SYS://REPO-RATER AUTOMATED RATINGS DESK v0.1
Request an audit

Categories / anomalyco/opencode / evidence

anomalyco/opencodecli-tool

A CLI-first AI coding agent that lets developers drive an LLM-backed build/plan workflow from the terminal, with desktop, web, and console surfaces layered on top.

TypeScriptstars 188,015license MITpushed today
6.7COMPOSITE
REPO-RATERBBBDEEP AUDIT · 07/2026

Dossier compilation

This audit's judge read a single 11.3k-token evidence dossier, compiled mechanically under per-section budgets. Below: each section, what went in, and what was cut. Citations on the audit page resolve here.

#Section / contentsModeSpent / budget
[24]Vitals + README (distilled)SECTION1.0k / 1.5k
[1]README.md · distilled: badges/TOC strippedDOSSIER1.0k
[2]Structure (dir-aggregated)SECTION402 / 1.0k
[25]Health + Static digestSECTION808 / 2.0k
[3](github api)PROBE404
[4](static analysis)PROBE404
[26]Manifests + lockfiles + CI (verbatim)SECTION1.2k / 1.2k
[5]package.jsonDOSSIER292
[6].github/workflows/deploy.ymlDOSSIER292
[7].github/workflows/publish.ymlDOSSIER292
[8].github/workflows/stats.ymlDOSSIER292
[27]Core files (complete / whole-function)SECTION4.9k / 5.0k
[9]packages/app/e2e/performance/timeline-stability/fixture.tsDOSSIER4.9k
cut: packages/opencode/src/session/prompt.ts — over budget (16232 tok) and no function boundaries parsed
cut: packages/app/src/pages/session.tsx — over budget (20301 tok) and no function boundaries parsed
cut: packages/app/src/i18n/en.ts — over budget (14420 tok) and no function boundaries parsed
cut: packages/sdk/js/src/v2/gen/sdk.gen.ts — over budget (44736 tok) and no function boundaries parsed
cut: packages/opencode/src/provider/provider.ts — over budget (19131 tok) and no function boundaries parsed
cut: packages/app/src/components/prompt-input.tsx — over budget (15254 tok) and no function boundaries parsed
cut: packages/opencode/src/lsp/server.ts — over budget (13694 tok) and no function boundaries parsed
cut: packages/console/app/src/routes/zen/util/handler.ts — over budget (12435 tok) and no function boundaries parsed
cut: packages/opencode/src/cli/cmd/run.ts — over budget (8029 tok) and no function boundaries parsed
cut: packages/console/app/src/i18n/en.ts — over budget (11877 tok) and no function boundaries parsed
cut: packages/tui/src/config/keybind.ts — over budget (6006 tok) and no function boundaries parsed
cut: packages/stats/app/src/routes/index.tsx — over budget (18267 tok) and no function boundaries parsed
cut: packages/app/src/pages/home.tsx — over budget (17640 tok) and no function boundaries parsed
cut: packages/opencode/src/session/message-v2.ts — over budget (6451 tok) and no function boundaries parsed
cut: packages/llm/src/schema/events.ts — over budget (6070 tok) and no function boundaries parsed
[28]Test realitySECTION1.4k / 1.5k
[10]packages/app/e2e/performance/timeline/session-tab-switch-benchmark.spec.tsDOSSIER1.4k
[29]Probe answersSECTION833 / 1.5k
[11] probe-deps[12] probe-license[13] probe-ci[14] probe-todo[15] probe-assertions[16] probe-top-tested[17] probe-cve[18] probe-claim-1[19] probe-claim-2[20] probe-claim-3[21] probe-claim-4
[22]Outlines (files not read above)SECTION223 / 500
[30]Coverage notes (what was cut & why)SECTION368 / 400
[23](composer)DOSSIER368
6303 files mapped · 2 complete, 0 whole-function · 11 probes · degraded: router-embeddings(lexical-only)11.3k / 15k cap

