QoderAI/better-harness
An open-source Harness Engineering platform for coding agents—define harnesses as code, run controlled experiments, inspect evidence, and compare outcomes. Turn task evidence into actionable team and organization insights.
phantom-dependency
- Repository: https://github.com/QoderAI/better-harness
- Commit:
c6240a808923630db9d6397ced789eab509f0f66 - Generated: 2026-11-14T00:14:07+00:00
- Scorer 0.1.0, scoring prov-4+qual-2+sec-2, report schema v2
Scores
Phantom dependency: a declared package does not exist on its public registry. If it isn't a private package, anyone could register that name and have their code installed (slopsquatting). See the security findings.
| Pillar | Score | Signal | Confidence | Coverage |
|---|---|---|---|---|
| AI provenance (estimated AI-generated share) | 42 | explicit | 95% | 100% |
| Code quality | 75 | adequate | 90% | 100% |
| Security | 39 | poor | 85% | 100% |
AI provenance
Explicit AI attribution on 42% of first-party code added; an estimated 42% including velocity signals.
- Explicitly attributed share (lower bound): 42.2%
- Unattributed share in AI-consistent velocity bursts: 12.1%
- Estimated AI-generated share: 42.2%
| AI tool | Attributed commits | Lines added |
|---|---|---|
| OpenAI Codex | 202 | 135,506 |
| Claude Code | 38 | 22,358 |
| GitHub Copilot coding agent | 1 | 268 |
- AI tooling configured in repo: claude-code, generic-agent
Current source lines last changed by AI-attributed commits: 87,115 of 226,503.
| Findings per 1,000 lines | AI-attributed | Other | Ratio |
|---|---|---|---|
| Quality | 1.297 | 0.624 | 2.08x |
| Security | 1.297 | 1.334 | 0.97x |
- Stylometry index: 0.07 per 1,000 lines (narrated steps 11, placeholders 0, assistant phrasing 1, emoji 8). Reported as a signal, not scored.
| Month | Lines added | Attributed to AI |
|---|---|---|
| 2026-07 | 114,609 | 6% |
| 2026-08 | 154,288 | 76% |
| 2026-09 | 104,632 | 32% |
| 2026-10 | 1,102 | 24% |
| 2026-11 | 84 | 0% |
Evidence
- OpenAI Codex: trailer 'Co-authored-by: Codex' (a7d77fb59e04)
- OpenAI Codex: trailer 'Co-authored-by: Codex' (0dd790b03aa0)
- Claude Code: trailer 'Co-Authored-By: Claude' (6a711e0c35a9)
- Claude Code: trailer 'Co-Authored-By: Claude' (eb7344b14dad)
- Claude Code: trailer 'Co-Authored-By: Claude' (c382a0f5af72)
- Claude Code: trailer 'Co-Authored-By: Claude' (63e663a231bc)
- Claude Code: trailer 'Co-Authored-By: Claude' (ddd9672852e8)
- Claude Code: trailer 'Co-Authored-By: Claude' (10c0b989b7d2)
- Claude Code: trailer 'Co-Authored-By: Claude' (88a370307a10)
- Claude Code: trailer 'Co-Authored-By: Claude' (daddbadff452)
- Claude Code: trailer 'Co-Authored-By: Claude' (f361661c6a9e)
- Claude Code: trailer 'Co-Authored-By: Claude' (d02f44c5397e)
- Claude Code: trailer 'Co-Authored-By: Claude' (a85b6bd095db)
- Claude Code: trailer 'Co-Authored-By: Claude' (e8e8d1be3cf7)
- Claude Code: trailer 'Co-Authored-By: Claude' (2d787f577cf3)
AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.
