The loop never sleeps — you finally can. Agents automate the entire development lifecycle (write, review, merge, learn) end to end, with a published safety record. Self-host today; rentable hosted loops in development. Any GitHub repo; Gittensor-native intelligence built in.
Drift inferred · capture-to-capture
No drift recorded — single capability capture; advisories appear once its surface changes.
transport stdio · streamable-http · http counts 0 tools · 0 res
· 0 prompts
permission surface via code analysis
No tools enumerated yet for this server.
prompt-surface
shipped agent-instruction files + hidden-content / dangerous-code findings —
quoted from the analyzed source
analyzed commit f665d94 · analyzer v33 · 1d ago
skills & prompt files 3
danger signals49
- dynamic code execution eval() JSONbored-loopover-f665d94/test/unit/selfhost-redis-cache.test.ts :41
async eval(script: string, _numkeys: number, k: string, expected: string, ttl?: string) { - dynamic code execution eval() JSONbored-loopover-f665d94/test/unit/selfhost-redis-ratelimit.test.ts :20
async eval(_script: string, _numKeys: number, key: string, windowMs: string) { - suspicious endpoint us.i.posthog.com (telemetry)
expected for this server's purpose
JSONbored-loopover-f665d94/apps/loopover-ui/src/lib/analytics-proxy.test.ts :9
const API = "https://us.i.posthog.com"; - suspicious endpoint us-assets.i.posthog.com (telemetry)
expected for this server's purpose
JSONbored-loopover-f665d94/apps/loopover-ui/src/lib/analytics-proxy.test.ts :10
const ASSETS = "https://us-assets.i.posthog.com"; - suspicious endpoint us.i.posthog.com (telemetry)
expected for this server's purpose
JSONbored-loopover-f665d94/apps/loopover-ui/src/lib/analytics-proxy.ts :39
const POSTHOG_API_HOST = "https://us.i.posthog.com"; - suspicious endpoint us-assets.i.posthog.com (telemetry)
expected for this server's purpose
JSONbored-loopover-f665d94/apps/loopover-ui/src/lib/analytics-proxy.ts :40
const POSTHOG_ASSET_HOST = "https://us-assets.i.posthog.com"; - suspicious endpoint us.posthog.com (telemetry)
expected for this server's purpose
JSONbored-loopover-f665d94/apps/loopover-ui/src/lib/analytics.test.ts :83
expect(config.ui_host).toBe("https://us.posthog.com"); - suspicious endpoint us.i.posthog.com (telemetry)
expected for this server's purpose
JSONbored-loopover-f665d94/apps/loopover-ui/src/lib/analytics.test.ts :100
vi.stubEnv("VITE_POSTHOG_HOST", "https://us.i.posthog.com"); - suspicious endpoint eu.posthog.com (telemetry)
expected for this server's purpose
JSONbored-loopover-f665d94/apps/loopover-ui/src/lib/analytics.test.ts :110
vi.stubEnv("VITE_POSTHOG_UI_HOST", "https://eu.posthog.com"); - suspicious endpoint us.posthog.com (telemetry)
expected for this server's purpose
JSONbored-loopover-f665d94/apps/loopover-ui/src/lib/analytics.ts :81
return (import.meta.env?.VITE_POSTHOG_UI_HOST as string | undefined) || "https://us.posthog.com"; - suspicious endpoint us.posthog.com (telemetry)
expected for this server's purpose
JSONbored-loopover-f665d94/packages/discovery-index/scripts/validate-posthog-release.ts :10
const DEFAULT_POSTHOG_APP_HOST = "https://us.posthog.com"; - suspicious endpoint us.i.posthog.com (telemetry)
expected for this server's purpose
JSONbored-loopover-f665d94/packages/discovery-index/src/posthog.ts :27
const DEFAULT_POSTHOG_HOST = "https://us.i.posthog.com"; - suspicious endpoint us.i.posthog.com (telemetry)
expected for this server's purpose
JSONbored-loopover-f665d94/packages/loopover-mcp/lib/telemetry.ts :30
const DEFAULT_POSTHOG_HOST = "https://us.i.posthog.com"; - suspicious endpoint us.i.posthog.com (telemetry)
expected for this server's purpose
JSONbored-loopover-f665d94/packages/loopover-miner/lib/posthog.ts :26
const DEFAULT_POSTHOG_HOST = "https://us.i.posthog.com"; - suspicious endpoint us.posthog.com (telemetry)
expected for this server's purpose
JSONbored-loopover-f665d94/review-enrichment/scripts/validate-posthog-release.ts :9
const DEFAULT_POSTHOG_APP_HOST = "https://us.posthog.com"; - suspicious endpoint us.i.posthog.com (telemetry)
expected for this server's purpose
JSONbored-loopover-f665d94/review-enrichment/src/posthog.ts :27
const DEFAULT_POSTHOG_HOST = "https://us.i.posthog.com"; - suspicious endpoint eu.i.posthog.com (telemetry)
expected for this server's purpose
JSONbored-loopover-f665d94/review-enrichment/test/posthog-degradation.test.ts :287
const activated = await initReesPostHog({ POSTHOG_API_KEY: "phc_test", POSTHOG_HOST: "https://eu.i.posthog.com" } as NodeJS.ProcessEnv); - suspicious endpoint us.posthog.com (telemetry)
expected for this server's purpose
JSONbored-loopover-f665d94/review-enrichment/test/posthog-release-validation.test.ts :37
baseUrl: "https://us.posthog.com", - suspicious endpoint eu.posthog.com (telemetry)
expected for this server's purpose
JSONbored-loopover-f665d94/review-enrichment/test/posthog-release-validation.test.ts :43
