2.4

Adjusted Signal

2.4

Raw Pattern Score

100%

Time Factor

2026-11-01

Last Push

57.6K

Stars

TypeScript

Language

691.3K

Lines of Code

2.7K

Files

979

Pattern Hits

2026-10-31

Scan Date

0.01

HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 4.0/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 542 finding(s).

Hallucinated Dependency & Supply Chain Risk 2.2/100 · LOW

Are imports declared and package/API names verified? 182 finding(s).

Agent Over-Engineering Ratio 8.3/100 · LOW

Are wrappers, guards, and repeated structures necessary? 648 finding(s).

PR Review Velocity Impact 11.0/100 · LOW

Which changes need focused human review? 979 finding(s).

What These Metrics Mean

Adjusted Signal: Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score: Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor: A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits: Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate: High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files: Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 13HIGH 1MEDIUM 254LOW 711

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 979 distinct pattern matches across 8 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Decorative Section Separators254 hits · 794 pts

Severity	File	Line	Snippet	Context
MEDIUM	e2e/task-recovery.spec.ts	71	// ─── Run 1: add → downloading → pause → SIGKILL ──────────────	COMMENT
MEDIUM	e2e/task-recovery.spec.ts	116	// ─── Run 2: relaunch → assert restore ────────────────────────	COMMENT
MEDIUM	src/renderer/routes/settings/cards/downloads-form.ts	9	// ─── Form shape ────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	src/core/settings/validators.ts	14	// ─── Zod Schemas ──────────────────────────────────────────────	COMMENT
MEDIUM	src/core/settings/validators.ts	54	// ─── Speed Limit Settings ─────────────────────────────────────	COMMENT
MEDIUM	src/core/settings/validators.ts	62	// ─── Tracker Settings ─────────────────────────────────────────	COMMENT
MEDIUM	src/core/settings/validators.ts	75	// ─── Validation functions ─────────────────────────────────────	COMMENT
MEDIUM	src/core/plugin/host/capability-bridge.ts	1451	// ── op lifecycle methods ───────────────────────────────────────────────	COMMENT
MEDIUM	src/core/plugin/host/capability-bridge.ts	1512	// ── launch methods ─────────────────────────────────────────────────────	COMMENT
MEDIUM	src/core/plugin/host/quick-js-worker.ts	1540	// ── log ────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	src/core/plugin/host/quick-js-worker.ts	1561	// ── app ────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	src/core/plugin/host/quick-js-worker.ts	1578	// ── i18n ───────────────────────────────────────────────────────────────	COMMENT
MEDIUM	src/core/plugin/host/quick-js-worker.ts	1610	// ── hooks ──────────────────────────────────────────────────────────────	COMMENT
MEDIUM	src/core/plugin/host/quick-js-worker.ts	1630	// ── commands ───────────────────────────────────────────────────────────	COMMENT
MEDIUM	src/core/plugin/host/quick-js-worker.ts	1718	// ── lifecycle ──────────────────────────────────────────────────────────	COMMENT
MEDIUM	src/core/plugin/host/quick-js-worker.ts	1744	// ── http ───────────────────────────────────────────────────────────────	COMMENT
MEDIUM	src/core/plugin/host/quick-js-worker.ts	1750	// ── storage ────────────────────────────────────────────────────────────	COMMENT
MEDIUM⚡	src/core/plugin/host/quick-js-worker.ts	1761	// ── crypto ─────────────────────────────────────────────────────────────	COMMENT
MEDIUM⚡	src/core/plugin/host/quick-js-worker.ts	1771	// ── config ─────────────────────────────────────────────────────────────	COMMENT
MEDIUM⚡	src/core/plugin/host/quick-js-worker.ts	1776	// ── notify ─────────────────────────────────────────────────────────────	COMMENT
MEDIUM⚡	src/core/plugin/host/quick-js-worker.ts	1781	// ── fs.storage ─────────────────────────────────────────────────────────	COMMENT
MEDIUM	src/core/plugin/host/quick-js-worker.ts	1794	// ── fs.task ────────────────────────────────────────────────────────────	COMMENT
MEDIUM	src/core/plugin/host/quick-js-worker.ts	1865	// ── ffmpeg ─────────────────────────────────────────────────────────────	COMMENT
MEDIUM	src/core/plugin/host/test-helpers.ts	35	// ── Plan A ────────────────────────────────────────────────────────────	COMMENT
MEDIUM	src/core/plugin/host/test-helpers.ts	66	// ── Plan B stubs ──────────────────────────────────────────────────────	COMMENT
MEDIUM	src/core/plugin/host/e2e-capabilities.test.ts	68	// ── Plan A ──────────────────────────────────────────────────────────────	COMMENT
MEDIUM	src/core/plugin/host/e2e-capabilities.test.ts	92	// ── Plan B ──────────────────────────────────────────────────────────────	COMMENT