Code quality
Code quality is adequate: test-to-source ratio 0.47, CI runs tests; 28% of function code in complex or long functions; 6% duplicated lines. Weakest area: complexity.
| Area | Score |
|---|---|
| Complexity (lizard) | 42 |
| Duplication | 72 |
| Code smells (Opengrep) | 75 |
| Tests and CI | 88 |
| Documentation | 100 |
| Type safety | 100 |
| Process (Scorecard review/maintenance) | n/a |
- Functions: 16,913; mean complexity 3.8, 90th percentile 9; 618 complex and 139 long functions
- Duplicated lines: 5.5% of 171,974 compared
- Tests: 106,032 test lines for 226,503 source lines (ratio 0.47); CI test commands: npm run test, vitest; 85% of recent source commits also change tests
- Docs missing or thin: none
Most complex functions:
- validateTaskLoopFindings in scripts/harness-analysis/task-loop-report.mjs: complexity 417, 744 lines
- route in packages/harness-studio/src/server/server.ts: complexity 246, 528 lines
- evaluateTaskLoopCanvasQuality in scripts/harness-analysis/validate-canvas.mjs: complexity 223, 330 lines
- validateSequence in scripts/session-analysis/platforms/dsh.mjs: complexity 135, 212 lines
- summarizeSessionEvents in scripts/commit-session-link/session-source.mjs: complexity 128, 226 lines
Security
Security posture is poor: 199 known vulnerabilities in 64 dependencies; 32 high-severity SAST findings; 31 high-severity workflow issues. Weakest area: posture.
| Area | Score |
|---|---|
| Secrets (gitleaks, tree + history) | 72 |
| Static analysis (Opengrep) | 84 |
| Vulnerable dependencies (OSV) | 0 |
| CI workflows (zizmor) | 0 |
| Posture (policy, updates, signing, lockfiles) | 0 |
| OpenSSF Scorecard | n/a |
-
Known vulnerabilities: 199 in 64 packages (critical 10, high 48, medium 87, low 19)
-
Posture checks passed: none; missing: security policy, dependency updates, signed commits, lockfiles
Top findings
| Severity | Finding | Location |
|---|---|---|
| critical | osv/GHSA-jqcg-44mw-7w3h: proxy-addr@2.0.7 (npm) is affected by GHSA-jqcg-44mw-7w3h; also in package-lock.json |
docs/package-lock.json |
| critical | osv/GHSA-pqg4-j6r4-53mv: shell-quote@1.10.0 (npm) is affected by GHSA-pqg4-j6r4-53mv |
docs/package-lock.json |
| critical | osv/GHSA-5gmw-xhrv-c9v3: tinypool@1.1.1 (npm) is affected by GHSA-5gmw-xhrv-c9v3 |
docs/package-lock.json |
| critical | osv/GHSA-85c8-ppgw-ccpr: tinypool@1.1.1 (npm) is affected by GHSA-85c8-ppgw-ccpr |
docs/package-lock.json |
| critical | osv/GHSA-8r5x-fm3f-whwj: handlebars@4.7.9 (npm) is affected by GHSA-8r5x-fm3f-whwj |
package-lock.json |
| critical | osv/GHSA-p8wg-vrv2-v86f: handlebars@4.7.9 (npm) is affected by GHSA-p8wg-vrv2-v86f |
package-lock.json |
| critical | osv/GHSA-2464-fhr4-w9xw: next@16.3.6 (npm) is affected by GHSA-2464-fhr4-w9xw |
package-lock.json |
| critical | osv/GHSA-673q-mjm6-r5xr: next@16.3.6 (npm) is affected by GHSA-673q-mjm6-r5xr |
package-lock.json |
| critical | osv/RUSTSEC-2026-0327: wasmtime@48.0.1 (crates.io) is affected by RUSTSEC-2026-0327 |
packages/better-harness-desktop/rust/ontology-service/Cargo.lock |
| critical | osv/GHSA-mghf-wjfp-p5xm: wasmtime@48.0.1 (crates.io) is affected by RUSTSEC-2026-0379, GHSA-mghf-wjfp-p5xm |
packages/better-harness-desktop/rust/ontology-service/Cargo.lock |
| high | registry.missing-package: npm package '@homology/integration-harness-notebook-provider' does not exist on the public registry: a private package, a typo, or an invented (hallucinated) name that anyone could register |
packages/harness-studio/package.json |
| high | opengrep/javascript.browser.security.insecure-document-method: User controlled data in methods like innerHTML, outerHTML or document.write is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
packages/harness-studio-apps/apps/file-viewer/ui/entry.mjs:129 |
| high | opengrep/javascript.browser.security.insecure-innerhtml: User controlled data in a disclosure.innerHTML is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
packages/harness-studio-apps/apps/file-viewer/ui/entry.mjs:129 |