const config = loadPostHogReleaseValidationConfig({ POSTHOG_CLI_HOST: "https://eu.posthog.com/" }); - suspicious endpoint discord.com JSONbored-loopover-f665d94/review-enrichment/test/secret-scan.test.ts :1408
["discord_webhook_url", "https://discord.com/api/webhooks/123456789012345678/" + b62(69) + "-"], - suspicious endpoint us.i.posthog.com (telemetry)
expected for this server's purpose
JSONbored-loopover-f665d94/src/api/worker-posthog.ts :27
const DEFAULT_POSTHOG_HOST = "https://us.i.posthog.com"; - suspicious endpoint us.i.posthog.com (telemetry)
expected for this server's purpose
JSONbored-loopover-f665d94/src/mcp/dispatch-telemetry-sink.ts :32
const DEFAULT_POSTHOG_HOST = "https://us.i.posthog.com"; - suspicious endpoint us.i.posthog.com (telemetry)
expected for this server's purpose
JSONbored-loopover-f665d94/src/mcp/telemetry.ts :21
const DEFAULT_POSTHOG_HOST = "https://us.i.posthog.com"; - suspicious endpoint us.i.posthog.com (telemetry)
expected for this server's purpose
JSONbored-loopover-f665d94/src/selfhost/otel.ts :36
const DEFAULT_POSTHOG_OTEL_HOST = "https://us.i.posthog.com"; - suspicious endpoint us.i.posthog.com (telemetry)
expected for this server's purpose
JSONbored-loopover-f665d94/src/selfhost/posthog.ts :69
const DEFAULT_POSTHOG_HOST = "https://us.i.posthog.com"; - suspicious endpoint discord.com JSONbored-loopover-f665d94/test/unit/alerts.test.ts :205
const WEBHOOK = "https://discord.com/api/webhooks/123/abc"; - suspicious endpoint us.i.posthog.com (telemetry)
expected for this server's purpose
JSONbored-loopover-f665d94/test/unit/analytics-proxy.test.ts :17
const API = "https://us.i.posthog.com"; - suspicious endpoint us-assets.i.posthog.com (telemetry)
expected for this server's purpose
JSONbored-loopover-f665d94/test/unit/analytics-proxy.test.ts :18
const ASSETS = "https://us-assets.i.posthog.com"; - suspicious endpoint 169.254.169.254 (cloud metadata) JSONbored-loopover-f665d94/test/unit/content-lane-safe-url.test.ts :22
expect(isSafeHttpUrl("https://169.254.169.254")).toBe(false); // cloud metadata - suspicious endpoint 100.63.255.255 JSONbored-loopover-f665d94/test/unit/content-lane-safe-url.test.ts :34
expect(isSafeHttpUrl("https://100.63.255.255")).toBe(true); // one below the range - suspicious endpoint 100.128.0.0 JSONbored-loopover-f665d94/test/unit/content-lane-safe-url.test.ts :35
expect(isSafeHttpUrl("https://100.128.0.0")).toBe(true); // one above the range - suspicious endpoint 8.8.8.8 JSONbored-loopover-f665d94/test/unit/content-lane-safe-url.test.ts :106
expect(isSafeHttpUrl("https://8.8.8.8")).toBe(true); - suspicious endpoint 1.1.1.1 JSONbored-loopover-f665d94/test/unit/content-lane-safe-url.test.ts :107
expect(isSafeHttpUrl("https://1.1.1.1")).toBe(true); - suspicious endpoint 172.15.0.1 JSONbored-loopover-f665d94/test/unit/content-lane-safe-url.test.ts :109
expect(isSafeHttpUrl("https://172.15.0.1")).toBe(true); - suspicious endpoint 172.32.0.1 JSONbored-loopover-f665d94/test/unit/content-lane-safe-url.test.ts :110
expect(isSafeHttpUrl("https://172.32.0.1")).toBe(true); - suspicious endpoint us.i.posthog.com (telemetry)
expected for this server's purpose
JSONbored-loopover-f665d94/test/unit/discovery-index/posthog.test.ts :118
expect(capturedOptions?.host).toBe("https://us.i.posthog.com"); - suspicious endpoint eu.i.posthog.com (telemetry)
expected for this server's purpose
JSONbored-loopover-f665d94/test/unit/discovery-index/posthog.test.ts :141
await initFresh({ POSTHOG_API_KEY: "phc_test", POSTHOG_HOST: "https://eu.i.posthog.com" } as unknown as NodeJS.ProcessEnv); - suspicious endpoint us.posthog.com (telemetry)
expected for this server's purpose
JSONbored-loopover-f665d94/test/unit/discovery-index/validate-posthog-release.test.ts :22
expect(config).toEqual({ apiKey: "phx_test", projectId: "42", release: "loopover-discovery-index@abc", baseUrl: "https://us.posthog.com" }); - suspicious endpoint eu.posthog.com (telemetry)
expected for this server's purpose
JSONbored-loopover-f665d94/test/unit/discovery-index/validate-posthog-release.test.ts :26
const config = loadPostHogReleaseValidationConfig({ POSTHOG_CLI_HOST: "https://eu.posthog.com/" }); - suspicious endpoint discord.com JSONbored-loopover-f665d94/test/unit/loop-escalation-wire.test.ts :29
expect(isValidDiscordWebhook("http://discord.com/api/webhooks/123/abc")).toBe(false); // not https - suspicious endpoint discord.com JSONbored-loopover-f665d94/test/unit/maintainer-recap-wire.test.ts :12
const HOOK = "https://discord.com/api/webhooks/123/abc"; - suspicious endpoint discord.com JSONbored-loopover-f665d94/test/unit/maintainer-recap.test.ts :20
const DISCORD_HOOK = "https://discord.com/api/webhooks/123/abc"; - committed secret private key JSONbored-loopover-f665d94/test/fixtures/verify-attested-run/synthetic-vcek-key.pem :1
PEM private key block (redacted) - committed secret GitHub token JSONbored-loopover-f665d94/test/unit/mcp-release-candidate.test.ts :115
