March 3, 2026 4 min read Python fork

CoPaw

Abstract

Your Personal AI Assistant; easy to install, deploy on your own machine or on the cloud; supports multiple chat apps with easily extensible capabilities.

Forked from agentscope-ai/QwenPaw

The Problem

CoPaw is a personal AI assistant that connects across multiple chat platforms (DingTalk, Feishu, QQ, Discord, iMessage) but has significant code health issues that increase maintenance risk and deployment vulnerability. The codebase contains circular imports, unpinned dependencies with known CVEs, and a missing lockfile that creates drift between tested and shipped artifacts.

What This Does

CoPaw is a full-stack Python/TypeScript application with a React console interface and Python backend. The console (console/, 139 files) handles the user interface built with React/Vite, while the Python source (src/, 349 files) provides the core assistant logic, agent orchestration, and channel integrations. A React runtime function t in website/src/i18n.ts is called from 55 other files, indicating the i18n system is deeply wired into the UI. The Python package is pip-installable via pyproject.toml and setup.py, and the project can be containerized with the deploy/Dockerfile. Skills and channels are extensible through the src/copaw/agents/skills/ and src/copaw/app/channels/ modules.

How It Is Wired

Execution starts at console/src/App.tsx:15 which reaches a single function and is the root of the React client. On the server, console/src/api/index.ts (Ca 23, Ce 16, instability 0.41) is the highest-instability hub - 23 modules import from it and it imports 16 others, making it a high-blast-radius point where changes ripple widely. The API request layer flows through console/src/api/request.ts which builds headers and makes fetches to the backend. The internal call graph shows t is called from 95 places and request from 83 places, representing the most break-prone edges. Circular imports exist in src/copaw/config/__init__.py, src/copaw/config/utils.py, and src/copaw/app/channels/registry.py - mutually reachable modules that will cause import failures if any one is reordered. Execution can leave the process via 2 functions running external commands and 1 function reading/writing files, primarily through skill execution and file-based configs.

Entry points: App (console/src/App.tsx:15), getSession (console/src/pages/Chat/sessionApi/index.ts:286), handleSubmit (console/src/pages/Agent/Skills/index.tsx:107), createSession (console/src/pages/Chat/sessionApi/index.ts:374), handleConfirmImport (console/src/pages/Agent/Skills/index.tsx:72), CronJobsPage (console/src/pages/Control/CronJobs/index.tsx:15).

How To Use It

Setup:

# Clone the repository
git clone https://github.com/moses-y/CoPaw

# Install dependencies (pnpm)
cd CoPaw
pnpm install

# Install the Python package
pip install -e .

Configuration: Required environment variables and keys are managed through console/src/pages/Settings/Environments/useEnvVars.ts. The Python configuration lives in src/copaw/config/config.py (Ca 17, Ce 1) and src/copaw/config/__init__.py. Channel configs (DingTalk, Feishu, Discord, etc.) are defined in console/src/api/types/channel.ts.

Running it:

Start the console UI: pnpm dev (from console/package.json)
Start the Python backend: The package exposes a CLI; invocation would use the installed copaw command or python -m copaw

Note: The repo provides scripts/install.sh and scripts/install.ps1 for environment setup, but specific environment variable names are not documented in the analyzed structure.

Real-World Use

A user adds a new channel configuration via the web console (console/src/pages/Settings/Environments/index.tsx), which calls useEnvVars.ts to persist settings. The Python side reads these via src/copaw/config/config.py and registers the channel handler. When a message arrives, it routes through the channel base (src/copaw/app/channels/base.py) and gets processed by the skill system (src/copaw/agents/skills_manager.py). A cron job scheduled through console/src/pages/Control/CronJobs/useCronJobs.ts can trigger periodic tasks like daily digests or reminders, with job definitions stored in the database and dispatched via the cron runtime defined in console/src/api/types/cronjob.ts.