MEDIUM	src/core/plugin/host/e2e-capabilities.test.ts	118	// ── Boot assertions ──────────────────────────────────────────────────	COMMENT
MEDIUM	src/core/plugin/host/e2e-capabilities.test.ts	139	// ── Command invocation assertions ────────────────────────────────────	COMMENT
MEDIUM	src/core/plugin/host/capability-bridge.phase.test.ts	255	// ── 1. Idle phase passes through ────────────────────────────────────────	COMMENT
MEDIUM	src/core/plugin/host/capability-bridge.phase.test.ts	273	// ── 2. Disallowed verdict ────────────────────────────────────────────────	COMMENT
MEDIUM	src/core/plugin/host/capability-bridge.phase.test.ts	305	// ── 3. Staged ctx.update beforeCreate ───────────────────────────────────	COMMENT
MEDIUM	src/core/plugin/host/capability-bridge.phase.test.ts	341	// ── 4. Staged metadata.set beforeCreate ─────────────────────────────────	COMMENT
MEDIUM	src/core/plugin/host/capability-bridge.phase.test.ts	377	// ── 5. Audit role + ctx.update → fails with AuditRoleCannotMutate ───────	COMMENT
MEDIUM	src/core/plugin/host/capability-bridge.phase.test.ts	415	// ── 5b. ctx.update without fs.task.write permission → fails ─────────────	COMMENT
MEDIUM	src/core/plugin/host/capability-bridge.phase.test.ts	445	// ── 6. Staged metadata.delete beforeFinalize ────────────────────────────	COMMENT
MEDIUM	src/core/plugin/host/capability-bridge.phase.test.ts	478	// ── 7. clearHookContext resets phase to idle ─────────────────────────────	COMMENT
MEDIUM	src/core/plugin/host/capability-bridge.phase.test.ts	510	// ── 8. afterComplete: metadata.set is disallowed ─────────────────────────	COMMENT
MEDIUM	src/core/plugin/host/capability-bridge.phase.test.ts	538	// ── 9. beforeCreate: fs.task.stat is disallowed ──────────────────────────	COMMENT
MEDIUM	src/core/plugin/host/capability-bridge.phase.test.ts	566	// ── 10. beforeFinalize: ctx.update filePath staged ───────────────────────	COMMENT
MEDIUM	src/core/plugin/host/capability-bridge.phase.test.ts	604	// ── 12. FfmpegStaging wiring: beforeFinalize redirects outputPath ────────	COMMENT
MEDIUM	src/core/plugin/host/capability-bridge.phase.test.ts	701	// ── 14. FfmpegStaging wiring: beforeCreate does NOT redirect ────────────	COMMENT
MEDIUM	…core/plugin/host/capability-bridge.ffmpeg-gate.test.ts	390	// ── 1. rejects saveDir output in beforeCreate ───────────────────────────	COMMENT
MEDIUM	…core/plugin/host/capability-bridge.ffmpeg-gate.test.ts	424	// ── 2. rejects saveDir output in afterComplete ──────────────────────────	COMMENT
MEDIUM	…core/plugin/host/capability-bridge.ffmpeg-gate.test.ts	457	// ── 3. rejects saveDir output in onError ───────────────────────────────	COMMENT
MEDIUM	…core/plugin/host/capability-bridge.ffmpeg-gate.test.ts	538	// ── 5. allows pluginStorage output in any phase without staging ─────────	COMMENT
MEDIUM	src/core/plugin/capabilities/interface.ts	54	// ── Plan A ────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	src/core/plugin/capabilities/interface.ts	72	// ── Plan B ────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	src/core/plugin/hooks/hook-context.test.ts	26	// ── helpers ──────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	src/core/plugin/hooks/hook-context.test.ts	198	// ── makeBeforeCreateHttp ──────────────────────────────────────────────────────	COMMENT
MEDIUM	src/core/plugin/hooks/hook-context.test.ts	287	// ── makeBeforeCreateBt ────────────────────────────────────────────────────────	COMMENT
MEDIUM	src/core/plugin/hooks/hook-context.test.ts	311	// ── makeBeforeFinalize ────────────────────────────────────────────────────────	COMMENT
MEDIUM	src/core/plugin/hooks/hook-context.test.ts	360	// ── makeAfterComplete ─────────────────────────────────────────────────────────	COMMENT
MEDIUM	src/core/plugin/hooks/hook-context.test.ts	374	// ── makeOnError ───────────────────────────────────────────────────────────────	COMMENT
MEDIUM	src/core/plugin/hooks/staged-effects.test.ts	34	// ── 1. starts empty ──────────────────────────────────────────────────────────	COMMENT
MEDIUM	src/core/plugin/hooks/staged-effects.test.ts	42	// ── 2. HTTP patch merge ──────────────────────────────────────────────────────	COMMENT
MEDIUM	src/core/plugin/hooks/staged-effects.test.ts	95	// ── 3. appendMeta set + commitMetadata writes rows ───────────────────────────	COMMENT
MEDIUM	src/core/plugin/hooks/staged-effects.test.ts	221	// ── 4. appendMeta delete removes rows ────────────────────────────────────────	COMMENT
MEDIUM	src/core/plugin/hooks/staged-effects.test.ts	243	// ── 5. tx callback runs inside the same transaction ──────────────────────────	COMMENT
MEDIUM	src/core/plugin/hooks/staged-effects.test.ts	270	// ── 6. tx throw rolls back everything ────────────────────────────────────────	COMMENT
194 more matches not shown…

