The easiest music streaming server available
This report summarizes scanner evidence for IrosTheBeggar/mStream, a JavaScript project with 2,407 GitHub stars. SynthScan examined 152,101 lines of code across 346 source files, recording 1477 pattern matches distributed across 11 syntactic categories. The legacy adjusted pattern signal is 15.4 (Elevated pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Can maintainers explain intent, assumptions, and trade-offs? 939 finding(s).
Are imports declared and package/API names verified? 10 finding(s).
Are wrappers, guards, and repeated structures necessary? 574 finding(s).
Which changes need focused human review? 1477 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 1477 distinct pattern matches across 11 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | test/smoke/docker/yt-dlp-fetch-smoke.sh | 74 | # ── Real release assets (cached) ──────────────────────────────────────────── | COMMENT |
| MEDIUM | test/smoke/docker/yt-dlp-fetch-smoke.sh | 87 | # ── Stores: the pin under its release file name + a latest/ namespace ─────── | COMMENT |
| MEDIUM | rust-parser/src/main.rs | 56 | // ── Config (matches what task-queue.js passes) ────────────────────────────── | COMMENT |
| MEDIUM | rust-parser/src/main.rs | 198 | // ── Walk/sweep ignore rules ───────────────────────────────────────────────── | COMMENT |
| MEDIUM | rust-parser/src/main.rs | 631 | // ── Entry point ───────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | rust-parser/src/main.rs | 1102 | // ── V71: album aggregate refresh ───────────────────────────────────────────── | COMMENT |
| MEDIUM | rust-parser/src/main.rs | 1239 | // ── V72: artist aggregate refresh ──────────────────────────────────────────── | COMMENT |
| MEDIUM | rust-parser/src/main.rs | 1968 | // ── Main scan ─────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | rust-parser/src/main.rs | 2018 | // ── Schema-version guard ──────────────────────────────────────────── | COMMENT |
| MEDIUM | rust-parser/src/main.rs | 2270 | // ── Serial path ────────────────────────────────────────────── | COMMENT |
| MEDIUM | rust-parser/src/main.rs | 2383 | // ── Parallel path ──────────────────────────────────────────── | COMMENT |
| MEDIUM | rust-parser/src/main.rs | 2464 | // ── Writer loop (greedy drain) ────────────────────────── | COMMENT |
| MEDIUM | rust-parser/src/main.rs | 2977 | // ── Per-file processing ───────────────────────────────────────────────────── | COMMENT |
| MEDIUM | rust-parser/src/main.rs | 4349 | // ── Artist / Album helpers ────────────────────────────────────────────────── | COMMENT |
| MEDIUM | rust-parser/src/main.rs | 4872 | // ── Lyrics helpers (V19) ──────────────────────────────────────────────────── | COMMENT |
| MEDIUM | rust-parser/src/main.rs | 4991 | // ── V59: lyrics_search_text derivation ────────────────────────────────────── | COMMENT |
| MEDIUM | rust-parser/src/main.rs | 5171 | // ── Waveform enrichment pass (`--waveform-scan`) ──────────────────────────── | COMMENT |
| MEDIUM | rust-parser/src/main.rs | 5728 | // ── Genre helpers ──────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | rust-parser/src/main.rs | 5777 | // ── MD5 hash ──────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | rust-parser/src/main.rs | 5978 | // ── Waveform generation (symphonia-powered) ─────────────────────────────── | COMMENT |
| MEDIUM | rust-parser/src/main.rs | 6259 | // ── Chromaprint fingerprint (--fingerprint) ───────────────────────────────── | COMMENT |
| MEDIUM | rust-parser/src/main.rs | 6358 | // ── Sampled hashing (threshold hybrid) ────────────────────────────────────── | COMMENT |
| MEDIUM | rust-parser/src/main.rs | 6629 | // ── Album art (V48 multi-art) ──────────────────────────────────────────────── | COMMENT |