Code Health & Issues

The static analysis identified 155 findings (42 high, 113 medium, 0 low) across 7 distinct categories. Key issues:

[HIGH/clarity] Hub module x7 - console/src/api/types/index.ts, console/src/api/index.ts, src/copaw/constant.py; 47 modules depend on these; high-blast-radius churn point
[HIGH/soundness] Import cycle member x8 - src/copaw/config/__init__.py, src/copaw/config/utils.py, src/copaw/app/channels/registry.py; circular import dependency
[MEDIUM/resilience] Broad exception handling x12 - src/copaw/app/channels/base.py, office validator files; bare except swallows errors indiscriminately
[HIGH/cognitive_load] Deep nesting x24 - src/copaw/app/channels/base.py, src/copaw/agents/utils/tool_message_utils.py, validators; max indentation depth 6
[HIGH/cognitive_load] Oversized file x7 - src/copaw/app/channels/base.py (676 lines), src/copaw/agents/skills_manager.py, validators; hard to hold in one head
[HIGH/clarity] Duplicated code blocks x2658 across 106 files; 6-line blocks repeated

SDLC observations: License file present (LICENSE), CI configured (GitHub Actions), Dockerfile present, lockfiles present for Python (pyproject.toml) and Node (console/package-lock.json), no committed secrets detected. However, 9 dependency vulnerabilities are pinned including agentscope@1.0.16 CVE-2026-6604 and 7 more advisories.

The Bottom Line

CoPaw functional architecture - multi-channel AI assistant with React front-end and Python back-end - is sound but burdened by structural debt: circular imports create import-time failures risk, unpinned dependencies carry known CVEs, and a missing lockfile creates ship-vs-test drift. The hub at console/src/api/index and the t runtime function are the highest-risk touch points for anyone extending the codebase. It's suitable for teams that can absorb the remediation work (pin SHAs, break cycles, extract duplicated logic) and want a self-hostable AI assistant with extensible channels. Teams needing zero-config deployment or strict security posture should look elsewhere.

What the analyser found

Deployment readiness

7/7

Container image
CI pipeline
Lockfile committed
Test suite
README
License
No committed secrets

Composition

598 files

Python194
Markdown74
TSX74
TypeScript64
JSON13
LESS13

ReactFlaskExpressDockerTransformers

Module dependencies

The 10 most depended-upon modules of 335, from static import analysis. Red outline marks a module in an import cycle.

graph LR n0_console_src_api_types_index["index"] n1_console_src_api_index["index"] n2_src_copaw_constant["constant"] n3_src_copaw_config_config["config"] n4_console_src_api_request["request"] n5_website_src_i18n["i18n"] n6_src_copaw_config___init__["__init__"] n7_src_copaw_app_channels_base["base"] n8_rc_copaw_app_channels_schema["schema"] n9_src_copaw_config_utils["utils"] n1_console_src_api_index --> n0_console_src_api_types_index n1_console_src_api_index --> n4_console_src_api_request n7_src_copaw_app_channels_base --> n8_rc_copaw_app_channels_schema n6_src_copaw_config___init__ --> n3_src_copaw_config_config n6_src_copaw_config___init__ --> n9_src_copaw_config_utils n3_src_copaw_config_config --> n2_src_copaw_constant n9_src_copaw_config_utils --> n2_src_copaw_constant n9_src_copaw_config_utils --> n3_src_copaw_config_config classDef cyc stroke:#ef4444,stroke-width:2px; class n6_src_copaw_config___init__,n9_src_copaw_config_utils cyc;

Dependencies

23 of 44 declared dependencies are a major version behind. Resolved 44 of 44 against the registry.

Package	Declared	Latest	Behind
`@vitejs/plugin-react`	^4.4.1	6.0.5	2 major
`eslint-plugin-react-hooks`	^5.2.0	7.1.1	2 major
`typescript`	~5.8.3	7.0.2	2 major
`vite`	^6.3.5	8.2.1	2 major
`python-telegram-bot`	>=20.0	22.8	2 major
`antd`	^5.29.1	6.6.1	1 major
`antd-style`	^3.7.1	4.1.0	1 major
`i18next`	^25.8.4	26.3.6	1 major

Open in Code Brain → See its neighbourhood →

What would stop me shipping this

Ranked by severity × confidence × production reach. Reach is the honest discriminator across a collection that is mostly other people's code: the same finding matters more in something that ships.

high3

medium8

low1

Pin third-party GitHub Actions to a commit SHAhigh5 occurrences

.github/workflows

pnpm/action-setup@v4, peaceiris/actions-gh-pages@v4, docker/setup-buildx-action@v3, docker/login-action@v3

A tag can be moved, so the action running with your token and secrets is whatever its owner last pushed; this is how tj-actions/changed-files leaked secrets from thousands of repos.

