts/run-locked-use-rehearsal.py:21"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"scripts/run-locked-use-rehearsal.py","line":24,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:scripts/run-locked-use-rehearsal.py:24"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"scripts/run-locked-use-rehearsal.py","line":57,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:scripts/run-locked-use-rehearsal.py:57"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"scripts/run-locked-use-rehearsal.py","line":75,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:scripts/run-locked-use-rehearsal.py:75"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"scripts/run-locked-use-smoke.py","line":65,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:scripts/run-locked-use-smoke.py:65"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args","severity":"high","message":"Detected subprocess function 'Popen' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'. [confidence medium]","path":"scripts/run-locked-use-smoke.py","line":65,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-tainted-env-args:scripts/run-locked-use-smoke.py:65"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"scripts/run-locked-use-smoke.py","line":79,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:scripts/run-locked-use-smoke.py:79"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args","severity":"high","message":"Detected subprocess function 'run' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'. [confidence medium]","path":"scripts/run-locked-use-smoke.py","line":79,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-tainted-env-args:scripts/run-locked-use-smoke.py:79"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"scripts/run-locked-use-unshielded-diagnostic.py","line":37,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:scripts/run-locked-use-unshielded-diagnostic.py:37"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"scripts/run-locked-use-unshielded-diagnostic.py","line":48,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:scripts/run-locked-use-unshielded-diagnostic.py:48"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"scripts/run-locked-use-unshielded-diagnostic.py","line":55,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:scripts/run-locked-use-unshielded-diagnostic.py:55"},{"rule_id":"opengrep/c.lang.security.insecure-use-memset","severity":"medium","message":"When handling sensitive information in a buffer, it's important to ensure  that the data is securely erased before the buffer is deleted or reused.  While `memset()` is commonly used for this purpose, it can leave sensitive  information behind due to compiler optimizations or other factors.  To avoi [confidence low]","path":"packages/LockedUseNative/PeerIdentity.c","line":16,"fingerprint":"c.lang.security.insecure-use-memset:packages/LockedUseNative/PeerIdentity.c:16"}],"evidence":[],"data":{"rulesets":["swift","go","python","javascript","bash","c"]},"error":null},{"analyzer":"sec-deps","pillar":"security","status":"ok","tool_version":"osv-scanner version: 2.7.1","metrics":{"vulnerable_packages":0.0,"vulnerabilities":0.0,"vulns_critical":0.0,"vulns_high":0.0,"vulns_medium":0.0,"vulns_low":0.0,"vulns_unknown":0.0,"penalty":0.0},"findings":[],"evidence":[],"data":{"ecosystems":["Go"]},"error":null},{"analyzer":"sec-actions","pillar":"security","status":"ok","tool_version":"zizmor 1.32.0","metrics":{"workflows":4.0,"findings":13.0,"findings_high":6.0,"findings_medium":7.0,"findings_low":0.0,"penalty":55.2},"findings":[{"rule_id":"zizmor/excessive-permissions","severity":"high","message":"overly broad permissions [confidence high]","path":".github/workflows/release.yml","line":22,"fingerprint":"excessive-permissions:.github/workflows/release.yml:22"},{"rule_id":"zizmor/excessive-permissions","severity":"high","message":"overly broad permissions [confidence high]","path":".github/workflows/release.yml","line":23,"fingerprint":"excessive-permissions:.github/workflows/release.yml:23"},{"rule_id":"zizmor/excessive-permissions","severity":"high","message":"overly broad permissions [confidence