| MEDIUM | rust-parser/src/main.rs | 6931 | // ── Image compression ─────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | rust-parser/src/main.rs | 6968 | // ── ID3v2 pre-read normaliser ─────────────────────────────────────────────── | COMMENT |
| MEDIUM | rust-parser/src/main.rs | 7640 | // ── Utilities ─────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | webapp/admin/index.js | 457 | // ── Backup destinations (V28) ─────────────────────────────────── | COMMENT |
| MEDIUM | webapp/admin/index.js | 3885 | // ── Federation ────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | webapp/admin/index.js | 4078 | // ── Federation requests (the Requests card) ────────────────────── | COMMENT |
| MEDIUM | webapp/admin/index.js | 5123 | // ── Path Templates (V41) ────────────────────────────────────── | COMMENT |
| MEDIUM | webapp/admin/index.js | 5132 | // ── Import for Seeding ─────────────────────────────────────── | COMMENT |
| MEDIUM | webapp/admin/index.js | 6088 | // ── Transmission backend actions ───────────────────────────────── | COMMENT |
| MEDIUM | webapp/admin/index.js | 6173 | // ── Library Access (per-vpath path-mapping) ──────────────────── | COMMENT |
| MEDIUM | webapp/admin/index.js | 6283 | // ── Path Templates ─────────────────────────────────────────────── | COMMENT |
| MEDIUM | webapp/admin/index.js | 6364 | // ── Import for Seeding ─────────────────────────────────────────── | COMMENT |
| MEDIUM | webapp/admin/index.js | 6501 | // ── Remove (managed-only, no data) ────────────────────────────── | COMMENT |
| MEDIUM | webapp/admin/index.js | 6598 | // ── qBittorrent backend actions ────────────────────────────────── | COMMENT |
| MEDIUM | webapp/admin/index.js | 6676 | // ── Deluge backend actions ─────────────────────────────────────── | COMMENT |
| MEDIUM | webapp/admin/index.js | 6756 | // ── Backup destinations (V28) ────────────────────────────────────────────── | COMMENT |
| MEDIUM | webapp/admin/index.js | 8017 | // ── Federation-request hooks on the catalog ────────────────────── | COMMENT |
| MEDIUM | webapp/admin/index.js | 8189 | // ── Discovery Plugins ───────────────────────────────────────────────────── | COMMENT |
| MEDIUM | webapp/admin/index.js | 11261 | // ── Backup history modal (V28) ───────────────────────────────────────────── | COMMENT |
| MEDIUM | webapp/admin/index.js | 11353 | // ── Backup destination editor ────────────────────────────────────────────── | COMMENT |
| MEDIUM | webapp/admin/index.js | 11644 | // ── Discovery Plugins · modals ──────────────────────────────────────────── | COMMENT |
| MEDIUM | webapp/torrent/index.js | 208 | // ── Auth + bootstrap ──────────────────────────────────────────────── | COMMENT |
| MEDIUM | webapp/torrent/index.js | 277 | // ── File pick + form wiring ───────────────────────────────────────── | COMMENT |
| MEDIUM | webapp/assets/js/mstream.player.js | 51 | // ── Stats API v2: play sessions ────────────────────────────────────── | COMMENT |
| MEDIUM | webapp/assets/js/mstream.player.js | 472 | // ── Cross-server session (mStream #929) ───────────────────────────── | COMMENT |
| MEDIUM | webapp/assets/js/mstream.player.js | 472 | // ── Cross-server session (mStream #929) ───────────────────────────── | COMMENT |
| MEDIUM | webapp/assets/js/mstream.server-audio.js | 17 | // ── Server Audio Mode Implementation ────────────────────────────────── | COMMENT |
| MEDIUM | webapp/assets/js/mstream.server-audio.js | 22 | // ── API helpers ─────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | webapp/assets/js/mstream.server-audio.js | 52 | // ── State ───────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | webapp/assets/js/mstream.server-audio.js | 90 | // ── Core playback ───────────────────────────────────────────────────── | COMMENT |
| MEDIUM | webapp/assets/js/mstream.server-audio.js | 329 | // ── Status polling ──────────────────────────────────────────────────── | COMMENT |
| MEDIUM | webapp/assets/js/mstream.server-audio.js | 370 | // ── Load existing queue from Rust on page load ──────────────────────── | COMMENT |
