cytostack/openwolf
Portable project memory across Claude Code, Codex and OpenCode, plus token accounting measured from harness transcripts. Local file I/O, no API calls, no telemetry.
- Repository: https://github.com/cytostack/openwolf
- Commit:
8568f41aa8a985a496314c3ea313ff1ee2b66483 - Generated: 2026-11-14T00:05:06+00:00
- Scorer 0.1.0, scoring prov-4+qual-2+sec-2, report schema v2
Scores
| Pillar | Score | Signal | Confidence | Coverage |
|---|---|---|---|---|
| AI provenance (estimated AI-generated share) | 25 | explicit | 95% | 100% |
| Code quality | 63 | weak | 90% | 100% |
| Security | 65 | weak | 85% | 100% |
AI provenance
Explicit AI attribution on 25% of first-party code added; an estimated 25% including velocity signals.
- Explicitly attributed share (lower bound): 25.2%
- Unattributed share in AI-consistent velocity bursts: 20.3%
- Estimated AI-generated share: 25.2%
| AI tool | Attributed commits | Lines added |
|---|---|---|
| Claude Code | 40 | 9,704 |
Current source lines last changed by AI-attributed commits: 6,462 of 26,940.
| Findings per 1,000 lines | AI-attributed | Other | Ratio |
|---|---|---|---|
| Quality | 0.155 | 0.635 | 0.24x |
| Security | 0.464 | 0.586 | 0.79x |
- Stylometry index: 0.28 per 1,000 lines (narrated steps 0, placeholders 0, assistant phrasing 0, emoji 15). Reported as a signal, not scored.
| Month | Lines added | Attributed to AI |
|---|---|---|
| 2026-03 | 10,453 | 0% |
| 2026-04 | 210 | 100% |
| 2026-05 | 171 | 67% |
| 2026-06 | 76 | 18% |
| 2026-07 | 4,549 | 1% |
| 2026-08 | 12,078 | 77% |
| 2026-09 | 4,560 | 0% |
| 2026-10 | 6,458 | 0% |
Evidence
- Claude Code: trailer 'Co-Authored-By: Claude' (12c21b593b31)
- Claude Code: trailer 'Co-Authored-By: Claude' (4b06864d023f)
- Claude Code: trailer 'Co-Authored-By: Claude' (16d63bb99cbd)
- Claude Code: trailer 'Co-Authored-By: Claude' (9c8fba46f674)
- Claude Code: trailer 'Co-Authored-By: Claude' (c8acf0a03384)
- Claude Code: trailer 'Co-Authored-By: Claude' (97c68003e274)
- Claude Code: trailer 'Co-Authored-By: Claude' (b925a011fbb8)
- Claude Code: trailer 'Co-Authored-By: Claude' (610c744167ac)
- Claude Code: trailer 'Co-Authored-By: Claude' (7defd81b9faa)
- Claude Code: trailer 'Co-Authored-By: Claude' (8c8d769782ea)
- Claude Code: trailer 'Co-Authored-By: Claude' (bba4e682baba)
- Claude Code: trailer 'Co-Authored-By: Claude' (1903334e667b)
- Claude Code: trailer 'Co-Authored-By: Claude' (fb95439b0a78)
- Claude Code: trailer 'Co-Authored-By: Claude' (20e06721bc11)
- Claude Code: trailer 'Co-Authored-By: Claude' (7769e5ed55bf)
AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.
Code quality
Code quality is weak: test-to-source ratio 0.19, CI runs tests; 34% of function code in complex or long functions; 34% duplicated lines. Weakest area: duplication.
| Area | Score |
|---|---|
| Complexity (lizard) | 36 |
| Duplication | 13 |
| Code smells (Opengrep) | 92 |
| Tests and CI | 75 |
| Documentation | 100 |
| Type safety | 100 |
| Process (Scorecard review/maintenance) | n/a |
- Functions: 1,929; mean complexity 4.4, 90th percentile 10; 101 complex and 12 long functions
- Duplicated lines: 33.8% of 19,962 compared
- Tests: 5,233 test lines for 26,940 source lines (ratio 0.19); CI test commands: npm test, pnpm test; 38% of recent source commits also change tests
- Docs missing or thin: none
Most complex functions:
- extractDescription in src/hooks/shared.ts: complexity 276, 368 lines
- extractDescription in src/templates/opencode-plugin/shared.ts: complexity 276, 368 lines
- collectUsage in src/tracker/usage.ts: complexity 93, 115 lines
- detectFixPattern in src/hooks/post-write.ts: complexity 62, 169 lines
- updateProject in src/cli/update.ts: complexity 58, 200 lines
Security
Security posture is weak: 45 known vulnerabilities in 19 dependencies; 2 high-severity workflow issues. Weakest area: posture.