Measured properties

Raw signals behind the scores. Source tags: COMPUTED derived from the clone · API GitHub/registry data · JUDGE model estimate

loc_source418113 COMPUTED
loc_test181794 COMPUTED
test_to_source_ratio0.43 COMPUTED
files_tracked6303 COMPUTED
language_mix[object Object] COMPUTED
deps_direct6 COMPUTED
lockfilebun.lock COMPUTED
ci_workflows26 COMPUTED
security_mdtrue COMPUTED
total_commits15090 COMPUTED
commits_last_90d3395 COMPUTED
top_author_share_pct13 COMPUTED
bus_factor_80pct16 COMPUTED
first_commit2025-03-21 COMPUTED
last_commit2026-07-20 COMPUTED
gh_stars188015 API
gh_forks23652 API
gh_open_issues4745 API
gh_pushed_at2026-07-21T05:26:48Z API
gh_created_at2025-04-30T20:08:00Z API
gh_archivedfalse API
gh_licenseMIT API
gh_topics API
gh_default_branchdev API
issue_open3658 API
issue_stale_ratio_pct0 API
issue_median_first_response_days0 API
issue_median_close_days0.1 API
issue_bot_first_response_pct100 API
pr_open1087 API
pr_median_merge_days0 API
pr_external_merge_share_pct45 API
pr_reviewed_share_pct5 API
releases_total100 API
releases_last_24mo100 API
release_latest2026-07-20T15:28:21Z API
release_notes_share_pct100 API
release_latest_automatedtrue API
contributors_100cap100 API
contributor_top10_share_pct84 API
community_health_pct87 API
discussions_enabledfalse API
complexity_p9022 STATIC
hotspot_toppackages/opencode/src/provider/transform.ts,packages/opencode/src/provider/provider.ts,packages/app/src/pages/session.tsx,packages/app/src/pages/layout.tsx,packages/app/src/components/prompt-input.tsx,packages/opencode/src/session/prompt.ts,packages/opencode/src/lsp/server.ts,packages/opencode/src/config/config.ts,packages/sdk/js/src/v2/gen/sdk.gen.ts,packages/console/app/src/routes/zen/util/handler.ts,packages/opencode/src/session/message-v2.ts,packages/opencode/src/cli/cmd/run.ts,packages/opencode/src/mcp/index.ts,packages/app/src/pages/home.tsx,packages/stats/app/src/routes/index.tsx STATIC
dup_pct17.8 STATIC
dup_worst_pair.github/workflows/beta.yml ↔ .github/workflows/publish.yml (7 lines) STATIC
cve_count_critical2 STATIC
cve_count_high46 STATIC
cve_count_medium96 STATIC
secrets_found11 STATIC
secret_scan_depthworking tree + last 50 commits STATIC
smell_empty_catch2 STATIC
smell_dynamic_exec2 STATIC
smell_long_functions26 STATIC
smell_deep_nesting162 STATIC
smell_todo_density0.2 STATIC
dossier_tokens11335 COMPUTED
graph_coverage_pct100 COMPUTED

Claim traceability

Every judgment on the audit page, mapped to what backs it.

ClaimBacked byKind
OpenCode installs via npm, bun, pnpm, yarn, brew, scoop, choco, pacman, mise, and nix, plus a beta desktop app.vitals-readmeOBSERVATION
The lockfile-resolved dependency tree carries 2 critical and 46 high-severity CVEs.probe-cveMEASUREMENT
Only 5% of a 20-PR sample of merged pull requests received at least one review.health-staticMEASUREMENT
The most complex and highest-churn source files (provider/transform.ts, provider/provider.ts) were not read in full due to size.coverage-notesOBSERVATION
effect.ts, the highest-pagerank file in the codebase, is referenced by 337 test files.probe-top-testedMEASUREMENT
README claims about desktop-app download artifacts and version cleanup were not substantively corroborated by the retrieval probes, which matched unrelated i18n locale files.probe-claim-1 probe-claim-2 probe-claim-3 probe-claim-4VERIFICATION

Coverage, provenance & bloat

How much of the repository this audit actually covered, who probably wrote it, and how heavy it is — informational, never part of the grade.

Coverage

structure mapped: 6303 files · dossier: 11335 tok · complete files: 1 · whole-function: 0 · probes: 11

Provenance

AI-likelihoodUNCLEAR

Large, consistently structured monorepo with conventional package boundaries; no distinguishing AI-authorship markers visible in the excerpts provided.

Bloat signal (lean 0 → heavy 10, descriptive only)

Index4.0
deps_direct6
deps_transitive
install_footprint
bundle_vs_category_median
loc_to_api_ratio
boilerplate_density