high]","path":".github/workflows/release.yml","line":24,"fingerprint":"excessive-permissions:.github/workflows/release.yml:24"},{"rule_id":"zizmor/cache-poisoning","severity":"high","message":"runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low]","path":".github/workflows/release.yml","line":35,"fingerprint":"cache-poisoning:.github/workflows/release.yml:35"},{"rule_id":"zizmor/cache-poisoning","severity":"high","message":"runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low]","path":".github/workflows/release.yml","line":54,"fingerprint":"cache-poisoning:.github/workflows/release.yml:54"},{"rule_id":"zizmor/cache-poisoning","severity":"high","message":"runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low]","path":".github/workflows/release.yml","line":59,"fingerprint":"cache-poisoning:.github/workflows/release.yml:59"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/ci.yml","line":21,"fingerprint":"artipacked:.github/workflows/ci.yml:21"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/locked-use-distribution.yml","line":52,"fingerprint":"artipacked:.github/workflows/locked-use-distribution.yml:52"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/release.yml","line":31,"fingerprint":"artipacked:.github/workflows/release.yml:31"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/release.yml","line":50,"fingerprint":"artipacked:.github/workflows/release.yml:50"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/release.yml","line":203,"fingerprint":"artipacked:.github/workflows/release.yml:203"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/release.yml","line":320,"fingerprint":"artipacked:.github/workflows/release.yml:320"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/windows-observation.yml","line":40,"fingerprint":"artipacked:.github/workflows/windows-observation.yml:40"}],"evidence":[],"data":{},"error":null},{"analyzer":"sec-posture","pillar":"security","status":"ok","tool_version":null,"metrics":{"check:security_policy":1.0,"check:dependency_updates":0.0,"check:signed_commits":0.0,"check:lockfiles":0.0,"signed_commit_share":0.41,"unpinned_manifests":3.0},"findings":[],"evidence":[{"kind":"posture","description":"Security policy: SECURITY.md","ref":"SECURITY.md","url":null,"weight":0.0},{"kind":"posture","description":"Security policy: docs/SECURITY.md","ref":"docs/SECURITY.md","url":null,"weight":0.0},{"kind":"posture","description":"apps/OpenComputerUseLinux/go.mod has no lockfile alongside it (unpinned dependencies)","ref":"apps/OpenComputerUseLinux/go.mod","url":null,"weight":0.3},{"kind":"posture","description":"apps/OpenComputerUseWindows/go.mod has no lockfile alongside it (unpinned dependencies)","ref":"apps/OpenComputerUseWindows/go.mod","url":null,"weight":0.3},{"kind":"posture","description":"package.json has no lockfile alongside it (unpinned dependencies)","ref":"package.json","url":null,"weight":0.3}],"data":{},"error":null},{"analyzer":"sec-distribution","pillar":"security","status":"ok","tool_version":null,"metrics":{"signals":1.0,"binary_assets":53.0,"suspicious":0.0},"findings":[],"evidence":[{"kind":"binary-release-asset","description":"release v1.1.4 ships CursorMotion-1.1.4.dmg (6 downloads)","ref":"CursorMotion-1.1.4.dmg","url":"https://github.com/iFurySt/open-computer-use/releases/download/v1.1.4/CursorMotion-1.1.4.dmg","weight":0.0},{"kind":"binary-release-asset","description":"release v1.1.4 ships Open-Computer-Use-1.1.4-macOS-universal.app.zip (43 downloads)","ref":"Open-Computer-Use-1.1.4-macOS-universal.app.zip","url":"https://github.com/iFurySt/open-computer-use/releases/download/v1.1.4/Open-Computer-Use-1.1.4-macOS-universal.app.zip","weight":0.0},{"kind":"binary-release-asset","description":"release v1.1.4 ships open-computer-use-cli-1.1.4-linux-amd64.tar.gz (14 downloads)","ref":"open-computer-use-cli-1.1.4-linux-amd64.tar.gz","url":"https://github.com/iFurySt/open-computer-use/releases/download/v1.1.4/open-computer-use-cli-1.1.4-linux-amd64.tar.gz","weight":0.0},{"kind":"binary-release-asset","description":"release v1.1.4 ships open-computer-use-cli-1.1.4-linux-arm64.tar.gz (5 