ghp_AA…(40 chars, redacted) - committed secret GitHub fine-grained PAT JSONbored-loopover-f665d94/test/unit/mcp-release-candidate.test.ts :191
github…(40 chars, redacted) - committed secret Anthropic key JSONbored-loopover-f665d94/test/unit/miner-status.test.ts :570
sk-ant…(36 chars, redacted) - committed secret Anthropic key JSONbored-loopover-f665d94/test/unit/provider-credentials.test.ts :13
sk-ant…(35 chars, redacted) - committed secret GitHub fine-grained PAT JSONbored-loopover-f665d94/test/unit/secrets-scan.test.ts :17
github…(47 chars, redacted) - committed secret Anthropic key JSONbored-loopover-f665d94/test/unit/selfhost-ai.test.ts :2609
sk-ant…(37 chars, redacted)
evidence-backed
findings quoted directly from the published source artifact — not inferred
code files: 3277
filesystem 241
- fs JSONbored-loopover-f665d94/apps/loopover-miner-ui/vite-attempt-log-api.ts :1
import { existsSync } from "node:fs"; - fs JSONbored-loopover-f665d94/apps/loopover-miner-ui/vite-governor-api.ts :1
import { existsSync } from "node:fs"; - fs JSONbored-loopover-f665d94/apps/loopover-miner-ui/vite-ledgers-api.ts :1
import { existsSync } from "node:fs"; - fs JSONbored-loopover-f665d94/apps/loopover-miner-ui/vite-portfolio-queue-actions-api.ts :1
import { existsSync } from "node:fs"; - fs JSONbored-loopover-f665d94/apps/loopover-miner-ui/vite-portfolio-queue-api.ts :1
import { existsSync } from "node:fs"; - fs JSONbored-loopover-f665d94/apps/loopover-miner-ui/vite-ranked-candidates-api.ts :1
import { existsSync } from "node:fs"; - fs JSONbored-loopover-f665d94/apps/loopover-miner-ui/vite-run-state-api.ts :1
import { existsSync } from "node:fs"; - fs (weak) JSONbored-loopover-f665d94/apps/loopover-ui/src/components/site/docs-nav.test.tsx :1
import { readdirSync } from "node:fs"; - fs (weak) JSONbored-loopover-f665d94/apps/loopover-ui/src/components/site/surface-code-token.test.ts :1
import { readFileSync } from "node:fs"; - fs (weak) JSONbored-loopover-f665d94/apps/loopover-ui/src/lib/docs-source-server-isolation.test.ts :1
import { readFileSync, readdirSync } from "node:fs"; - fs (weak) JSONbored-loopover-f665d94/apps/loopover-ui/src/lib/miner-coding-agent-docs-data.test.ts :1
import { readFileSync } from "node:fs"; - fs (weak) JSONbored-loopover-f665d94/apps/loopover-ui/src/routes/docs-mdx-eager-scope.test.ts :1
import { readFileSync, readdirSync } from "node:fs";
show 28 more
- fs (weak) JSONbored-loopover-f665d94/apps/loopover-ui/src/routes/docs-routes-loading-state.test.tsx :1
import { readFileSync, readdirSync } from "node:fs"; - fs (weak) JSONbored-loopover-f665d94/apps/loopover-ui/src/routes/docs.ams-observability-callout.test.tsx :1
import { readFileSync } from "node:fs"; - fs (weak) JSONbored-loopover-f665d94/control-plane/scripts/gen-cf-typegen.ts :10
import { readFileSync, writeFileSync } from "node:fs"; - fs (weak) JSONbored-loopover-f665d94/packages/discovery-index/scripts/gen-cf-typegen.ts :9
import { readFileSync, writeFileSync } from "node:fs"; - fs (weak) JSONbored-loopover-f665d94/packages/discovery-index/scripts/validate-sourcemaps.ts :4
import { existsSync, readFileSync, readdirSync, statSync } from "node:fs"; - fs JSONbored-loopover-f665d94/packages/discovery-index/src/upload-sourcemaps.ts :10
import { existsSync, readFileSync, readdirSync, statSync } from "node:fs"; - fs JSONbored-loopover-f665d94/packages/loopover-engine/src/miner/repo-map.ts :20
import { readFileSync } from "node:fs"; - fs (weak) JSONbored-loopover-f665d94/packages/loopover-engine/test/miner-goal-spec.test.ts :6
import { readFileSync } from "node:fs"; - fs JSONbored-loopover-f665d94/packages/loopover-mcp/bin/loopover-mcp.ts :5
import { closeSync, constants as fsConstants, existsSync, fstatSync, mkdirSync, openSync, readdirSync, readFileSync, readSync, realpathSync, rmSync, statSync, writeFileSync } from "node:fs"; - fs JSONbored-loopover-f665d94/packages/loopover-mcp/lib/local-branch.ts :2
import { realpathSync } from "node:fs"; - fs (weak) JSONbored-loopover-f665d94/packages/loopover-mcp/scripts/check-syntax.ts :7
import { readdirSync } from "node:fs"; - fs (weak) JSONbored-loopover-f665d94/packages/loopover-mcp/scripts/strip-bin-sourcemap.ts :10
import { readdirSync, readFileSync, writeFileSync } from "node:fs"; - fs JSONbored-loopover-f665d94/packages/loopover-miner/bin/loopover-miner-mcp.ts :2
import { readFileSync, realpathSync } from "node:fs"; - fs JSONbored-loopover-f665d94/packages/loopover-miner/lib/ams-calibration.ts :24
import { existsSync as fsExistsSync, readFileSync as fsReadFileSync } from "node:fs"; - fs JSONbored-loopover-f665d94/packages/loopover-miner/lib/ams-policy.ts :1
import { existsSync, readFileSync } from "node:fs"; - fs JSONbored-loopover-f665d94/packages/loopover-miner/lib/calibration-cli.ts :5
import type { existsSync, readFileSync } from "node:fs"; - fs JSONbored-loopover-f665d94/packages/loopover-miner/lib/coding-task-spec.ts :1