| MEDIUM | webapp/assets/js/mstream.server-audio.js | 443 | // ── Hide irrelevant UI elements ─────────────────────────────────────── | COMMENT |
| MEDIUM | webapp/assets/js/mstream.play-session.js | 67 | // ── The session ─────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | webapp/assets/js/mstream.play-session.js | 188 | // ── The outbox ──────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | webapp/alpha/vp.js | 642 | // ── Discover panel ───────────────────────────────────────────── | COMMENT |
| MEDIUM | webapp/alpha/vp.js | 733 | // ── "From your peers" rows ───────────────────────────────────── | COMMENT |
| 468 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | install.sh | 1 | #!/bin/sh | COMMENT |
| LOW | install.sh | 21 | # (app folders, command, menu entry / ~/Applications | COMMENT |
| LOW | install.sh | 161 | # ONE per-user login item by app name ("mStream"), so a second copy of | COMMENT |
| LOW | install.sh | 381 | if command -v ps >/dev/null 2>&1; then | COMMENT |
| LOW | install.sh | 501 | # so a path with a space survives the launcher's word split. | COMMENT |
| LOW | cli-boot-wrapper.js | 21 | // src/util/boot-config.js): source/npm runs keep appRoot/save/conf/... | COMMENT |
| LOW | cli-boot-wrapper.js | 41 | COMMENT | |
| LOW | test/smoke/update-watchdog-smoke.sh | 1 | #!/bin/sh | COMMENT |
| LOW | test/smoke/player-open-smoke.sh | 1 | #!/bin/sh | COMMENT |
| LOW | test/smoke/player-open-smoke.sh | 21 | # `gui --instance-lock <data home>/desktop-player.lock --serve-port 3333 | COMMENT |
| LOW | test/smoke/player-open-smoke.sh | 41 | # 6. a desktop build that names `window-pages` (`features: window | COMMENT |
| LOW | test/smoke/player-open-smoke.sh | 61 | # leg writes setupComplete into the config once the window is up, as | COMMENT |
| LOW | test/smoke/update-apply-smoke.sh | 1 | #!/bin/sh | COMMENT |
| LOW | test/smoke/docker/yt-dlp-fetch-smoke.sh | 1 | #!/bin/bash | COMMENT |
| LOW | test/smoke/docker/yt-dlp-fetch-smoke.sh | 21 | # does not hash to → refused, the installed build kept, logged. | COMMENT |
| LOW | test/smoke/docker/compose.smoke.yaml | 1 | # All-Docker smoke compose: mStream in a container, talking to the | COMMENT |
| LOW | test/smoke/docker/README.md | 41 | docker compose -f test/smoke/docker/compose.smoke.yaml up --build -d | COMMENT |
| LOW | test/smoke/docker/p2p-sidecar-volume-smoke.sh | 1 | #!/bin/bash | COMMENT |
| LOW | test/smoke/docker/p2p-sidecar-volume-smoke.sh | 21 | # | COMMENT |
| LOW | rust-parser/Cargo.toml | 21 | walkdir = "2" | COMMENT |
| LOW | rust-parser/Cargo.toml | 61 | # File-level parallelism for the scan loop and the --waveform-scan | COMMENT |
| LOW | rust-parser/src/main.rs | 41 | // src/db/waveform-lib.js, which owns the scheme. The `w2` generation marks | COMMENT |
| LOW | rust-parser/src/main.rs | 81 | // Accepted-but-ignored: waveform generation moved out of the scan | COMMENT |
| LOW | rust-parser/src/main.rs | 101 | // Default matches the legacy Rust behaviour (walkdir's | COMMENT |
| LOW | rust-parser/src/main.rs | 121 | // fixtures instead of 25MB files. Mirror field in src/db/scanner.mjs. | COMMENT |
| LOW | rust-parser/src/main.rs | 141 | // the directory where a torrent just finished, avoiding a full | COMMENT |
| LOW | rust-parser/src/main.rs | 161 | COMMENT | |
| LOW | rust-parser/src/main.rs | 281 | file_hash: Option<String>, | COMMENT |
| LOW | rust-parser/src/main.rs | 301 | // under (tracks.hash_v). Carried into sweep candidates so move | COMMENT |
| LOW | rust-parser/src/main.rs | 401 | COMMENT | |
| LOW | rust-parser/src/main.rs | 421 | // when the schemes agree. | COMMENT |
| LOW | rust-parser/src/main.rs | 461 | byte_size: Option<i64>, | COMMENT |
| LOW | rust-parser/src/main.rs | 481 | // the scan_progress.current_file column — pre-computed in the worker | COMMENT |