downloads)","ref":"open-computer-use-cli-1.1.4-linux-arm64.tar.gz","url":"https://github.com/iFurySt/open-computer-use/releases/download/v1.1.4/open-computer-use-cli-1.1.4-linux-arm64.tar.gz","weight":0.0},{"kind":"binary-release-asset","description":"release v1.1.4 ships open-computer-use-cli-1.1.4-windows-amd64.zip (64 downloads)","ref":"open-computer-use-cli-1.1.4-windows-amd64.zip","url":"https://github.com/iFurySt/open-computer-use/releases/download/v1.1.4/open-computer-use-cli-1.1.4-windows-amd64.zip","weight":0.0}],"data":{"signals":["binary-release-assets"],"suspicious":false,"unusual_traction":false,"metadata":true},"error":null},{"analyzer":"qual-complexity","pillar":"quality","status":"ok","tool_version":"lizard 1.25.1","metrics":{"functions":2985.0,"function_nloc":41238.0,"mean_ccn":3.64,"p90_ccn":8.0,"complex_functions":90.0,"long_functions":24.0,"many_param_functions":29.0,"risky_nloc_share":0.1795},"findings":[],"evidence":[{"kind":"complex-function","description":"handle in packages/OpenComputerUseKit/Sources/OpenComputerUseKit/LockedUseBrokerCoordinator.swift: complexity 178, 189 lines","ref":"packages/OpenComputerUseKit/Sources/OpenComputerUseKit/LockedUseBrokerCoordinator.swift","url":"https://github.com/iFurySt/open-computer-use/blob/e25be21caa0ea489316f6be6635d2a4766c4cd0b/packages/OpenComputerUseKit/Sources/OpenComputerUseKit/LockedUseBrokerCoordinator.swift#L98","weight":1.0},{"kind":"complex-function","description":"probe in experiments/LockedUse/Sources/Guardian/LockScreenInteractor.swift: complexity 99, 186 lines","ref":"experiments/LockedUse/Sources/Guardian/LockScreenInteractor.swift","url":"https://github.com/iFurySt/open-computer-use/blob/e25be21caa0ea489316f6be6635d2a4766c4cd0b/experiments/LockedUse/Sources/Guardian/LockScreenInteractor.swift#L57","weight":1.0},{"kind":"complex-function","description":"read in experiments/LockedUse/Sources/Broker/BrokerMain.swift: complexity 56, 112 lines","ref":"experiments/LockedUse/Sources/Broker/BrokerMain.swift","url":"https://github.com/iFurySt/open-computer-use/blob/e25be21caa0ea489316f6be6635d2a4766c4cd0b/experiments/LockedUse/Sources/Broker/BrokerMain.swift#L253","weight":0.9333333333333333},{"kind":"complex-function","description":"handle in apps/OpenComputerUse/Sources/OpenComputerUse/MacOSAppAgentProxy.swift: complexity 49, 133 lines","ref":"apps/OpenComputerUse/Sources/OpenComputerUse/MacOSAppAgentProxy.swift","url":"https://github.com/iFurySt/open-computer-use/blob/e25be21caa0ea489316f6be6635d2a4766c4cd0b/apps/OpenComputerUse/Sources/OpenComputerUse/MacOSAppAgentProxy.swift#L365","weight":0.8166666666666667},{"kind":"complex-function","description":"runWatchdog in experiments/LockedUse/Sources/Guardian/GuardianMain.swift: complexity 48, 66 lines","ref":"experiments/LockedUse/Sources/Guardian/GuardianMain.swift","url":"https://github.com/iFurySt/open-computer-use/blob/e25be21caa0ea489316f6be6635d2a4766c4cd0b/experiments/LockedUse/Sources/Guardian/GuardianMain.swift#L237","weight":0.8},{"kind":"complex-function","description":"main in experiments/LockedUse/Sources/Guardian/GuardianMain.swift: complexity 43, 153 lines","ref":"experiments/LockedUse/Sources/Guardian/GuardianMain.swift","url":"https://github.com/iFurySt/open-computer-use/blob/e25be21caa0ea489316f6be6635d2a4766c4cd0b/experiments/LockedUse/Sources/Guardian/GuardianMain.swift#L21","weight":0.7166666666666667},{"kind":"complex-function","description":"main in scripts/node-repl/open-computer-use-cli.mjs: complexity 42, 84 lines","ref":"scripts/node-repl/open-computer-use-cli.mjs","url":"https://github.com/iFurySt/open-computer-use/blob/e25be21caa0ea489316f6be6635d2a4766c4cd0b/scripts/node-repl/open-computer-use-cli.mjs#L448","weight":0.7},{"kind":"complex-function","description":"poll in experiments/LockedUse/Sources/Guardian/DisplayGuardian.swift: complexity 40, 79 lines","ref":"experiments/LockedUse/Sources/Guardian/DisplayGuardian.swift","url":"https://github.com/iFurySt/open-computer-use/blob/e25be21caa0ea489316f6be6635d2a4766c4cd0b/experiments/LockedUse/Sources/Guardian/DisplayGuardian.swift#L332","weight":0.6666666666666666},{"kind":"complex-function","description":"renderSelected