Hyper-Verbose Identifiers393 hits · 398 pts

Severity	File	Line	Snippet	Context
LOW	tests/check-third-party-notices.test.ts	421	function registryPackagesFromCargoLock(	CODE
LOW⚡	tests/scripts/test_flatpak_node_generator.py	76	async def test_fixture_exceeds_the_unmodified_client_limit(self):	CODE
LOW⚡	tests/scripts/test_flatpak_node_generator.py	80	async def test_larger_redirect_and_payload_headers_preserve_source_bytes(self):	CODE
LOW⚡	tests/scripts/test_flatpak_node_generator.py	86	async def test_headers_above_the_bound_still_fail_after_upstream_retries(self):	CODE
LOW⚡	tests/scripts/test_flatpak_node_generator.py	91	async def test_status_retries_and_source_cache_remain_active(self):	CODE
LOW	tests/scripts/workflow-snap.test.ts	875	function runPromotionCredentialGate({	CODE
LOW	tests/scripts/workflow-snap.test.ts	1057	function runPromotionSourceValidation(	CODE
LOW	tests/scripts/release-signing-input.test.ts	651	async function createGeneratedSigningInput(	CODE
LOW	tests/scripts/windows-artifact-names.test.ts	17	async function resolveConfiguredWindowsTargets(	CODE
LOW	tests/scripts/workflow-release-matrix.test.ts	3183	function bareUppercaseEnvironmentReferences(command: string): string[] {	CODE
LOW	scripts/registry-runtime-conformance.ts	103	export function runRegistryRuntimeConformance(): RegistryRuntimeConformanceResult {	CODE
LOW	e2e/task-inspector-activity.spec.ts	273	async function expectStatusPillContained(page: Page): Promise<void> {	CODE
LOW	e2e/task-inspector-activity.spec.ts	297	async function expectYAxisSpeedLabelsSingleLine(page: Page): Promise<void> {	CODE
LOW	e2e/task-inspector-activity.spec.ts	377	async function expectLiveTransferSummary(	CODE
LOW	e2e/activity-tile.spec.ts	268	async function readActivityFixtureProfile(	CODE
LOW	src/renderer/platform/services.tsx	71	export function useOptionalPlatformServices(): PlatformServices \| null {	CODE
LOW	…features/legacy-import/use-legacy-import-navigation.ts	8	export function useLegacyImportNavigation() {	CODE
LOW	…/renderer/features/legacy-import/sidebar-preference.ts	18	export function createLegacyImportSidebarStore() {	CODE
LOW	…nderer/features/legacy-import/legacy-import-dialog.tsx	122	function LegacyImportDialogContent({	CODE
LOW	…tures/engine-diagnostics/engine-diagnostics-dialog.tsx	140	export function EngineDiagnosticsDialogHost() {	CODE
LOW	src/renderer/features/engine-diagnostics/controller.ts	13	export function consumeEngineDiagnosticsRequest(): boolean {	CODE
LOW	src/renderer/features/engine-diagnostics/controller.ts	19	export function subscribeEngineDiagnostics(listener: Listener): () => void {	CODE
LOW	src/renderer/features/application-menu/task-context.ts	41	export function registerDownloadsMenuContext(	CODE
LOW	…enderer/features/application-menu/navigation-focus.tsx	5	export function requestMenuNavigationFocus(path: string): void {	CODE
LOW	…directory-preferences/directory-preferences-dialog.tsx	29	export function DirectoryPreferencesDialog({	CODE
LOW	…directory-preferences/directory-preferences-dialog.tsx	36	function OpenDirectoryPreferencesDialog({ onClose }: { onClose: () => void }) {	CODE
LOW	…irectory-preferences/directory-preferences-section.tsx	32	export function DirectoryPreferencesStatus({	CODE
LOW	…irectory-preferences/directory-preferences-section.tsx	74	export function DirectoryPreferencesSection({	CODE
LOW	…rectory-preferences/use-directory-preferences-draft.ts	315	export function useDirectoryPreferencesDraft(options: Options = {}) {	CODE