| LOW | rust-parser/src/main.rs | 501 | // throughput gain. The cap also bounds peak memory: each worker | COMMENT |
| LOW | rust-parser/src/main.rs | 521 | // Process-wide unique sequence used by `write_atomic` to give each | COMMENT |
| LOW | rust-parser/src/main.rs | 661 | // exits 0. task-queue.js's findRustParser runs it before every | COMMENT |
| LOW | rust-parser/src/main.rs | 841 | COMMENT | |
| LOW | rust-parser/src/main.rs | 861 | } | COMMENT |
| LOW | rust-parser/src/main.rs | 881 | // LIMIT goes on a subselect rather than the DELETE itself. | COMMENT |
| LOW | rust-parser/src/main.rs | 921 | // V48 multi-art: stale-art reaping. Disk is the source of truth, exactly | COMMENT |
| LOW | rust-parser/src/main.rs | 941 | // image files are never touched. | COMMENT |
| LOW | rust-parser/src/main.rs | 1101 | // in a rand dependency for one modulus would be overkill. | COMMENT |
| LOW | rust-parser/src/main.rs | 1241 | // Since V72 an artist row's display `name`, `order_name`, `track_count` and | COMMENT |
| LOW | rust-parser/src/main.rs | 1421 | } | COMMENT |
| LOW | rust-parser/src/main.rs | 1461 | list.min_by(|a, b| key(a).cmp(&key(b)).then_with(|| a.rel.cmp(&b.rel))) | COMMENT |
| LOW | rust-parser/src/main.rs | 1581 | COMMENT | |
| LOW | rust-parser/src/main.rs | 1601 | // `!=` — even after its file was deleted from disk. Such rows are | COMMENT |
| LOW | rust-parser/src/main.rs | 1621 | // must keep data, only NotFound proves deletion) — fail closed; | COMMENT |
| LOW | rust-parser/src/main.rs | 1641 | // mid-sweep, every listing would suddenly read NotFound and the sweep | COMMENT |
| LOW | rust-parser/src/main.rs | 1941 | // full commit_track with FTS + M2M fan-out), so a pure row count | COMMENT |
| LOW | rust-parser/src/main.rs | 1961 | // that the timeout probability drops to ~zero (p99 wait ~200ms), costing | COMMENT |
| LOW | rust-parser/src/main.rs | 1981 | "library directory not accessible: {}", config.directory | COMMENT |
| LOW | rust-parser/src/main.rs | 2061 | // otherwise probes 21 `<base>.<lang>.lrc` candidates + `<base>.txt` | COMMENT |
| LOW | rust-parser/src/main.rs | 2081 | // Genres are keyed by name alone. | COMMENT |
| LOW | rust-parser/src/main.rs | 2121 | // Walk once, keeping only supported audio files paired with their | COMMENT |
| LOW | rust-parser/src/main.rs | 2221 | "INSERT OR REPLACE INTO scan_progress (scan_id, library_id, vpath, scanned, expected) VALUES (?1, ?2, ?3, 0, ?4) | COMMENT |
| LOW | rust-parser/src/main.rs | 2241 | // verify-absence check finds the file on disk and keeps them — same | COMMENT |
| LOW | rust-parser/src/main.rs | 2261 | // Goes to stdout (not stderr) so task-queue.js's handleStderrLine | COMMENT |
| LOW | rust-parser/src/main.rs | 2381 | } | COMMENT |
| LOW | rust-parser/src/main.rs | 2461 | // would wait forever for a message that can't come. | COMMENT |
| 811 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | webapp/assets/js/lib/qr.js | 513 | function getAlignmentPatternPositions() { | CODE |
| LOW⚡ | webapp/alpha/m.js | 3750 | function toggleDiscoverDownloadsAll(el) { | CODE |
| LOW⚡ | webapp/alpha/m.js | 3755 | function toggleDiscoverDownloadsRemoved(el) { | CODE |
| LOW⚡ | webapp/alpha/m.js | 3761 | function showDiscoverDownloadInLibrary(el) { | CODE |
| LOW | webapp/alpha/m.js | 311 | function renderFileWithMetadataHtml(filepath, lokiId, metadata) { | CODE |
| LOW | webapp/alpha/m.js | 1729 | function sanitiseTorrentPathSegment(s) { | CODE |
| LOW | webapp/alpha/m.js | 2141 | function updateAddTorrentPathPreview() { | CODE |
| LOW | webapp/alpha/m.js | 3660 | function discoverDownloadPluginTitle(name) { | CODE |
| LOW | webapp/alpha/m.js | 3711 | function renderDiscoverDownloadRow(row) { | CODE |
| LOW | src/util/boot-config.js | 104 | export async function ensureDesktopDefaultConfig(resolved, { quickConnectOffByDefault = false } = {}) { | CODE |