in packages/OpenComputerUseKit/Sources/OpenComputerUseKit/AccessibilitySnapshot.swift: complexity 40, 197 lines","ref":"packages/OpenComputerUseKit/Sources/OpenComputerUseKit/AccessibilitySnapshot.swift","url":"https://github.com/iFurySt/open-computer-use/blob/e25be21caa0ea489316f6be6635d2a4766c4cd0b/packages/OpenComputerUseKit/Sources/OpenComputerUseKit/AccessibilitySnapshot.swift#L951","weight":0.6666666666666666},{"kind":"complex-function","description":"main in scripts/run-locked-use-native-validation.py: complexity 38, 157 lines","ref":"scripts/run-locked-use-native-validation.py","url":"https://github.com/iFurySt/open-computer-use/blob/e25be21caa0ea489316f6be6635d2a4766c4cd0b/scripts/run-locked-use-native-validation.py#L95","weight":0.6333333333333333}],"data":{},"error":null},{"analyzer":"qual-duplication","pillar":"quality","status":"ok","tool_version":"repotrust-dup-w6","metrics":{"compared_lines":42835.0,"duplicated_lines":5980.0,"duplicated_share":0.1396,"files":251.0},"findings":[],"evidence":[{"kind":"duplicate-code","description":"6+ duplicated lines: apps/OpenComputerUse/Sources/OpenComputerUse/MCPAppRuntime.swift:28 and apps/OpenComputerUse/Sources/OpenComputerUse/MacOSAppAgentProxy.swift:193","ref":"apps/OpenComputerUse/Sources/OpenComputerUse/MCPAppRuntime.swift","url":"https://github.com/iFurySt/open-computer-use/blob/e25be21caa0ea489316f6be6635d2a4766c4cd0b/apps/OpenComputerUse/Sources/OpenComputerUse/MCPAppRuntime.swift#L28","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: apps/OpenComputerUse/Sources/OpenComputerUse/PermissionOnboardingApp.swift:1183 and scripts/render-open-computer-use-icon.swift:85","ref":"apps/OpenComputerUse/Sources/OpenComputerUse/PermissionOnboardingApp.swift","url":"https://github.com/iFurySt/open-computer-use/blob/e25be21caa0ea489316f6be6635d2a4766c4cd0b/apps/OpenComputerUse/Sources/OpenComputerUse/PermissionOnboardingApp.swift#L1183","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: apps/OpenComputerUseFixture/Sources/OpenComputerUseFixture/main.swift:27 and apps/OpenComputerUseFixture/Sources/OpenComputerUseFixture/main.swift:66","ref":"apps/OpenComputerUseFixture/Sources/OpenComputerUseFixture/main.swift","url":"https://github.com/iFurySt/open-computer-use/blob/e25be21caa0ea489316f6be6635d2a4766c4cd0b/apps/OpenComputerUseFixture/Sources/OpenComputerUseFixture/main.swift#L27","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: apps/OpenComputerUseLinux/main.go:10 and apps/OpenComputerUseWindows/main.go:12","ref":"apps/OpenComputerUseLinux/main.go","url":"https://github.com/iFurySt/open-computer-use/blob/e25be21caa0ea489316f6be6635d2a4766c4cd0b/apps/OpenComputerUseLinux/main.go#L10","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: apps/OpenComputerUseLinux/main.go:390 and apps/OpenComputerUseLinux/main.go:415","ref":"apps/OpenComputerUseLinux/main.go","url":"https://github.com/iFurySt/open-computer-use/blob/e25be21caa0ea489316f6be6635d2a4766c4cd0b/apps/OpenComputerUseLinux/main.go#L390","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: apps/OpenComputerUseLinux/runtime.py:970 and apps/OpenComputerUseLinux/runtime.py:984","ref":"apps/OpenComputerUseLinux/runtime.py","url":"https://github.com/iFurySt/open-computer-use/blob/e25be21caa0ea489316f6be6635d2a4766c4cd0b/apps/OpenComputerUseLinux/runtime.py#L970","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: apps/OpenComputerUseWindows/runtime.ps1:1747 and apps/OpenComputerUseWindows/runtime.ps1:1762","ref":"apps/OpenComputerUseWindows/runtime.ps1","url":"https://github.com/iFurySt/open-computer-use/blob/e25be21caa0ea489316f6be6635d2a4766c4cd0b/apps/OpenComputerUseWindows/runtime.ps1#L1747","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: experiments/CursorMotion/Sources/CursorMotion/CursorLabRootView.swift:254 and experiments/StandaloneCursor/Sources/StandaloneCursor/StandaloneCursorRootView.swift:459","ref":"experiments/CursorMotion/Sources/CursorMotion/CursorLabRootView.swift","url":"https://github.com/iFurySt/open-computer-use/blob/e25be21caa0ea489316f6be6635d2a4766c4cd0b/experiments/CursorMotion/Sources/CursorMotion/CursorLabRootView.swift#L254","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: