wxtsky/CodeIsland
Real-time AI coding agent status panel in your MacBook notch — live status, approvals & replies for 30+ AI coding tools, with iPhone & Apple Watch companions
- Repository: https://github.com/wxtsky/CodeIsland
- Commit:
03c77e9457f0adc56fa036caf4925e4a576b453b - Generated: 2026-11-14T00:16:06+00:00
- Scorer 0.1.0, scoring prov-4+qual-2+sec-2, report schema v2
Scores
| Pillar | Score | Signal | Confidence | Coverage |
|---|---|---|---|---|
| AI provenance (estimated AI-generated share) | 78 | explicit | 95% | 100% |
| Code quality | 71 | adequate | 90% | 100% |
| Security | 58 | weak | 85% | 100% |
AI provenance
Explicit AI attribution on 78% of first-party code added; an estimated 78% including velocity signals.
- Explicitly attributed share (lower bound): 78.1%
- Unattributed share in AI-consistent velocity bursts: 0.0%
- Estimated AI-generated share: 78.1%
| AI tool | Attributed commits | Lines added |
|---|---|---|
| Claude Code | 605 | 136,768 |
| OpenAI Codex | 7 | 7,783 |
| GitHub Copilot coding agent | 2 | 4,626 |
Current source lines last changed by AI-attributed commits: 129,500 of 162,805.
| Findings per 1,000 lines | AI-attributed | Other | Ratio |
|---|---|---|---|
| Quality | 0.0 | 0.06 | 0.0x |
| Security | 0.201 | 0.0 | n/a |
- Stylometry index: 0.14 per 1,000 lines (narrated steps 3, placeholders 0, assistant phrasing 0, emoji 40). Reported as a signal, not scored.
| Month | Lines added | Attributed to AI |
|---|---|---|
| 2026-04 | 43,902 | 50% |
| 2026-05 | 5,711 | 50% |
| 2026-06 | 10,894 | 85% |
| 2026-07 | 12,181 | 60% |
| 2026-08 | 14,950 | 45% |
| 2026-09 | 44,069 | 95% |
| 2026-10 | 57,991 | 100% |
Evidence
- Claude Code: trailer 'Co-Authored-By: Claude' (03c77e9457f0)
- Claude Code: trailer 'Co-Authored-By: Claude' (cac776b269e4)
- Claude Code: trailer 'Co-Authored-By: Claude' (0d8995cf2d68)
- Claude Code: trailer 'Co-Authored-By: Claude' (e8ca01690607)
- Claude Code: trailer 'Co-Authored-By: Claude' (d5949b42fb61)
- Claude Code: trailer 'Co-Authored-By: Claude' (16c1c3aa5d00)
- Claude Code: trailer 'Co-Authored-By: Claude' (2bbdd13cd3d1)
- Claude Code: trailer 'Co-Authored-By: Claude' (6bfcb465523b)
- Claude Code: trailer 'Co-Authored-By: Claude' (e13097158af9)
- Claude Code: trailer 'Co-Authored-By: Claude' (b96495451c83)
- Claude Code: trailer 'Co-Authored-By: Claude' (3da88f2bc3c8)
- Claude Code: trailer 'Co-Authored-By: Claude' (814652509137)
- Claude Code: trailer 'Co-Authored-By: Claude' (c22e907dd166)
- Claude Code: trailer 'Co-Authored-By: Claude' (c360cfdb20b1)
- Claude Code: trailer 'Co-Authored-By: Claude' (a2d4850667e9)
AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.
