bestruirui/octopus

• Repository: https://github.com/bestruirui/octopus
• Commit: 8aa58b0340ba2de58ce74fbfacd32597c44842a2
• Generated: 2026-11-14T00:02:13+00:00
• Scorer 0.1.0, scoring prov-4+qual-2+sec-2, report schema v2

Scores

AI provenance

Explicit AI attribution on 1% of first-party code added; an estimated 1% including velocity signals.

• Explicitly attributed share (lower bound): 1.0%
• Unattributed share in AI-consistent velocity bursts: 25.3%
• Estimated AI-generated share: 1.0%

Current source lines last changed by AI-attributed commits: 0 of 22,613.

Too few lines in one group to compare finding densities.

• Stylometry index: 0.02 per 1,000 lines (narrated steps 0, placeholders 0, assistant phrasing 0, emoji 1). Reported as a signal, not scored.

Evidence

• Claude Code: trailer 'Co-authored-by: Claude' (94e643e9c774)
• Claude Code: trailer 'Co-Authored-By: Claude' (32b0a1796ce6)
• GitHub Copilot coding agent: trailer 'Co-authored-by: Copilot' (f66e8f85f814)
• 1,483 lines of first-party code in ~1.1h (1,393 lines/hour, 1 commit session) (55873f7fe106)
• 3,912 lines of first-party code in ~4.2h (941 lines/hour, 2 commit session) (f07b8dc026a0)
• 1,343 lines of first-party code in ~1.6h (819 lines/hour, 3 commit session) (ce445d179e9a)
• 3,144 lines of first-party code in ~4.0h (786 lines/hour, 1 commit session) (520ba5241149)
• 2,522 lines of first-party code in ~4.1h (616 lines/hour, 2 commit session) (d0eb759548c8)
• 2,149 lines of first-party code in ~4.0h (537 lines/hour, 1 commit session) (fd8fee2a708f)
• 2,071 lines of first-party code in ~4.0h (518 lines/hour, 1 commit session) (19aa05988675)

AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.

Code quality

Code quality is weak: test-to-source ratio 0.00, no CI test run detected; 21% of function code in complex or long functions; 2% duplicated lines. Weakest area: testing.

• Functions: 1,398; mean complexity 2.8, 90th percentile 6; 26 complex and 15 long functions
• Duplicated lines: 2.0% of 16,238 compared
• Tests: 0 test lines for 22,613 source lines (ratio 0.00); CI test commands: none detected; 1% of recent source commits also change tests
• Docs missing or thin: changelog

Most complex functions:

• sendPassthroughStream in internal/relay/upstream.go: complexity 77, 129 lines
• anonymous__0 in internal/relay/handler.go: complexity 59, 255 lines
• LogDetail in web/src/components/modules/log/Item.tsx: complexity 58, 177 lines
• anonymous__0 in internal/db/migrate/008.go: complexity 42, 144 lines
• inspectStreamEvent in internal/relay/protocol.go: complexity 38, 84 lines

Security

Security posture is weak: 22 known vulnerabilities in 9 dependencies; 3 high-severity SAST findings; 24 high-severity workflow issues. Weakest area: posture.

• Known vulnerabilities: 22 in 9 packages (critical 0, high 5, medium 7, low 1)

• Posture checks passed: lockfiles; missing: security policy, dependency updates, signed commits

Top findings

Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.

Distribution signals

• binary-release-asset: release v0.13.13 ships octopus-android-386.zip (15 downloads)
• binary-release-asset: release v0.13.13 ships octopus-android-amd64.zip (16 downloads)
• binary-release-asset: release v0.13.13 ships octopus-android-arm.zip (15 downloads)
• binary-release-asset: release v0.13.13 ships octopus-android-arm64.zip (20 downloads)
• binary-release-asset: release v0.13.13 ships octopus-darwin-amd64.zip (65 downloads)

Signals consistent with a repository that exists to distribute a download. They are heuristics, not a verdict; release files were not downloaded or inspected.

Repository profile

• Source lines: 22,613; test lines: 0