experiments/CursorMotion/Sources/CursorMotion/CursorLabRootView.swift:579 and packages/OpenComputerUseKit/Sources/OpenComputerUseKit/SoftwareCursorGlyphRenderer.swift:6","ref":"experiments/CursorMotion/Sources/CursorMotion/CursorLabRootView.swift","url":"https://github.com/iFurySt/open-computer-use/blob/e25be21caa0ea489316f6be6635d2a4766c4cd0b/experiments/CursorMotion/Sources/CursorMotion/CursorLabRootView.swift#L579","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: experiments/CursorMotion/Sources/CursorMotion/CursorMotionApp.swift:39 and experiments/StandaloneCursor/Sources/StandaloneCursor/StandaloneCursorApp.swift:38","ref":"experiments/CursorMotion/Sources/CursorMotion/CursorMotionApp.swift","url":"https://github.com/iFurySt/open-computer-use/blob/e25be21caa0ea489316f6be6635d2a4766c4cd0b/experiments/CursorMotion/Sources/CursorMotion/CursorMotionApp.swift#L39","weight":0.3}],"data":{},"error":null},{"analyzer":"qual-lint","pillar":"quality","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":46.0,"weighted_findings":60.25,"scanned_lines":55776.0,"category:best-practice":16.0,"category:correctness":30.0},"findings":[{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"apps/OpenComputerUseLinux/runtime.py","line":700,"fingerprint":"python.lang.best-practice.arbitrary-sleep:apps/OpenComputerUseLinux/runtime.py:700"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"apps/OpenComputerUseLinux/runtime.py","line":702,"fingerprint":"python.lang.best-practice.arbitrary-sleep:apps/OpenComputerUseLinux/runtime.py:702"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"apps/OpenComputerUseLinux/runtime.py","line":713,"fingerprint":"python.lang.best-practice.arbitrary-sleep:apps/OpenComputerUseLinux/runtime.py:713"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"apps/OpenComputerUseLinux/runtime.py","line":921,"fingerprint":"python.lang.best-practice.arbitrary-sleep:apps/OpenComputerUseLinux/runtime.py:921"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"apps/OpenComputerUseLinux/runtime.py","line":1024,"fingerprint":"python.lang.best-practice.arbitrary-sleep:apps/OpenComputerUseLinux/runtime.py:1024"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"scripts/run-locked-use-native-validation.py","line":83,"fingerprint":"python.lang.best-practice.arbitrary-sleep:scripts/run-locked-use-native-validation.py:83"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"scripts/run-locked-use-native-validation.py","line":91,"fingerprint":"python.lang.best-practice.arbitrary-sleep:scripts/run-locked-use-native-validation.py:91"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"scripts/run-locked-use-native-validation.py","line":150,"fingerprint":"python.lang.best-practice.arbitrary-sleep:scripts/run-locked-use-native-validation.py:150"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"scripts/run-locked-use-native-validation.py","line":193,"fingerprint":"python.lang.best-practice.arbitrary-sleep:scripts/run-locked-use-native-validation.py:193"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"scripts/run-locked-use-rehearsal.py","line":29,"fingerprint":"python.lang.best-practice.arbitrary-sleep:scripts/run-locked-use-rehearsal.py:29"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"scripts/run-locked-use-smoke.py","line":68,"fingerprint":"python.lang.best-practice.arbitrary-sleep:scripts/run-locked-use-smoke.py:68"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"scripts/run-locked-use-smoke.py","line":78,"fingerprint":"python.lang.best-practice.arbitrary-sleep:scripts/run-locked-use-smoke.py:78"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"scripts/run-locked-use-smoke.py","line":92,"fingerprint":"python.lang.best-practice.arbitrary-sleep:scripts/run-locked-use-smoke.py:92"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"scripts/run-locked-use-unshielded-diagnostic.py","line":47,"fingerprint":"python.lang.best-practice.arbitrary-sleep:scripts/run-locked-use-unshielded-diagnostic.py:47"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"scripts/run-locked-use-unshielded-diagnostic