Code quality
Code quality is adequate: test-to-source ratio 0.02, CI runs tests; 12% of function code in complex or long functions; 6% duplicated lines. Weakest area: type safety.
| Area | Score |
|---|---|
| Complexity (lizard) | 71 |
| Duplication | 68 |
| Code smells (Opengrep) | 100 |
| Tests and CI | 58 |
| Documentation | 85 |
| Type safety | 40 |
| Process (Scorecard review/maintenance) | n/a |
- Functions: 8,514; mean complexity 2.9, 90th percentile 6; 144 complex and 35 long functions
- Duplicated lines: 6.4% of 123,707 compared
- Tests: 2,521 test lines for 162,805 source lines (ratio 0.02); CI test commands: dotnet test; 5% of recent source commits also change tests
- Docs missing or thin: contributing
Most complex functions:
- applyHookEvent in Sources/CodeIslandCore/SessionSnapshot.swift: complexity 163, 434 lines
- mapEvent in Sources/CodeIsland/Resources/codeisland-opencode-remote.js: complexity 97, 173 lines
- mapEvent in Sources/CodeIsland/Resources/codeisland-opencode.js: complexity 94, 153 lines
- init in Sources/CodeIslandCore/HookIntake.swift: complexity 83, 194 lines
- extractMetadata in Sources/CodeIslandCore/SessionSnapshot.swift: complexity 77, 125 lines
Security
Security posture is weak: 2 high-severity SAST findings; 5 high-severity workflow issues. Weakest area: posture.
| Area | Score |
|---|---|
| Secrets (gitleaks, tree + history) | 63 |
| Static analysis (Opengrep) | 99 |
| Vulnerable dependencies (OSV) | n/a |
| CI workflows (zizmor) | 35 |
| Posture (policy, updates, signing, lockfiles) | 0 |
| OpenSSF Scorecard | n/a |
- Posture checks passed: none; missing: security policy, dependency updates, signed commits, lockfiles
Top findings
| Severity | Finding | Location |
|---|---|---|
| high | opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query: Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition [confidence low] |
Sources/CodeIsland/Resources/codeisland-remote-hook.py:390 |
| high | opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query: Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition [confidence low] |
Sources/CodeIsland/Resources/codeisland-remote-hook.py:408 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/build-macos-arm-dmg.yml:28 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/build-macos-arm-dmg.yml:160 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/windows.yml:20 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/windows.yml:21 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/windows.yml:49 |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename: Detected that function argument path has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low] |
Sources/CodeIsland/Resources/codeisland-opencode-remote.js:49 |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename: Detected that function argument path has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low] |
Sources/CodeIsland/Resources/codeisland-opencode.js:37 |
| medium | opengrep/python.lang.security.audit.formatted-sql-query: Detected possible formatted SQL query. Use parameterized queries instead. [confidence low] |
Sources/CodeIsland/Resources/codeisland-remote-hook.py:390 |
| medium | opengrep/swift.sqllite.swift-potential-sqlite-injection: Potential Client-side SQL injection which has different impacts depending on the SQL use-case. The impact may include the circumvention of local authentication mechanisms, obtaining of sensitive data from the app, or manipulation of client-side behavior. It wasn't possible to make certain that the s [confidence low] |
Sources/CodeIslandCore/WarpPaneResolver.swift:166 |
| medium | opengrep/swift.lang.crypto.insecure-random: A random number generator was detected which is not guaranteed to be Cryptographically secure. If the source of entropy is used for security purposes (e.g. with other Cryptographic operations), make sure to use the SecCopyRandomBytes API explicitly. [confidence low] |
Tests/CodeIslandCoreTests/MarkdownBlockParserTests.swift:435 |