LOW	src/renderer/components/ui/chart.tsx	328	function getPayloadConfigFromPayload(	CODE
LOW	src/renderer/components/ui/blur-highlight.test.tsx	17	function installIntersectionObserver() {	CODE
LOW	src/renderer/components/window-chrome/window-chrome.tsx	150	export function shouldShowDesktopWindowControls(	CODE
LOW	…nts/window-chrome/window-controls-overlay-provider.tsx	31	function LinuxOverlayPopupBoundary({ children }: { children: ReactNode }) {	CODE
LOW	…nts/window-chrome/window-controls-overlay-provider.tsx	42	export function WindowControlsOverlayProvider({	CODE
LOW	…derer/components/task/magnet-file-selection-button.tsx	9	export function MagnetFileSelectionButton({ task }: { task: DownloadTask }) {	CODE
LOW	…onents/add-task-dialog/use-pending-magnet-selection.ts	12	export function usePendingMagnetSelection(	CODE
LOW	…erer/components/desktop-kit/cubic-glass/webgl-scene.ts	195	export function createCubicGlassWebGlScene(	CODE
LOW	…/renderer/components/desktop-kit/cubic-glass/motion.ts	21	export function resolveHorizontalResponseSeconds(speed: number): number {	CODE
LOW	…components/desktop-kit/toolbar-glass/toolbar-glass.tsx	13	function subscribeMaterialPreference(listener: () => void) {	CODE
LOW	src/renderer/hooks/use-task-activity.ts	98	export function taskActivityRangeSignature(	CODE
LOW	src/renderer/hooks/use-task-inspector-activity.ts	41	export function createTaskInspectorActivitySnapshotCache(): TaskInspectorActivitySnapshotCache {	CODE
LOW	src/renderer/hooks/use-application-menu.ts	18	function supportsRendererApplicationMenu(): boolean {	CODE
LOW	src/renderer/hooks/use-engine-restart-required-toast.ts	13	export function useEngineRestartRequiredToast(): void {	CODE
LOW	src/renderer/lib/renderer-health.ts	53	export function registerRendererCapability(	CODE
LOW	src/renderer/lib/i18n.ts	32	export function applyDocumentLocaleMetadata(	CODE
LOW	src/renderer/lib/initial-theme.ts	15	export function resolveInitialRendererTheme({	CODE
LOW	src/renderer/lib/initial-theme.ts	26	export function applyInitialRendererTheme(	CODE
LOW	src/renderer/lib/directory-preferences.ts	498	export function useServerDirectoryLocations(enabled = true) {	CODE
LOW	…/routes/settings/cards/use-downloads-settings-draft.ts	42	export function useDownloadsSettingsDraft(	CODE
LOW	…ngs/cards/integration/appimage-integration-section.tsx	31	export function AppImageIntegrationSection({	CODE
LOW	…ngs/cards/integration/appimage-native-host-section.tsx	12	export function AppImageNativeHostSection() {	CODE
LOW	…nderer/routes/plugins/plugin-diagnostics-page.test.tsx	321	function installTooltipCompatibleResizeObserver(): void {	CODE
LOW	…omponents/call-graph/plugin-call-graph-omni-search.tsx	107	export function buildPluginCallGraphSuggestions(	CODE
LOW	…omponents/call-graph/plugin-call-graph-omni-search.tsx	142	export function PluginCallGraphOmniSearch({	CODE
LOW	…s/call-graph/plugin-call-graph-error-boundary.test.tsx	63	function CanvasThatRecoversOnRemount() {	CODE
LOW	…tes/plugins/components/call-graph/graph-test-utils.tsx	38	export function installGraphTestEnvironment({	CODE
LOW	…tes/plugins/components/call-graph/graph-test-utils.tsx	153	export function renderInReactFlowProvider(ui: ReactElement): RenderResult {	CODE
LOW	src/renderer/routes/plugins/lib/network-error.ts	4	export function formatPluginNetworkFailure(	CODE
LOW	src/renderer/routes/plugins/lib/call-graph-model.ts	114	function toInstalledPluginIdentities(	CODE
LOW	src/renderer/routes/plugins/lib/call-graph-model.ts	125	function buildModelFromCommandEdges(	CODE
333 more matches not shown…