import { closeSync, constants as fsConstants, openSync, realpathSync, writeFileSync } from "node:fs"; - fs JSONbored-loopover-f665d94/packages/loopover-miner/lib/cross-repo-evaluation.ts :8
import { cpSync, existsSync, mkdtempSync, realpathSync, rmSync } from "node:fs"; - fs JSONbored-loopover-f665d94/packages/loopover-miner/lib/deny-hooks-cli.ts :13
import { readFileSync } from "node:fs"; - fs JSONbored-loopover-f665d94/packages/loopover-miner/lib/discover-cli.ts :3
import { existsSync } from "node:fs"; - fs JSONbored-loopover-f665d94/packages/loopover-miner/lib/env-file-indirection.ts :10
import { readFileSync } from "node:fs"; - fs JSONbored-loopover-f665d94/packages/loopover-miner/lib/generate-egress-firewall-config.ts :15
import { writeFileSync } from "node:fs"; - fs JSONbored-loopover-f665d94/packages/loopover-miner/lib/github-token-resolution.ts :10
import { existsSync, readFileSync } from "node:fs"; - fs JSONbored-loopover-f665d94/packages/loopover-miner/lib/hosted-entry.ts :12
import { access } from "node:fs/promises"; - fs JSONbored-loopover-f665d94/packages/loopover-miner/lib/init-wizard.ts :2
import { chmodSync, mkdirSync, writeFileSync } from "node:fs"; - fs JSONbored-loopover-f665d94/packages/loopover-miner/lib/laptop-init.ts :1
import { accessSync, constants, existsSync } from "node:fs"; - fs JSONbored-loopover-f665d94/packages/loopover-miner/lib/local-store.ts :1
import { chmodSync, mkdirSync } from "node:fs"; - fs JSONbored-loopover-f665d94/packages/loopover-miner/lib/migrate-cli.ts :11
import { existsSync } from "node:fs";
201 more not shown — this panel samples each group; the count above is the real total.
shell / exec 144
- shell (weak) JSONbored-loopover-f665d94/control-plane/scripts/gen-cf-typegen.ts :9
import { execFileSync } from "node:child_process"; - shell (weak) JSONbored-loopover-f665d94/packages/discovery-index/scripts/gen-cf-typegen.ts :8
import { execFileSync } from "node:child_process"; - shell JSONbored-loopover-f665d94/packages/discovery-index/src/upload-sourcemaps.ts :9
import { spawnSync } from "node:child_process"; - shell JSONbored-loopover-f665d94/packages/loopover-engine/src/miner/agent-sdk-driver.ts :11
import { execFile } from "node:child_process"; - shell JSONbored-loopover-f665d94/packages/loopover-engine/src/miner/cli-subprocess-driver.ts :44
/** The coding-agent CLI to spawn (e.g. "claude" or "codex"). */ - shell JSONbored-loopover-f665d94/packages/loopover-engine/src/miner/coding-agent-mode.ts :13
// • Chosen: never spawn (cheapest, safest, mirrors `agentActionModeExecutes` skipping GitHub mutations). - shell JSONbored-loopover-f665d94/packages/loopover-engine/src/miner/lint-guard.ts :79
const { code, output } = await spawn("node", ["--check", file], { cwd }); - shell (weak) JSONbored-loopover-f665d94/packages/loopover-engine/test/driver-factory.test.ts :120
test("runCodingAgentAttempt dry_run with claude-cli does not require spawn (#4289)", async () => { - shell JSONbored-loopover-f665d94/packages/loopover-mcp/lib/local-branch.ts :1
import { execFileSync } from "node:child_process"; - shell (weak) JSONbored-loopover-f665d94/packages/loopover-mcp/scripts/check-syntax.ts :10
import { execFileSync } from "node:child_process"; - shell JSONbored-loopover-f665d94/packages/loopover-miner/lib/attempt-worktree.ts :1
import { spawn } from "node:child_process"; - shell JSONbored-loopover-f665d94/packages/loopover-miner/lib/coding-agent-construction.ts :4
// call site -- it provides a real `child_process`-backed spawn (mirroring src/selfhost/ai.ts's `defaultSpawn`,
show 28 more
- shell JSONbored-loopover-f665d94/packages/loopover-miner/lib/cross-repo-evaluation.ts :7
import { spawn as nodeSpawn } from "node:child_process"; - shell JSONbored-loopover-f665d94/packages/loopover-miner/lib/execute-local-write.ts :11
import { spawn } from "node:child_process"; - shell JSONbored-loopover-f665d94/packages/loopover-miner/lib/replay-snapshot.ts :118
const result = await exec("git", ["worktree", "add", "--detach", worktreePath, commitSha], { cwd: repoPath }); - shell JSONbored-loopover-f665d94/packages/loopover-miner/lib/repo-clone.ts :1
import { execFile } from "node:child_process"; - shell JSONbored-loopover-f665d94/packages/loopover-miner/lib/store-db-adapter.ts :16
exec(sql: string): void; - shell JSONbored-loopover-f665d94/packages/loopover-miner/lib/target-repo-verification.ts :14
import { spawn as nodeSpawn } from "node:child_process"; - shell (weak) JSONbored-loopover-f665d94/packages/loopover-miner/scripts/check-syntax.ts :10
import { execFileSync } from "node:child_process"; - shell JSONbored-loopover-f665d94/review-enrichment/src/upload-sourcemaps.ts :10
import { spawnSync } from "node:child_process"; - shell (weak) JSONbored-loopover-f665d94/review-enrichment/test/posthog-upload.test.ts :2
import { spawn } from "node:child_process"; - shell (weak) JSONbored-loopover-f665d94/scripts/attested-backtest-run.ts :19