| medium | opengrep/swift.sqllite.swift-potential-sqlite-injection: Potential Client-side SQL injection which has different impacts depending on the SQL use-case. The impact may include the circumvention of local authentication mechanisms, obtaining of sensitive data from the app, or manipulation of client-side behavior. It wasn't possible to make certain that the s [confidence low] |
Tests/CodeIslandTests/GrokSupportTests.swift:403 |
| medium | opengrep/swift.sqllite.swift-potential-sqlite-injection: Potential Client-side SQL injection which has different impacts depending on the SQL use-case. The impact may include the circumvention of local authentication mechanisms, obtaining of sensitive data from the app, or manipulation of client-side behavior. It wasn't possible to make certain that the s [confidence low] |
Tests/CodeIslandTests/HermesTurnSettleTests.swift:251 |
| medium | opengrep/swift.lang.crypto.insecure-random: A random number generator was detected which is not guaranteed to be Cryptographically secure. If the source of entropy is used for security purposes (e.g. with other Cryptographic operations), make sure to use the SecCopyRandomBytes API explicitly. [confidence low] |
Tests/CodeIslandTests/RemoteSocketFolderTests.swift:138 |
| medium | opengrep/swift.sqllite.swift-potential-sqlite-injection: Potential Client-side SQL injection which has different impacts depending on the SQL use-case. The impact may include the circumvention of local authentication mechanisms, obtaining of sensitive data from the app, or manipulation of client-side behavior. It wasn't possible to make certain that the s [confidence low] |
Tests/CodeIslandTests/SQLiteReaderClosedWALTests.swift:33 |
| medium | opengrep/swift.sqllite.swift-potential-sqlite-injection: Potential Client-side SQL injection which has different impacts depending on the SQL use-case. The impact may include the circumvention of local authentication mechanisms, obtaining of sensitive data from the app, or manipulation of client-side behavior. It wasn't possible to make certain that the s [confidence low] |
Tests/CodeIslandTests/T3CodeHarnessSupportTests.swift:62 |
| medium | zizmor/artipacked: credential persistence through GitHub Actions artifacts [confidence low] |
.github/workflows/build-macos-arm-dmg.yml:27 |
| medium | zizmor/artipacked: credential persistence through GitHub Actions artifacts [confidence low] |
.github/workflows/windows.yml:20 |
| low | gitleaks/curl-auth-header: Possible curl-auth-header secret in the current tree (test/docs/example file) |
Tests/CodeIslandCoreTests/CodexRichStatusTests.swift:51 |
| low | gitleaks/generic-api-key: Possible generic-api-key secret in the current tree (test/docs/example file) |
Tests/CodeIslandCoreTests/CodexRichStatusTests.swift:78 |
| low | gitleaks/github-pat: Possible github-pat secret in the current tree (test/docs/example file) |
Tests/CodeIslandCoreTests/CodexRichStatusTests.swift:77 |
| low | gitleaks/generic-api-key: Possible generic-api-key secret in the current tree (test/docs/example file) |
Tests/CodeIslandCoreTests/PushSigningAndResponseTests.swift:13 |
| low | gitleaks/generic-api-key: Possible generic-api-key secret in the current tree (test/docs/example file) |
Tests/CodeIslandCoreTests/PushChannelPayloadTests.swift:196 |
| low | gitleaks/curl-auth-header: Possible curl-auth-header secret in the current tree (test/docs/example file) |
Tests/CodeIslandCoreTests/PushPolicyTests.swift:241 |
Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.
Distribution signals
- binary-release-asset: release v1.0.41 ships CodeIsland.dmg (2884 downloads)
- binary-release-asset: release v1.0.40 ships CodeIsland.dmg (1632 downloads)
- binary-release-asset: release v1.0.39 ships CodeIsland.dmg (908 downloads)
- binary-release-asset: release v1.0.38 ships CodeIsland.dmg (2526 downloads)
- binary-release-asset: release v1.0.37 ships CodeIsland.dmg (30 downloads)
Signals consistent with a repository that exists to distribute a download. They are heuristics, not a verdict; release files were not downloaded or inspected.
Repository profile
- Source lines: 162,805; test lines: 2,521
| Language | Lines |
|---|---|
| Swift | 146,965 |
| TypeScript | 4,687 |
| C# | 4,562 |
| Kotlin | 3,573 |
| C | 1,806 |
| JavaScript | 1,443 |
| Shell | 1,385 |
| Python | 721 |
| PowerShell | 184 |