Fix: Replace each @vN with the 40-character commit SHA, keep # vN as a comment, and let Dependabot bump the SHAs.

Upgrade the pinned dependency carrying a published advisoryhigh8 occurrences

agentscope@1.0.16 CVE-2026-6604 (medium) +7 more

The pinned version is the one that installs, so a published advisory against it describes this deployment rather than a hypothetical one, and the advisory is also a public description of how to exploit it.

Fix: Upgrade to the fixed version named in the advisory, then commit the lockfile.

Commit a lockfile beside the manifesthigh

pyproject.toml

manifest with no lockfile in scope

An unlocked range means the artifact you tested and the artifact you ship can contain different transitive code, so a malicious patch release reaches production with no diff.

Fix: Run the package manager once and commit the generated lockfile.

Declare least-privilege permissions for GITHUB_TOKENmedium2 occurrences

.github/workflows/docker-release.yml

2 workflow(s) declare no permissions, 1 of them reference secrets

With no declaration the token inherits the repository default, so any injected step can push commits or mint releases from inside your own CI.

Fix: Add permissions: contents: read at the top of the workflow and widen per job only where needed.

Enable Dependabot or Renovatemedium

3 manifest(s), no update bot configured

Without a bot a published advisory sits unpatched until someone audits by hand, which across 1,322 repositories means never.

Fix: Commit .github/dependabot.yml covering the repo ecosystems plus github-actions.

Pin the container base image by digestmedium2 occurrences

deploy/Dockerfile

agentscope-registry.ap-southeast-1.cr.aliyuncs.com/agentscope/node:slim, agentscope-registry.ap-southeast-1.cr.aliyuncs.com/agentscope/node:slim

An untagged or mutable base means today's build and last month's contain different libc and a different CVE set, with no record of which shipped.

Fix: Use image:tag@sha256:<digest> and enable Dependabot's docker ecosystem.

Gate pull requests on a dependency vulnerability scanmedium

.github/workflows

no dependency scan in CI

This is the one gate that would catch a known-vulnerable package before it reaches a build, and no repository in the sample had it.

Fix: Add dependency-review-action on pull_request, or osv-scanner on push and a schedule.

Move large binaries to Git LFS or out of the repositorymedium

src/copaw/tokenizer/tokenizer.json

1 blobs over 5MB: tokenizer.json 6.7MB

One repository here carries twenty blobs over 5MB including a 10.9MB spreadsheet, so every clone and every CI checkout pays for data nobody diffs.

Fix: Track those extensions with LFS, or move datasets to object storage and fetch them in a setup step.

Set persist-credentials: false on checkoutmedium

.github/workflows/deploy-website.yml

checkout keeps the token, then dependencies are installed

The token stays in .git/config for every later step, so a malicious postinstall script reads a pushable credential without one ever being passed to it.

Fix: Add with: persist-credentials: false, and pass an explicit token only to the step that pushes.

Add a non-root USER to the imagemedium

deploy/Dockerfile

CMD or ENTRYPOINT with no USER directive

A process running as root in the container is root against every mounted volume, and it turns any container escape or writable-mount mistake from a contained problem into a host one.

Fix: Create an unprivileged user, chown what it needs, and end the Dockerfile with USER.

Expand the test suite; it cannot cover this codebasemedium

1 test files against 335 source files (ratio 0.003)

A reviewer reads "has tests" and assumes a safety net that covers two files out of eighty-five, which is how untested paths ship behind a green badge.

Fix: Add tests for the highest fan-in modules first.

Set timeout-minutes on the workflow jobslow4 occurrences

.github/workflows/deploy-website.yml

4 workflow(s) declare no job timeout

A wedged step runs to the six-hour platform default, which on a two-hourly schedule means three runs overlap behind it.

Fix: Add timeout-minutes with a realistic bound to each job.

Checked deterministically against the repository tree and a bounded set of its files: committed credentials, unpinned actions and base images, missing lockfiles and update bots, workflows that discard failures, published advisories against the declared dependencies, runtime configuration, licensing and notebook reproducibility. No language model is involved in this section.

View on GitHub All Projects