| high | opengrep/javascript.lang.security.audit.spawn-shell-true: Found '$SPAWN' with '{shell: !npmCli && process.platform === "win32"}'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use '{shell: false [confidence low] |
scripts/dsh-configured-assets/native-smoke.mjs:74 |
| high | opengrep/javascript.lang.security.audit.spawn-shell-true: Found '$SPAWN' with '{shell: !npmCli && process.platform === "win32"}'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use '{shell: false [confidence low] |
scripts/dsh-skill-discovery/native-smoke.mjs:52 |
| high | opengrep/javascript.browser.security.insecure-document-method: User controlled data in methods like innerHTML, outerHTML or document.write is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
scripts/harness-inspector/ui/workbench.js:1269 |
| high | opengrep/javascript.browser.security.insecure-innerhtml: User controlled data in a container.innerHTML is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
scripts/harness-inspector/ui/workbench.js:1269 |
| high | opengrep/javascript.browser.security.insecure-document-method: User controlled data in methods like innerHTML, outerHTML or document.write is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
scripts/harness-inspector/ui/workbench.js:1282 |
| high | opengrep/javascript.browser.security.insecure-innerhtml: User controlled data in a inspector.innerHTML is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
scripts/harness-inspector/ui/workbench.js:1282 |
| high | opengrep/javascript.browser.security.insecure-document-method: User controlled data in methods like innerHTML, outerHTML or document.write is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
scripts/harness-inspector/ui/workbench.js:1295 |
| high | opengrep/javascript.browser.security.insecure-innerhtml: User controlled data in a inspector.innerHTML is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
scripts/harness-inspector/ui/workbench.js:1295 |
| high | opengrep/javascript.browser.security.insecure-document-method: User controlled data in methods like innerHTML, outerHTML or document.write is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
scripts/harness-inspector/ui/workbench.js:1312 |
| high | opengrep/javascript.browser.security.insecure-document-method: User controlled data in methods like innerHTML, outerHTML or document.write is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
scripts/harness-inspector/ui/workbench.js:1324 |
| high | opengrep/javascript.browser.security.insecure-document-method: User controlled data in methods like innerHTML, outerHTML or document.write is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
scripts/harness-inspector/ui/workbench.js:1737 |
| high | opengrep/javascript.browser.security.insecure-innerhtml: User controlled data in a body.innerHTML is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
scripts/harness-inspector/ui/workbench.js:1737 |
Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.
Distribution signals
- binary-release-asset: release v0.7.0-alpha2 ships Harness.Studio-0.1.0-arm64-mac.zip (12 downloads)
- binary-release-asset: release v0.7.0-alpha2 ships Harness.Studio-0.1.0.AppImage (7 downloads)
- binary-release-asset: release v0.7.0-alpha2 ships Harness.Studio.Setup.0.1.0.exe (15 downloads)
Signals consistent with a repository that exists to distribute a download. They are heuristics, not a verdict; release files were not downloaded or inspected.
Dependency registry checks
154 declared packages checked: 1 not found on their registry, 0 first published in the last 30 days.
- missing-package: npm: @homology/integration-harness-notebook-provider (declared in packages/harness-studio/package.json)
A missing package may be private. If it isn't, the name is unclaimed and anyone could publish code under it.
Repository profile
- Source lines: 226,503; test lines: 106,032
| Language | Lines |
|---|---|
| JavaScript | 189,150 |
| TypeScript | 99,464 |
| Rust | 43,143 |
| Go | 433 |
| Objective-C | 231 |
| C | 114 |