import { spawnSync } from "node:child_process"; - shell (weak) JSONbored-loopover-f665d94/scripts/audit-quality-gate-min-score.ts :23
import { spawnSync } from "node:child_process"; - shell (weak) JSONbored-loopover-f665d94/scripts/backfill-calibration-corpus-phase2.ts :17
import { spawnSync } from "node:child_process"; - shell (weak) JSONbored-loopover-f665d94/scripts/backfill-calibration-corpus.ts :16
import { spawnSync } from "node:child_process"; - shell (weak) JSONbored-loopover-f665d94/scripts/backfill-slop-corpus.ts :12
import { spawnSync } from "node:child_process"; - shell (weak) JSONbored-loopover-f665d94/scripts/backtest-corpus-export.ts :15
import { spawnSync } from "node:child_process"; - shell (weak) JSONbored-loopover-f665d94/scripts/backtest-logic-check.ts :18
import { spawnSync } from "node:child_process"; - shell (weak) JSONbored-loopover-f665d94/scripts/backtest-track-record.ts :14
import { spawnSync } from "node:child_process"; - shell (weak) JSONbored-loopover-f665d94/scripts/check-branding-drift.ts :20
import { execFileSync } from "node:child_process"; - shell (weak) JSONbored-loopover-f665d94/scripts/check-changelog.ts :6
import { spawnSync } from "node:child_process"; - shell (weak) JSONbored-loopover-f665d94/scripts/check-contract-package.ts :9
import { spawnSync } from "node:child_process"; - shell (weak) JSONbored-loopover-f665d94/scripts/check-engine-package.ts :4
import { spawnSync } from "node:child_process"; - shell (weak) JSONbored-loopover-f665d94/scripts/check-engine-parity.ts :8
import { execFileSync } from "node:child_process"; - shell (weak) JSONbored-loopover-f665d94/scripts/check-mcp-package.ts :4
import { spawnSync } from "node:child_process"; - shell (weak) JSONbored-loopover-f665d94/scripts/check-mcp-release-candidate.ts :5
import { spawnSync, type SpawnSyncOptions } from "node:child_process"; - shell (weak) JSONbored-loopover-f665d94/scripts/check-mcp-release-due.ts :1
import { execFileSync, spawnSync } from "node:child_process"; - shell (weak) JSONbored-loopover-f665d94/scripts/check-miner-package.ts :4
import { spawnSync } from "node:child_process"; - shell (weak) JSONbored-loopover-f665d94/scripts/check-orb-release-due.ts :5
import { execFileSync } from "node:child_process"; - shell (weak) JSONbored-loopover-f665d94/scripts/check-orb-stable-release-due.ts :6
import { execFileSync } from "node:child_process";
104 more not shown — this panel samples each group; the count above is the real total.
network 126
- net JSONbored-loopover-f665d94/apps/loopover-miner-ui/src/lib/chat-stream.ts :3
// fetch() + ReadableStream (not the native EventSource, which can't send the POST body the endpoint needs). - net (weak) JSONbored-loopover-f665d94/apps/loopover-miner-ui/src/ranked-candidates.test.tsx :195
it("surfaces a thrown fetch (server not running) as a typed error, never a crash", async () => { - net (weak) JSONbored-loopover-f665d94/apps/loopover-miner-ui/src/run-history.test.tsx :184
it("surfaces a thrown fetch (server not running) as a typed error, never a crash", async () => { - net JSONbored-loopover-f665d94/apps/loopover-miner-ui/vite-chat-api.ts :9
// - `text/event-stream`, one `data: <json>\n\n` line per event, consumed client-side via fetch() + ReadableStream - net JSONbored-loopover-f665d94/apps/loopover-ui/src/components/site/api/try-it.tsx :118
res = await fetch(url, { ...init, signal: ctrl.signal }); - net JSONbored-loopover-f665d94/apps/loopover-ui/src/components/site/github-stats-chip.tsx :99
const ghResponse = await fetch(`https://api.github.com/repos/${REPO}`, { - net JSONbored-loopover-f665d94/apps/loopover-ui/src/lib/analytics-proxy.ts :159
const upstream = await fetch(upstreamUrl); - net JSONbored-loopover-f665d94/apps/loopover-ui/src/lib/api/request.ts :62
const res = await fetch(input, { ...init, signal: ctrl.signal }); - net JSONbored-loopover-f665d94/apps/loopover-ui/src/lib/api/status.ts :131
const res = await fetch(HEALTH_URL, { signal: ctrl.signal, cache: "no-store" }); - net (weak) JSONbored-loopover-f665d94/apps/loopover-ui/src/lib/openapi.test.ts :194
expect(getFetch).toContain("await fetch('https://api.example.com/v1/repos/{owner}/{repo}'"); - net JSONbored-loopover-f665d94/apps/loopover-ui/src/lib/openapi.ts :207
return `const res = await fetch('${url}', {\n${init.join(",\n")},\n});\nconst data = await res.json();`; - net JSONbored-loopover-f665d94/apps/loopover-ui/src/server.ts :42
async fetch(request: Request, env: unknown, ctx: unknown) {
show 28 more
- net JSONbored-loopover-f665d94/control-plane/src/neon-database-driver.ts :108
const response = await fetch(`${baseUrl}${path}`, { - net JSONbored-loopover-f665d94/control-plane/src/orb-webhook-router.ts :17
* polls for completion; ORB's container is a persistent HTTP server, so a plain `fetch()` is enough -- - net JSONbored-loopover-f665d94/control-plane/src/pagerduty-notify.ts :95
const response = await fetch(PAGERDUTY_EVENTS_URL, { - net JSONbored-loopover-f665d94/control-plane/src/worker.ts :72