Fake / Example Data169 hits · 172 pts

Severity	File	Line	Snippet	Context
LOW	e2e/settings-speed-limit-units.spec.ts	89	await expect(upload).toHaveAttribute('placeholder', 'Unlimited')	CODE
LOW	e2e/settings-speed-limit-units.spec.ts	93	await expect(lowDownload).toHaveAttribute('placeholder', 'Use standard')	CODE
LOW	…rer/routes/settings/cards/compact-limit-input.test.tsx	96	expect(input).toHaveAttribute('placeholder', 'Unlimited')	CODE
LOW	…rer/routes/settings/cards/compact-limit-input.test.tsx	130	'placeholder',	CODE
LOW	…nderer/routes/settings/cards/downloads-dialog.test.tsx	927	expect(baseDown).toHaveAttribute('placeholder', 'Unlimited')	CODE
LOW	…nderer/routes/settings/cards/downloads-dialog.test.tsx	929	expect(altDown).toHaveAttribute('placeholder', 'Use standard')	CODE
LOW	…nderer/routes/settings/cards/downloads-dialog.test.tsx	1027	expect(startTime).toHaveAttribute('placeholder', 'HH:mm')	CODE
LOW	…ettings/cards/integration/media-tools-section.test.tsx	575	expect(input).toHaveAttribute('placeholder', 'Not set')	CODE
LOW	src/core/bridge/extension-identity-resolver.test.ts	115	id: 'imported@example.org',	CODE
LOW⚡	src/core/bridge/extension-identity-resolver.test.ts	129	expect(registry.has('imported@example.org', 'firefox')).toBe(true)	CODE
LOW⚡	src/core/bridge/extension-identity-resolver.test.ts	131	expect(resolver.isOfficialId('firefox', 'imported@example.org')).toBe(false)	CODE
LOW⚡	src/core/bridge/extension-identity-resolver.test.ts	141	{ browser: 'firefox', id: 'dev@example.org' },	CODE
LOW	src/core/bridge/extension-identity-resolver.test.ts	235	const claimedExtensionId = 'recognizable-but-self-reported@example.org'	CODE
LOW	src/core/bridge/extension-identity-resolver.test.ts	294	['other@example.org', 'attested-non-official'],	CODE
LOW	src/core/bridge/mbp1/pair-session.test.ts	688	callerId: 'motrix@example.org',	CODE
LOW	src/core/bridge/mbp1/pair-session.test.ts	696	claimedExtensionId: 'motrix@example.org',	CODE
LOW	src/core/bridge/__tests__/initialize-handler.test.ts	138	extensionId: 'motrix@example.org',	CODE
LOW⚡	src/core/bridge/__tests__/mbp1-transport.test.ts	1638	claimedExtensionId: 'motrix@example.org',	CODE
LOW⚡	src/core/bridge/__tests__/mbp1-transport.test.ts	1643	initializeParams('motrix@example.org', 'firefox')	CODE
LOW⚡	src/core/bridge/__tests__/mbp1-transport.test.ts	1649	expect(h.server.getSession('firefox:motrix@example.org')).toBeUndefined()	CODE
LOW	src/core/bridge/__tests__/mbp1-transport.test.ts	601	claimedExtensionId: 'motrix@example.org',	CODE
LOW	src/core/bridge/__tests__/mbp1-transport.test.ts	647	['firefox', 'motrix@example.org'],	CODE
LOW	src/core/bridge/__tests__/mbp1-transport.test.ts	662	callerId: 'motrix@example.org',	CODE
LOW	src/core/bridge/__tests__/mbp1-transport.test.ts	668	claimedExtensionId: 'motrix@example.org',	CODE
LOW	src/core/bridge/__tests__/mbp1-transport.test.ts	681	callerId: 'other@example.org',	CODE
LOW	src/core/bridge/__tests__/mbp1-transport.test.ts	687	claimedExtensionId: 'other@example.org',	CODE
