Main Thread Tool Calls
1.5K
6 unique tools
Sub-agent Tool Calls
1.5K
exec (shell sandbox)
Sub-agents
4
Codex multi-agent team mode
Estimated Cost
$5.62
375.3M tokens
Tool Usage per Sub-agent
4 agents
Tool Usage per Sub-agent
Code Quality Assessment
PHPMetrics
Code Quality Assessment
Code Quality Assessment
PHPMetrics 2.11.0Classes
194
Lines of Code
10.4K
Avg MI
68.2
Avg Complexity
11.4
Est. Bugs
59.6
max 7.2 in AdminController
Violations
0
0 errors, 0 warnings
Complexity Distribution
Maintainability Distribution
Most Complex Classes
AdminStoreConfigurationService
App\Services
AdminController
App\Http\Controllers\Api
AdminProductApiService
App\Services
Index
App\Livewire\Admin\Navigation
StorefrontController
App\Http\Controllers\Api
Least Maintainable
AdminController
Api · CCN 141 · 495 LOC
StorefrontController
Api · CCN 73 · 285 LOC
Index
Navigation · CCN 105 · 439 LOC
AdminStoreConfigurationService
Services · CCN 152 · 345 LOC
Form
Products · CCN 70 · 264 LOC
Most Coupled Classes
AdminController
24StorefrontController
22CheckoutService
19Index (Navigation)
16DispatchWebhooks
16Max Efferent
24
Max LCOM
9
Notes
- •PHPMetrics flags 0 rule violations across 194 classes, with an average MI of 68.2, pulled down by a heavy low-maintainability tail (40.7% of classes score below 55), led by AdminController (CCN 141, MI 10.9, 495 LOC, coupling 24) and AdminStoreConfigurationService (CCN 152, MI 18.7).
- •SonarCloud tells a different story: 152 unresolved issues on PR #31 (39 critical, 105 major, 8 minor) = 5 bugs, 2 vulnerabilities, and 145 code smells. The quality gate FAILED on new-code reliability (C) AND new-code security (C); maintainability passed (A) and duplication passed (1.1% vs a 3% threshold).
- •The 5 BUGs are all accessibility issues: two admin pages missing a <title> tag and three inputs (domains, developer token forms) missing an associated label. The 2 VULNERABILITYs are an unsafe pseudorandom generator used for storefront analytics client IDs and the same unbounded content-length check on a settings upload request seen on prior builds (potential DoS via oversized files).
- •10.4K class-LOC (16.7K ncloc) across 194 classes, with two admin-side God classes standing out: AdminController (24 admin API endpoints in one controller, CCN 141) and AdminStoreConfigurationService (CCN 152, the single highest-complexity class in the report). Both are a direct result of the admin API build-out that spec_audit kept pushing for.
SonarCloud Analysis
PR #31 - Quality Gate Failed
SonarCloud Analysis
SonarCloud Analysis
PR #31 · 2026-09-23-codex-luna-6 → mainReliability on New Code
Security on New Code
Maintainability on New Code
Duplicated Lines on New Code
Security Hotspots Reviewed
Bugs
5
Vulnerabilities
2
Code Smells
145
Security Hotspots
0
Lines of Code
16.7K
Duplication
1.1%
Tech Debt
30h
1808 min
Reliability
C
new code
Security
C
new code
Maintainability
A
new code
Issues by Severity (152 total)
145 of the 152 issues are code smells. The gate still fails on both new-code reliability (C) and new-code security (C). The 5 BUGs are all accessibility gaps (missing page titles, unassociated form labels); the 2 VULNERABILITYs are an unbounded content-length check on a settings upload request and an insecure Math.random() used for an analytics client ID.
Top Issue Rules
Cognitive Complexity of functions should not be too high
Concentrated in the largest admin services and controllers: RefundService (51 vs. 15 allowed), the media-upload controller and job, and the same admin API surface that PHPMetrics also flags as the most complex in the report.
Prefer tag over ARIA role
Admin Blade partials (settings, analytics) use role="status"/role="img" instead of the native <output>/<img> elements for live-region and image content.
Accessible name should be part of the visible label
Icon-only or ARIA-labelled controls (cart count, shipping settings, storefront nav menu) whose accessible name doesn't textually contain the visible label.
String literals should not be duplicated
Repeated literals in admin settings components, e.g. "Standard Shipping" (3x) and the "19.00" default tax rate (3x), hardcoded instead of centralized into constants.
Functions should not contain too many return statements
Guard-clause-heavy middleware and admin components: AuthenticateApiToken (5 returns), ResolveStore (4), the Navigation admin component (4), each over the 3-return threshold.
Generic exceptions should not be thrown
Background export/analytics jobs (GenerateAnalyticsExport and siblings) throw bare Exception instead of a domain-specific hierarchy.
Images should have a non-redundant alternate description
Product-image alt text across admin product forms and storefront cart/order views repeats the word "image" redundantly.
Ternary operators should not be nested
Nested ternary chains in ResolveStore middleware and the Shipping settings component's rate-calculation branching.
Content length should be limited when uploading files
One of the two VULNERABILITY-type findings: the store-configuration upload request has no content-length cap, a potential DoS vector via oversized uploads. Prior builds had the same finding.
Pseudorandom number generators should not be used in security-sensitive contexts
The other VULNERABILITY: the storefront analytics client-ID generator uses Math.random() rather than a cryptographically secure source.
The issue mix skews toward cognitive-complexity findings in the largest admin services (RefundService, the media-upload pipeline) and duplicated-literal smells in admin settings components, alongside a heavy dose of ARIA/accessibility findings on the admin Blade views the run's implementer sub-agent built. That fits a team of 4 agents writing Blade partials and guard clauses in parallel, each on its own, without a shared base.