* use. `defaultPort` is what `Container.fetch()` proxies to -- orb-webhook-router.ts (#7181) is the thing - net (weak) JSONbored-loopover-f665d94/control-plane/test/http-app.test.ts :938
return { async fetch() { return response; } }; - net (weak) JSONbored-loopover-f665d94/control-plane/test/orb-webhook-router.test.ts :32
async fetch(request) { - net JSONbored-loopover-f665d94/packages/discovery-index/src/rate-limiter.ts :28
override async fetch(request: Request): Promise<Response> { - net JSONbored-loopover-f665d94/packages/discovery-index/src/worker.ts :81
async fetch(request: Request, workerEnv: WorkerEnv): Promise<Response> { - net JSONbored-loopover-f665d94/packages/loopover-engine/src/miner/attempt-db-fork.ts :87
const response = await fetch(`${baseUrl}${path}`, { - net JSONbored-loopover-f665d94/packages/loopover-mcp/bin/loopover-mcp.ts :2547
const response = await fetch(url, init as RequestInit); - net JSONbored-loopover-f665d94/packages/loopover-mcp/bin/loopover-verify.ts :77
const response = await fetch(`${baseUrl}${path}`, { - net JSONbored-loopover-f665d94/packages/loopover-miner/lib/ams-health-server.ts :1
import { createServer, type Server } from "node:http"; - net JSONbored-loopover-f665d94/packages/loopover-miner/lib/attempt-cli.ts :4
// real coding-agent driver (#5131) and slop assessor (#5133), a live SelfReviewContext fetch (#5145), a real - net JSONbored-loopover-f665d94/packages/loopover-miner/lib/claim-conflict-resolver.ts :102
* Bounded retry for the live-state snapshot fetch (#6058): up to `maxAttempts` (default 3) attempts with - net JSONbored-loopover-f665d94/packages/loopover-miner/lib/governor-kill-switch.ts :59
const response = await fetch(PAGERDUTY_EVENTS_URL, { - net JSONbored-loopover-f665d94/packages/loopover-miner/lib/governor-pause-cli.ts :118
const response = await fetch(`${session.apiUrl}/v1/auth/session`, { - net JSONbored-loopover-f665d94/packages/loopover-miner/lib/hosted-entry.ts :11
import type { Server } from "node:http"; - net JSONbored-loopover-f665d94/packages/loopover-miner/lib/submission-freshness-check.ts :75
// Bounded retry for the pre-submission live-state fetch (#7089), mirroring claim-conflict-resolver.js's - net JSONbored-loopover-f665d94/packages/loopover-miner/lib/update-check.ts :126
const response = await fetch(registryPath, { - net (weak) JSONbored-loopover-f665d94/review-enrichment/test/caller-impact.test.ts :315
test("scanCallerImpact: a thrown fetch (network error) degrades to no finding", async () => { - net (weak) JSONbored-loopover-f665d94/review-enrichment/test/floating-promise.test.ts :17
assert.equal(detectFloatingPromise("fetch('/api/users');"), "fetch"); - net (weak) JSONbored-loopover-f665d94/review-enrichment/test/hardcoded-url.test.ts :19
assert.deepEqual(detectHardcodedUrl("await fetch('http://10.0.0.5:8080/health');"), { - net (weak) JSONbored-loopover-f665d94/review-enrichment/test/posthog-upload.test.ts :4
import { createServer } from "node:http"; - net (weak) JSONbored-loopover-f665d94/scripts/backfill-calibration-corpus-phase2.ts :127
const response = await fetch(`https://api.github.com${path}`, { - net (weak) JSONbored-loopover-f665d94/scripts/check-mcp-release-due.ts :194
const response = await fetch(`https://api.github.com${path}`, { - net (weak) JSONbored-loopover-f665d94/scripts/check-package-release-due.ts :205
const response = await fetch(`https://api.github.com${path}`, { - net (weak) JSONbored-loopover-f665d94/scripts/check-roadmap-issue-drift.ts :36
const response = await fetch(`https://api.github.com${path}`, { - net (weak) JSONbored-loopover-f665d94/scripts/check-stuck-required-checks.ts :47
const response = await fetch(`https://api.github.com${path}`, {
86 more not shown — this panel samples each group; the count above is the real total.
secrets 74
- secrets JSONbored-loopover-f665d94/apps/loopover-ui/src/lib/config.server.ts :24
// stripeSecretKey: process.env.STRIPE_SECRET_KEY, - secrets (weak) JSONbored-loopover-f665d94/control-plane/test/driver-factory.test.ts :314
const previousKey = process.env.NEON_API_KEY; - secrets JSONbored-loopover-f665d94/packages/discovery-index/src/app.ts :59
const secret = normalizeSharedSecret(process.env.DISCOVERY_INDEX_SHARED_SECRET); - secrets JSONbored-loopover-f665d94/packages/discovery-index/src/server.ts :21
const githubToken = process.env.DISCOVERY_INDEX_GITHUB_TOKEN ?? ""; - secrets JSONbored-loopover-f665d94/packages/discovery-index/src/upload-sourcemaps.ts :157
POSTHOG_CLI_API_KEY: nonBlank(process.env.POSTHOG_CLI_API_KEY), - secrets JSONbored-loopover-f665d94/packages/loopover-mcp/bin/loopover-mcp.ts :4557
const githubToken = optionText(options.githubToken) ?? process.env.GITHUB_TOKEN; - secrets JSONbored-loopover-f665d94/packages/loopover-mcp/lib/telemetry.ts :64
const apiKey = trimmedOrUndefined(process.env.LOOPOVER_MCP_POSTHOG_API_KEY); - secrets JSONbored-loopover-f665d94/packages/loopover-miner/lib/contribution-profile-extract.ts :332