| LOW | src/util/admin.js | 448 | export async function editDiscoveryPluginSettings(name, settings) { | CODE |
| LOW | src/util/admin.js | 469 | export async function editUserAllowDiscoveryJobs(username, allow) { | CODE |
| LOW | src/util/admin.js | 619 | export async function editArtistSplitExceptions(list) { | CODE |
| LOW | src/util/admin.js | 732 | export async function editDiscoveryServerDescription(val) { | CODE |
| LOW | src/util/admin.js | 863 | export async function editAutoAlbumArtWriteToFolder(val) { | CODE |
| LOW | src/util/admin.js | 879 | export async function editAlbumArtWriteToFolder(val) { | CODE |
| LOW | src/state/config.js | 36 | export function deriveModelCacheDirectory(dbDirectory) { | CODE |
| LOW | src/state/federation.js | 135 | export function buildFederationGuestTicket({ endpointTicket, guestToken }) { | CODE |
| LOW | src/state/federation.js | 144 | export function parseFederationGuestTicket(str) { | CODE |
| LOW | src/torrent/constants.js | 127 | export function clientNeedsPadFilesOnDisk(clientType) { | CODE |
| LOW | src/torrent/path-probe.js | 551 | export async function daemonKnownPathsCandidates(vpath, creds, clientType, memo) { | CODE |
| LOW | src/torrent/path-probe.js | 593 | export async function symlinkAndRealpathCandidates(vpath) { | CODE |
| LOW | src/torrent/vpath-sweep.js | 33 | export async function sweepVpathsForActiveClient(libraries) { | CODE |
| LOW | src/db/discovery-features-lib.js | 208 | function rethrowIfCacheDirUnwritable(err, modelCacheDir) { | CODE |
| LOW | src/db/discovery-db.js | 367 | export function fillCatalogueFieldsFromLibrary(libSchema = 'lib') { | CODE |
| LOW | src/db/discovery-db.js | 531 | export function applyHashTransitionGroups(groups) { | CODE |
| LOW | src/db/manager.js | 777 | export function getBackupDestinationsByLibrary(libraryId, { triggerType, enabledOnly = true } = {}) { | CODE |
| LOW | src/db/manager.js | 791 | export function getBackupDestinationsByTrigger(triggerType) { | CODE |
| LOW | src/db/manager.js | 944 | export function markStaleBackupRunsFailed(excludeHistoryId = null) { | CODE |
| LOW | src/db/manager.js | 1024 | export function getLastCountedBackupBefore(destinationId, beforeHistoryId) { | CODE |
| LOW | src/db/federation.js | 96 | export function getFederationKeyLibraries(keyId) { | CODE |
| LOW | src/db/federation.js | 113 | export function bindFederationKeyEndpoint(id, endpointId) { | CODE |
| LOW | src/db/federation.js | 123 | export function resetFederationKeyBinding(id) { | CODE |
| LOW | src/db/federation.js | 136 | export function touchFederationKeyLastUsed(id) { | CODE |
| LOW | src/db/federation.js | 198 | export function updateFederationPeerStatus(id, status) { | CODE |
| LOW | src/db/federation.js | 209 | export function setFederationPeerUseDiscovery(id, enabled) { | CODE |
| LOW | src/db/task-queue.js | 78 | export function setOnScanCompleteCallback(fn) { onScanCompleteCallback = fn; } | CODE |
| LOW | src/db/task-queue.js | 462 | function checkQueueDrainedSideEffects() { | CODE |
| LOW | src/db/task-queue.js | 500 | async function applyHashTransitionsInner() { | CODE |
| LOW | src/db/task-queue.js | 632 | function checkQueueDrainedSideEffectsInner() { | CODE |
| LOW | src/db/task-queue.js | 1302 | async function runWaveformFfmpegFallback() { | CODE |
| LOW | src/db/task-queue.js | 1733 | export function maybeEnqueueAudioAnalysis() { | CODE |
| LOW | src/db/task-queue.js | 2549 | export function cancelBackupsForDestination(destinationId) { | CODE |
| LOW | src/api/federation-auth.js | 188 | export function authenticateFederationKey(key, req) { | CODE |
| LOW | src/api/server-playback.js | 181 | export function rewriteIndexForServerAudio(page) { | CODE |
| LOW | src/api/scrobbler.js | 59 | export async function fetchLastfmSimilarArtists(artist, apiKey) { | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | webapp/torrent/index.js | 353 | // Step 1: seed-existing check unless the user opted out. | COMMENT |