LOW	src/core/bridge/__tests__/mbp1-transport.test.ts	700	callerId: 'motrix@example.org',	CODE
LOW	src/core/bridge/__tests__/mbp1-transport.test.ts	706	claimedExtensionId: 'motrix@example.org',	CODE
LOW	src/core/bridge/__tests__/mbp1-transport.test.ts	738	callerId: 'motrix@example.org',	CODE
LOW	src/core/bridge/__tests__/mbp1-transport.test.ts	746	claimedExtensionId: 'motrix@example.org',	CODE
LOW	src/core/bridge/__tests__/mbp1-transport.test.ts	761	callerId: 'motrix@example.org',	CODE
LOW	src/core/bridge/__tests__/mbp1-transport.test.ts	767	claimedExtensionId: 'motrix@example.org',	CODE
LOW	src/core/bridge/__tests__/mbp1-transport.test.ts	788	callerId: 'motrix@example.org',	CODE
LOW	src/core/bridge/__tests__/mbp1-transport.test.ts	794	claimedExtensionId: 'motrix@example.org',	CODE
LOW	src/core/bridge/__tests__/mbp1-transport.test.ts	2392	const GECKO_ID = 'motrix@example.org'	CODE
LOW	src/core/legacy-import/bt-activation-service.test.ts	142	'placeholder',	CODE
LOW	src/core/legacy-import/bt-activation-service.test.ts	173	if (state === 'placeholder') {	CODE
LOW	src/core/legacy-import/http-activation-service.test.ts	180	'placeholder',	CODE
LOW	src/core/legacy-import/http-activation-service.test.ts	211	if (state === 'placeholder') {	CODE
LOW	src/shared/locales/tr.json	5	"placeholder": "Operatör belirteci",	CODE
LOW	src/shared/locales/tr.json	878	"placeholder": {	CODE
LOW	src/shared/locales/tr.json	958	"placeholder": "İndirmelerde ara",	CODE
LOW	src/shared/locales/tr.json	2352	"placeholder": "Kaynak seçin",	CODE
LOW	src/shared/locales/tr.json	2442	"placeholder": "GitHub adresi veya URL yapıştırın ya da yerel bir .moext dosyası seçin",	CODE
LOW	src/shared/locales/hu.json	5	"placeholder": "Üzemeltetői token",	CODE
LOW	src/shared/locales/hu.json	878	"placeholder": {	CODE
LOW	src/shared/locales/hu.json	958	"placeholder": "Letöltések keresése",	CODE
LOW	src/shared/locales/hu.json	2352	"placeholder": "Források kiválasztása",	CODE
LOW	src/shared/locales/hu.json	2442	"placeholder": "Illessz be egy GitHub-címet vagy URL-t, vagy válassz egy helyi .moext fájlt",	CODE
LOW	src/shared/locales/nl.json	401	"placeholder": "Operatortoken",	CODE
LOW	src/shared/locales/nl.json	1111	"placeholder": {	CODE
LOW	src/shared/locales/nl.json	1185	"placeholder": "Downloads zoeken",	CODE
LOW	src/shared/locales/nl.json	1567	"placeholder": "Plak een GitHub-adres of URL, of kies een lokaal .moext-bestand",	CODE
LOW	src/shared/locales/nl.json	3014	"placeholder": "Bronnen selecteren",	CODE
LOW	src/shared/locales/ja.json	5	"placeholder": "管理者トークン",	CODE
LOW	src/shared/locales/ja.json	866	"placeholder": {	CODE
LOW	src/shared/locales/ja.json	946	"placeholder": "ダウンロードを検索",	CODE
LOW	src/shared/locales/ja.json	2337	"placeholder": "ソースを選択",	CODE
LOW	src/shared/locales/ja.json	2426	"placeholder": "GitHub のアドレスや URL を貼り付けるか、ローカルの .moext ファイルを選択",	CODE
LOW	src/shared/locales/de.json	5	"placeholder": "Betreiber-Token",	CODE
109 more matches not shown…