options.githubToken ?? process.env.GITHUB_TOKEN, - secrets JSONbored-loopover-f665d94/packages/loopover-miner/lib/live-issue-snapshot.ts :114
const githubToken = options.githubToken ?? process.env.GITHUB_TOKEN ?? ""; - secrets JSONbored-loopover-f665d94/packages/loopover-miner/lib/loop-cli.ts :325
// pollPrDisposition (unlike runDiscover, which falls back to process.env.GITHUB_TOKEN internally) has NO - secrets JSONbored-loopover-f665d94/packages/loopover-miner/lib/rejection-signal.ts :163
githubToken: typeof options.githubToken === "string" ? options.githubToken.trim() : (process.env.GITHUB_TOKEN ?? ""), - secrets JSONbored-loopover-f665d94/review-enrichment/src/server.ts :60
const secret = normalizeSharedSecret(process.env.REES_SHARED_SECRET);
show 28 more
- secrets JSONbored-loopover-f665d94/review-enrichment/src/upload-sourcemaps.ts :163
POSTHOG_CLI_API_KEY: nonBlank(process.env.POSTHOG_CLI_API_KEY), - secrets (weak) JSONbored-loopover-f665d94/review-enrichment/test/scheduler.test.ts :220
patch: `${" context\n".repeat(130000)}+console.log(process.env.TOKEN);`, - secrets (weak) JSONbored-loopover-f665d94/scripts/backfill-calibration-corpus-phase2.ts :114
const token = process.env.GITHUB_TOKEN ?? process.env.GH_TOKEN; - secrets (weak) JSONbored-loopover-f665d94/scripts/check-mcp-release-due.ts :158
const token = process.env.GITHUB_TOKEN; - secrets (weak) JSONbored-loopover-f665d94/scripts/check-package-release-due.ts :166
const token = process.env.GITHUB_TOKEN; - secrets (weak) JSONbored-loopover-f665d94/scripts/check-roadmap-issue-drift.ts :140
const token = process.env.GITHUB_TOKEN ?? process.env.GH_TOKEN; - secrets (weak) JSONbored-loopover-f665d94/scripts/check-stuck-required-checks.ts :186
const token = process.env.GITHUB_TOKEN; - secrets (weak) JSONbored-loopover-f665d94/scripts/ci-duration-report.ts :97
const token = process.env.GITHUB_TOKEN; - secrets (weak) JSONbored-loopover-f665d94/scripts/counterfactual-replay.ts :181
const token = process.env.CLOUDFLARE_API_TOKEN?.trim(); - secrets (weak) JSONbored-loopover-f665d94/scripts/frozen-repo-snapshot.ts :149
const token = process.env.GITHUB_TOKEN; - secrets (weak) JSONbored-loopover-f665d94/scripts/redeploy-companion.ts :41
const token = process.env.REDEPLOY_COMPANION_TOKEN?.trim(); - secrets JSONbored-loopover-f665d94/src/selfhost/orb-collector.ts :251
const brokered = Boolean((process.env.ORB_ENROLLMENT_SECRET ?? "").trim()); - secrets JSONbored-loopover-f665d94/src/selfhost/qdrant-vectorize.ts :52
if (process.env.QDRANT_API_KEY) h["api-key"] = process.env.QDRANT_API_KEY; - secrets JSONbored-loopover-f665d94/src/server.ts :425
const redeployCompanionToken = nonBlank(process.env.REDEPLOY_COMPANION_TOKEN); - secrets (weak) JSONbored-loopover-f665d94/test/contract/upstream-contract.test.ts :9
const env = createTestEnv(process.env.GITHUB_TOKEN ? { GITHUB_PUBLIC_TOKEN: process.env.GITHUB_TOKEN } : {}); - secrets (weak) JSONbored-loopover-f665d94/test/unit/mcp-api-response-validation.test.ts :40
process.env.LOOPOVER_TOKEN = "test-token"; - secrets (weak) JSONbored-loopover-f665d94/test/unit/mcp-check-issue-slop-description.test.ts :26
process.env.LOOPOVER_API_TOKEN = "in-process-token"; - secrets (weak) JSONbored-loopover-f665d94/test/unit/mcp-cli-activation-preview.test.ts :37
process.env.LOOPOVER_API_TOKEN = "in-process-token"; - secrets (weak) JSONbored-loopover-f665d94/test/unit/mcp-cli-agent-audit-feed.test.ts :31
process.env.LOOPOVER_API_TOKEN = "in-process-token"; - secrets (weak) JSONbored-loopover-f665d94/test/unit/mcp-cli-agent-start.test.ts :25
process.env.LOOPOVER_API_TOKEN = "in-process-token"; - secrets (weak) JSONbored-loopover-f665d94/test/unit/mcp-cli-ams-miner-cohort.test.ts :32
process.env.LOOPOVER_API_TOKEN = "in-process-token"; - secrets (weak) JSONbored-loopover-f665d94/test/unit/mcp-cli-automation-state-stdio.test.ts :32
process.env.LOOPOVER_API_TOKEN = "in-process-token"; - secrets (weak) JSONbored-loopover-f665d94/test/unit/mcp-cli-basics.test.ts :257
process.env.LOOPOVER_TOKEN = "session-token"; - secrets (weak) JSONbored-loopover-f665d94/test/unit/mcp-cli-clear-selftune-override.test.ts :34
process.env.LOOPOVER_API_TOKEN = "in-process-token"; - secrets (weak) JSONbored-loopover-f665d94/test/unit/mcp-cli-contributor-profile-inprocess.test.ts :37
process.env.LOOPOVER_API_TOKEN = "in-process-token"; - secrets (weak) JSONbored-loopover-f665d94/test/unit/mcp-cli-current-branch-input.test.ts :43
process.env.LOOPOVER_API_TOKEN = "in-process-token"; - secrets (weak) JSONbored-loopover-f665d94/test/unit/mcp-cli-dispatch-inprocess.test.ts :31
process.env.LOOPOVER_TOKEN = "test-token"; - secrets (weak) JSONbored-loopover-f665d94/test/unit/mcp-cli-gate-config-effective.test.ts :32
process.env.LOOPOVER_API_TOKEN = "in-process-token";
34 more not shown — this panel samples each group; the count above is the real total.