| Area | Score |
|---|---|
| Secrets (gitleaks, tree + history) | 100 |
| Static analysis (Opengrep) | 96 |
| Vulnerable dependencies (OSV) | 11 |
| CI workflows (zizmor) | 84 |
| Posture (policy, updates, signing, lockfiles) | 0 |
| OpenSSF Scorecard | n/a |
-
Known vulnerabilities: 45 in 19 packages (critical 1, high 21, medium 20, low 3)
-
Posture checks passed: lockfiles; missing: security policy, dependency updates, signed commits
Top findings
| Severity | Finding | Location |
|---|---|---|
| critical | osv/GHSA-jqcg-44mw-7w3h: proxy-addr@2.0.7 (npm) is affected by GHSA-jqcg-44mw-7w3h |
pnpm-lock.yaml |
| high | osv/GHSA-g2v6-rqmx-r4w6: @vue/server-renderer@3.5.30 (npm) is affected by GHSA-g2v6-rqmx-r4w6 |
docs/package-lock.json |
| high | osv/GHSA-28wg-ghj8-5hjv: nanoid@3.3.11 (npm) is affected by GHSA-28wg-ghj8-5hjv; also in pnpm-lock.yaml |
docs/package-lock.json |
| high | osv/GHSA-2v37-7h3g-55p8: nanoid@3.3.11 (npm) is affected by GHSA-2v37-7h3g-55p8; also in pnpm-lock.yaml |
docs/package-lock.json |
| high | osv/GHSA-xwg4-73v4-xw9w: nanoid@3.3.11 (npm) is affected by GHSA-xwg4-73v4-xw9w; also in pnpm-lock.yaml |
docs/package-lock.json |
| high | osv/GHSA-6g55-p6wh-862q: postcss@8.5.8 (npm) is affected by GHSA-6g55-p6wh-862q; also in pnpm-lock.yaml |
docs/package-lock.json |
| high | osv/GHSA-r28c-9q8g-f849: postcss@8.5.8 (npm) is affected by GHSA-r28c-9q8g-f849; also in pnpm-lock.yaml |
docs/package-lock.json |
| high | osv/GHSA-68fv-2mgg-jv7q: source-map-js@1.2.1 (npm) is affected by GHSA-68fv-2mgg-jv7q; also in pnpm-lock.yaml |
docs/package-lock.json |
| high | osv/GHSA-587h-7wmj-h5pm: vite@5.4.21 (npm) is affected by GHSA-587h-7wmj-h5pm; also in pnpm-lock.yaml |
docs/package-lock.json |
| high | osv/GHSA-g2v6-rqmx-r4w6: @vue/server-renderer@3.5.29 (npm) is affected by GHSA-g2v6-rqmx-r4w6 |
pnpm-lock.yaml |
| high | osv/GHSA-27r3-jxmh-p828: body-parser@2.3.0 (npm) is affected by GHSA-27r3-jxmh-p828 |
pnpm-lock.yaml |
| high | osv/GHSA-73wf-gq98-2v4g: browserslist@4.28.1 (npm) is affected by GHSA-73wf-gq98-2v4g |
pnpm-lock.yaml |
| high | osv/GHSA-c83g-rgw3-j3cx: browserslist@4.28.1 (npm) is affected by GHSA-c83g-rgw3-j3cx |
pnpm-lock.yaml |
| high | osv/GHSA-r5fr-rjxr-66jc: lodash@4.17.23 (npm) is affected by GHSA-r5fr-rjxr-66jc |
pnpm-lock.yaml |
| high | osv/GHSA-c2c7-rcm5-vvqj: picomatch@4.0.3 (npm) is affected by GHSA-c2c7-rcm5-vvqj |
pnpm-lock.yaml |
| high | osv/GHSA-4qx8-w7c3-pj3p: toml@4.3.0 (npm) is affected by GHSA-4qx8-w7c3-pj3p |
pnpm-lock.yaml |
| high | osv/GHSA-9j65-hcg3-gc64: toml@4.3.0 (npm) is affected by GHSA-9j65-hcg3-gc64 |
pnpm-lock.yaml |
| high | osv/GHSA-9qmh-m7c6-f92p: toml@4.3.0 (npm) is affected by GHSA-9qmh-m7c6-f92p |
pnpm-lock.yaml |
| high | osv/GHSA-h895-cgqg-jf52: toml@4.3.0 (npm) is affected by GHSA-h895-cgqg-jf52 |
pnpm-lock.yaml |
| high | osv/GHSA-587h-7wmj-h5pm: vite@6.4.1 (npm) is affected by GHSA-587h-7wmj-h5pm |
pnpm-lock.yaml |
| high | osv/GHSA-p9ff-h696-f583: vite@6.4.1 (npm) is affected by GHSA-p9ff-h696-f583 |
pnpm-lock.yaml |
| high | osv/GHSA-mrhx-c7xc-m3w5: zod@4.1.8 (npm) is affected by GHSA-mrhx-c7xc-m3w5 |
pnpm-lock.yaml |
| high | zizmor/cache-poisoning: runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low] |
.github/workflows/validate.yml:21 |
| high | zizmor/cache-poisoning: runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low] |
.github/workflows/validate.yml:36 |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-regexp: RegExp() called with a body function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled [confidence low] |
src/hooks/ignore-runtime.ts:150 |
Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.
Distribution signals
- binary-release-asset: release v2.5.3 ships openwolf-2.5.3.tgz (9 downloads)
- binary-release-asset: release v2.5.2 ships openwolf-2.5.2.tgz (12 downloads)
Signals consistent with a repository that exists to distribute a download. They are heuristics, not a verdict; release files were not downloaded or inspected.
Repository profile
- Source lines: 26,940; test lines: 5,233
| Language | Lines |
|---|---|
| TypeScript | 31,583 |
| JavaScript | 370 |
| Vue | 151 |
| Python | 69 |