.py","line":51,"fingerprint":"python.lang.best-practice.arbitrary-sleep:scripts/run-locked-use-unshielded-diagnostic.py:51"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"scripts/install-config-helper.mjs","line":326,"fingerprint":"javascript.lang.correctness.no-stringify-keys:scripts/install-config-helper.mjs:326"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"scripts/install-config-helper.mjs","line":347,"fingerprint":"javascript.lang.correctness.no-stringify-keys:scripts/install-config-helper.mjs:347"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"scripts/install-config-helper.mjs","line":491,"fingerprint":"javascript.lang.correctness.no-replaceall:scripts/install-config-helper.mjs:491"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"scripts/install-config-helper.mjs","line":491,"fingerprint":"javascript.lang.correctness.no-replaceall:scripts/install-config-helper.mjs:491"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"scripts/install-config-helper.mjs","line":496,"fingerprint":"javascript.lang.correctness.no-replaceall:scripts/install-config-helper.mjs:496"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"scripts/install-config-helper.mjs","line":496,"fingerprint":"javascript.lang.correctness.no-replaceall:scripts/install-config-helper.mjs:496"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"scripts/install-config-helper.mjs","line":496,"fingerprint":"javascript.lang.correctness.no-replaceall:scripts/install-config-helper.mjs:496"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"scripts/install-config-helper.mjs","line":496,"fingerprint":"javascript.lang.correctness.no-replaceall:scripts/install-config-helper.mjs:496"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"scripts/node-repl/open-computer-use-repl.mjs","line":83,"fingerprint":"javascript.lang.best-practice.lazy-load-module:scripts/node-repl/open-computer-use-repl.mjs:83"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"scripts/validate-github-release-notes.mjs","line":57,"fingerprint":"javascript.lang.correctness.no-replaceall:scripts/validate-github-release-notes.mjs:57"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/install-config-helper.mjs","line":672,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/install-config-helper.mjs:672"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/install-config-helper.mjs","line":672,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/install-config-helper.mjs:672"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/install-config-helper.mjs","line":694,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/install-config-helper.mjs:694"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/install-config-helper.mjs","line":694,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/install-config-helper.mjs:694"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/install-config-helper.mjs","line":694,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/install-config-helper.mjs:694"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/node-repl/open-computer-use-repl.mjs","line":26,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/node-repl/open-computer-use-repl.mjs:26"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/node-repl/open-computer-use-repl.mjs","line":26,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/node-repl/open-computer-use-repl.mjs:26"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/node-repl/open-computer-use-repl.mjs","line":34,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/node-repl/open-computer-use-repl.mjs:34"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/node-repl/open-computer-use-repl.mjs","line":34,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/node-repl/open-computer-use-repl.mjs:34"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/node-repl/open-computer-use-repl.mjs","line":196,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/node-repl/open-computer-use-repl.mjs:196"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/node-repl/open-computer-use-repl.mjs","line":196,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/node-repl/open-computer