database 25
- db (weak) JSONbored-loopover-f665d94/scripts/migrate-selfhost-sqlite-to-postgres.ts :5
import pg, { type PoolClient } from "pg"; - db (weak) JSONbored-loopover-f665d94/scripts/pg-cli.ts :8
import pg from "pg"; - db JSONbored-loopover-f665d94/src/selfhost/pg-adapter.ts :10
import type { Pool, PoolClient } from "pg"; - db JSONbored-loopover-f665d94/src/selfhost/pg-queue.ts :5
import type { Pool, QueryResult } from "pg"; - db JSONbored-loopover-f665d94/src/selfhost/pg-vectorize.ts :15
import type { Pool } from "pg"; - db JSONbored-loopover-f665d94/src/selfhost/redis-cache.ts :6
import type { Redis } from "ioredis"; - db JSONbored-loopover-f665d94/src/selfhost/redis-ratelimit.ts :5
import type { Redis } from "ioredis"; - db JSONbored-loopover-f665d94/src/selfhost/redis-response-cache.ts :10
import type { Redis } from "ioredis"; - db JSONbored-loopover-f665d94/src/selfhost/redis-token-cache.ts :7
import type { Redis } from "ioredis"; - db (weak) JSONbored-loopover-f665d94/test/contract/selfhost-d1-database.test.ts :21
import type { Pool } from "pg"; - db (weak) JSONbored-loopover-f665d94/test/contract/selfhost-durable-queue.test.ts :18
import type { Pool } from "pg"; - db (weak) JSONbored-loopover-f665d94/test/contract/selfhost-vectorize.test.ts :16
import type { Pool } from "pg";
show 13 more
- db (weak) JSONbored-loopover-f665d94/test/integration/selfhost-pg-calibration.test.ts :9
import pg from "pg"; - db (weak) JSONbored-loopover-f665d94/test/integration/selfhost-pg.test.ts :6
import pg from "pg"; - db (weak) JSONbored-loopover-f665d94/test/unit/github-app.test.ts :33
import type { Redis } from "ioredis"; - db (weak) JSONbored-loopover-f665d94/test/unit/migrate-selfhost-sqlite-to-postgres.test.ts :6
import type { PoolClient } from "pg"; - db (weak) JSONbored-loopover-f665d94/test/unit/selfhost-migrate.test.ts :10
import type { Pool } from "pg"; - db (weak) JSONbored-loopover-f665d94/test/unit/selfhost-pg-adapter.test.ts :9
import type { Pool, PoolClient } from "pg"; - db (weak) JSONbored-loopover-f665d94/test/unit/selfhost-pg-queue.test.ts :4
import type { Pool, QueryResult } from "pg"; - db (weak) JSONbored-loopover-f665d94/test/unit/selfhost-pg-retention.test.ts :9
import type { Pool } from "pg"; - db (weak) JSONbored-loopover-f665d94/test/unit/selfhost-pg-vectorize.test.ts :6
import type { Pool } from "pg"; - db (weak) JSONbored-loopover-f665d94/test/unit/selfhost-redis-cache.test.ts :1
import type { Redis } from "ioredis"; - db (weak) JSONbored-loopover-f665d94/test/unit/selfhost-redis-ratelimit.test.ts :1
import type { Redis } from "ioredis"; - db (weak) JSONbored-loopover-f665d94/test/unit/selfhost-redis-response-cache.test.ts :1
import type { Redis } from "ioredis"; - db (weak) JSONbored-loopover-f665d94/test/unit/selfhost-redis-token-cache.test.ts :1
import type { Redis } from "ioredis";
install hooks 1
- postinstall JSONbored-loopover-f665d94/apps/loopover-ui/package.json :10
fumadocs-mdx
declared dependencies 48
- @modelcontextprotocol/sdk@1.29.0
- @asteasolutions/zod-to-openapi@^8.5.0
- @cloudflare/puppeteer@^1.1.0
- @hono/node-server@^2.0.11
- @loopover/contract@^0.1.0
- @loopover/engine@*
- @octokit/core@^7.0.6
- @opentelemetry/api@^1.9.1
- @opentelemetry/exporter-trace-otlp-http@^0.221.0
- @opentelemetry/resources@^2.10.0
- @opentelemetry/sdk-trace-node@^2.10.0
- agents@^0.19.0
show 28 more
- aws4fetch@^1.0.20
- drizzle-orm@^0.45.2
- hono@^4.12.31
- ioredis@^5.11.1
- pg@^8.22.0
- posthog-node@^5.46.1
- sharp@^0.35.3
- yaml@^2.9.0
- zod@^4.4.3
- @cloudflare/vitest-pool-workers@^0.18.8
- @tktco/node-actionlint@^1.6.0
- @types/node@^24.13.3
- @types/pg@^8.20.0
- @types/pixelmatch@^5.2.6
- @types/pngjs@^6.0.5
- @types/semver@^7.7.1
- @vitest/coverage-v8@^4.1.10
- ajv@^8.20.0
- drizzle-kit@^0.31.10
- gifenc@^1.0.3
- git-cliff@^2.13.1
- github-actionlint@^1.7.12
- node-addon-api@^8.9.0
- node-gyp@^12.4.0
- pixelmatch@^7.2.0
- playwright@^1.61.1
- pngjs@^7.0.0
- release-please@^16.18.0
8 more not shown — this panel samples each group; the count above is the real total.
perm:untrusted 2
- untrusted (weak) JSONbored-loopover-f665d94/test/integration/mcp-discovery-routes.test.ts :46
const selfhost = (await (await app.fetch(new Request("https://api.loopover.ai/.well-known/mcp.json"), selfhostEnv)).json()) as { - untrusted (weak) JSONbored-loopover-f665d94/test/unit/transient-locks.test.ts :158
await expect(lock.fetch(claimRequest("token-a", 1)).then((r) => r.json())).resolves.toEqual({
transport_posture 1
- network-listening, binds all interfaces, no auth detected JSONbored-loopover-f665d94/test/unit/selfhost-observability-config.test.ts :249
host: "0.0.0.0",