Main Thread Tool Calls
2.5K
36 unique tools
Sub-agent Tool Calls
942
exec_command / apply_patch / Playwright MCP
Sub-agents
23
Codex multi-agent v2
Estimated Cost
$9.85
10.0M tokens
Tool Usage per Sub-agent
23 agents
Tool Usage per Sub-agent
Code Quality Assessment
PHPMetrics
Code Quality Assessment
Code Quality Assessment
PHPMetrics 2.9.1Classes
226
Lines of Code
7.1K
Avg MI
75.0
Avg Complexity
5.1
Est. Bugs
29.3
max 3.0 in AdminController
Violations
0
0 errors, 0 warnings
Complexity Distribution
Maintainability Distribution
Most Complex Classes
ProductService
App\Services
AdminController
App\Http\Controllers\Api
Show
App\Livewire\Storefront\Checkout
Form
App\Livewire\Admin\Discounts
OrderService
App\Services
Least Maintainable
AdminController
Api · CCN 60 · 305 LOC
Show
Checkout · CCN 42 · 237 LOC
CartService
Services · CCN 26 · 106 LOC
Show
Cart · CCN 13 · 104 LOC
CheckoutService
Services · CCN 20 · 97 LOC
Most Coupled Classes
AdminController
43Order
26Product
23User
21Store
18Max Efferent
43
Max LCOM
7
Notes
- •PHPMetrics flags 0 rule violations across 226 classes, with an average MI of 75.0 - pulled down by a heavy low-maintainability tail (30.5% of classes score below 55), led by AdminController (39 methods, CCN 60, MI 14.5, coupling 43).
- •SonarCloud tells a different story: 49 unresolved issues on PR #28 (15 critical, 32 major, 2 minor) = 1 bug, 1 vulnerability, and 47 code smells. The quality gate FAILED on new-code reliability (C) AND new-code security (C); maintainability passed (A) and duplication passed (0.4% vs a 3% threshold).
- •The single BUG is a missing id/label pairing on the storefront search-modal input (accessibility). The single VULNERABILITY is an unbounded content-length check on the theme-upload request (potential DoS via oversized files).
- •7.1K class-LOC (12.2K ncloc) across 226 classes, with AdminController standing out as a God-class outlier: 39 methods (S1448), CCN 60, and the highest single-class Halstead bug estimate (2.99) and coupling (43) in the report.
SonarCloud Analysis
PR #28 - Quality Gate Failed
SonarCloud Analysis
SonarCloud Analysis
PR #28 · 2026-08-20-codex-gpt-5-6-luna → mainReliability on New Code
Security on New Code
Maintainability on New Code
Duplicated Lines on New Code
Security Hotspots Reviewed
Bugs
1
Vulnerabilities
1
Code Smells
47
Security Hotspots
0
Lines of Code
12.2K
Duplication
0.5%
Tech Debt
10h
611 min
Reliability
C
new code
Security
C
new code
Maintainability
A
new code
Issues by Severity (49 total)
48 of the 49 issues are code smells or the single vulnerability rather than functional bugs - the gate fails on both new-code reliability (C) and new-code security (C). The lone BUG is a missing input/label pairing on the storefront search modal; the lone VULNERABILITY is an unbounded content-length check on the theme-upload request.
Top Issue Rules
Prefer tag over ARIA role
Layout partials (storefront, admin) and the product-page component use role="status" for live-region updates instead of the native <output> element.
Cognitive Complexity of functions should not be too high
Concentrated in API guard-clause middleware (EnsureApiAbility, ResolveStore) and core services (OrderService, PaymentService) that branch heavily to validate abilities, resolve the tenant store, and negotiate order/payment state.
String literals should not be duplicated
Repeated route-path literals, date-format strings, and seeder fixture text (emails, product names) duplicated 3-6x instead of centralized into constants.
Ternary operators should not be nested
Nested ternary chains in the ShippingSeeder fixture data and in status-branching logic (Section, FulfillmentService).
Functions should not contain too many return statements
Guard-clause-heavy checkout/middleware methods - EnsureApiAbility alone has 10 return statements, the same method flagged for cognitive complexity above.
Generic exceptions should not be thrown
Background jobs (media upload, webhook delivery) and the Stripe tax provider integration throw bare exceptions instead of a domain-specific hierarchy.
Functions should not have too many parameters
Seeder factory methods take large flat parameter lists - ProductSeeder alone takes 16 - instead of a DTO/array.
Content length should be limited when uploading files
The only VULNERABILITY-type finding: the theme upload request has no content-length cap, a potential DoS vector via oversized uploads.
Images should have a non-redundant alternate description
Product-image alt text on the storefront PDP repeats the word "image" redundantly.
Two methods should not have the same implementation
Theme model has a method whose body is identical to settings, defined a few lines above.
The issue mix skews toward cognitive-complexity and duplicated-string findings concentrated in API guard-clause middleware and core services, alongside scattered ARIA/accessibility and generic-exception smells - consistent with a 23-agent multi-agent-v2 team pipeline where guard clauses and seeder fixtures were reimplemented independently per agent rather than shared.