-use-repl.mjs:196"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/node-repl/open-computer-use-repl.mjs","line":206,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/node-repl/open-computer-use-repl.mjs:206"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/node-repl/open-computer-use-repl.mjs","line":206,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/node-repl/open-computer-use-repl.mjs:206"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/npm/build-packages.mjs","line":215,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/npm/build-packages.mjs:215"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/npm/build-packages.mjs","line":215,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/npm/build-packages.mjs:215"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/npm/build-packages.mjs","line":219,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/npm/build-packages.mjs:219"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/npm/build-packages.mjs","line":235,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/npm/build-packages.mjs:235"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/npm/build-packages.mjs","line":235,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/npm/build-packages.mjs:235"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/npm/build-packages.mjs","line":236,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/npm/build-packages.mjs:236"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/npm/build-packages.mjs","line":246,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/npm/build-packages.mjs:246"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/npm/build-packages.mjs","line":284,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/npm/build-packages.mjs:284"}],"evidence":[],"data":{},"error":null},{"analyzer":"qual-testing","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:has_tests":1.0,"check:test_ratio":0.3702,"check:ci_present":1.0,"check:ci_runs_tests":1.0,"check:ci_runs_lint":0.0,"check:tests_cochange":1.0,"test_lines":10781.0,"source_lines":58251.0,"test_ratio":0.1851,"ci_files":4.0,"cochange_share":0.3,"cochange_commits":250.0},"findings":[],"evidence":[{"kind":"ci","description":"CI config: .github/workflows/ci.yml","ref":".github/workflows/ci.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI config: .github/workflows/locked-use-distribution.yml","ref":".github/workflows/locked-use-distribution.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI config: .github/workflows/release.yml","ref":".github/workflows/release.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI config: .github/workflows/windows-observation.yml","ref":".github/workflows/windows-observation.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI runs tests (go test)","ref":null,"url":null,"weight":0.0}],"data":{"test_commands":["go test"],"lint_commands":[]},"error":null},{"analyzer":"qual-docs","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:readme":1.0,"check:license":1.0,"check:contributing":1.0,"check:changelog":0.0,"readme_lines":116.0},"findings":[],"evidence":[{"kind":"docs","description":"README.md","ref":"README.md","url":null,"weight":0.0},{"kind":"docs","description":"LICENSE","ref":"LICENSE","url":null,"weight":0.0},{"kind":"docs","description":"CONTRIBUTING.md","ref":"CONTRIBUTING.md","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"qual-type-safety","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:strict_config":0.0,"check:low_escape_density":0.0,"escapes":26.0,"escapes_per_kloc":5.865},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"x-blame","pillar":"ai_provenance","status":"ok","tool_version":"git-blame","metrics":{"ai_lines":4126.0,"other_lines":54125.0,"files_blamed":251.0,"blame_failures":0.0,"quality:ai_findings":3.0,"quality:ai_per_kloc":0.727,"quality:other_findings":43.0,"quality:other_per_kloc":0.794,"quality:ratio":0.92,"security:ai_findings":4.0,"security:ai_per_kloc":0.969,"security:other_findings":15.0,"security:other_per_kloc":0.277,"security:ratio":3.5},"findings":[],"evidence":[],"data":{"sampled":false,"comparable":true},"error":null}],"flags":[]}