| LOW | webapp/torrent/index.js | 434 | // Step 2: /torrent/add. | COMMENT |
| LOW | src/torrent/tag-probe.js | 119 | // Step 1: add paused. | COMMENT |
| LOW⚡ | src/torrent/tag-probe.js | 138 | // Step 2: set file priorities. Skip everything except the target. | COMMENT |
| LOW⚡ | src/torrent/tag-probe.js | 141 | // Step 3: resume. | COMMENT |
| LOW⚡ | src/torrent/tag-probe.js | 144 | // Step 4: poll for bytes. | COMMENT |
| LOW | src/torrent/tag-probe.js | 179 | // Step 7: always clean up. delete-local-data: true makes the | COMMENT |
| LOW | src/api/torrent.js | 237 | // Step 1: Content-Length pre-check. Reject before reading bytes. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | webapp/torrent/index.js | 353 | // Step 1: seed-existing check unless the user opted out. | COMMENT |
| LOW | src/torrent/tag-probe.js | 119 | // Step 1: add paused. | COMMENT |
| LOW⚡ | src/torrent/tag-probe.js | 138 | // Step 2: set file priorities. Skip everything except the target. | COMMENT |
| LOW⚡ | src/torrent/tag-probe.js | 141 | // Step 3: resume. | COMMENT |
| LOW⚡ | src/torrent/tag-probe.js | 144 | // Step 4: poll for bytes. | COMMENT |
| LOW | src/torrent/tag-probe.js | 179 | // Step 7: always clean up. delete-local-data: true makes the | COMMENT |
| LOW | src/api/torrent.js | 237 | // Step 1: Content-Length pre-check. Reject before reading bytes. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | webapp/index.html | 107 | <input id="spath_playlist_name" autocomplete="off" type="text" required placeholder="Enter your playlist n | CODE |
| LOW | webapp/index.html | 132 | <textarea id="share-textarea" autocomplete="off" rows="8" cols="60" placeholder="Your URL will be put here" re | CODE |
| LOW | webapp/index.html | 186 | <input id="playlist_name" autocomplete="off" type="text" required placeholder="Enter your playlist name" pat | CODE |
| LOW | webapp/index.html | 220 | <input id="new-live-playlist-name" type="text" name="live-queue-name" placeholder="Playlist Name" autoco | CODE |
| LOW | webapp/index.html | 254 | <input autocomplete="off" id="new_playlist_name" type="text" required placeholder="Enter your playlist name" | CODE |
| LOW | webapp/index.html | 292 | <input id="ytdl_url" autocomplete="off" type="url" required placeholder="Enter URL" style="color:#fff;" da | CODE |
| LOW | webapp/index.html | 351 | <input id="mkdir_name" autocomplete="off" type="text" required placeholder="Folder name" pattern="[a-zA-Z0-9 | CODE |
| LOW | webapp/index.html | 832 | <input id="localSearchBar" onkeyup="runLocalSearch(this)" type="text" placeholder="Search List" autocomplete | CODE |
| LOW | webapp/assets/js/lib/vue2.js | 11 | !function(t,e){"object"==typeof exports&&"undefined"!=typeof module?module.exports=e():"function"==typeof define&&define | CODE |
| LOW | webapp/assets/js/lib/materialize.js | 6 | var _get=function t(e,i,n){null===e&&(e=Function.prototype);var s=Object.getOwnPropertyDescriptor(e,i);if(void 0===s){va | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | test/smoke/docker/compose.smoke.yaml | 28 | # Host port 8915 so the smoke harness can hit mStream without | COMMENT |
| MEDIUM | .github/workflows/test.yml | 261 | # the test harness on top of the release build. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | test/smoke/docker/yt-dlp-fetch-smoke.sh | 38 | # Usage: | COMMENT |
| LOW | test/smoke/docker/p2p-sidecar-volume-smoke.sh | 28 | # Usage: | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | .github/workflows/build-bun.yml | 1549 | # This file is LOAD-BEARING: the end-of-smoke asserts require the | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | src/state/config.js | 553 | // invisibly. See discovery-catalog.pruneStalePeers for the guardrails. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | src/state/federation-requests.js | 456 | function handleRequest(from, payload) { | CODE |