Hallucination Indicators13 hits · 130 pts

Severity	File	Line	Snippet	Context
CRITICAL	src/renderer/hooks/use-task-activity.test.tsx	305	hook.result.current.snapshot.days.every(	CODE
CRITICAL	src/renderer/lib/directory-preferences.test.ts	252	h.bridge.invoke.mock.calls.filter(	CODE
CRITICAL	src/renderer/lib/directory-preferences.test.ts	257	h.bridge.invoke.mock.calls.filter(	CODE
CRITICAL	src/core/engine/aria2/aria2-process-manager.test.ts	343	const data = child.stdout.on.mock.calls.find(	CODE
CRITICAL	src/core/engine/aria2/aria2-process-manager.test.ts	381	const data = child.stdout.on.mock.calls.find(	CODE
CRITICAL	src/core/engine/aria2/aria2-process-manager.test.ts	384	const end = child.stdout.on.mock.calls.find(	CODE
CRITICAL	src/core/engine/aria2/aria2-process-manager.test.ts	404	const firstData = first.stderr.on.mock.calls.find(	CODE
CRITICAL	src/core/engine/aria2/aria2-process-manager.test.ts	412	const secondData = second.stderr.on.mock.calls.find(	CODE
CRITICAL	src/shared/schemas/speed-limit.test.ts	50	DEFAULT_SPEED_LIMIT_SETTINGS.auto.adaptive.speedTest.providers.map(	CODE
CRITICAL	src/shared/schemas/speed-limit.test.ts	55	DEFAULT_SPEED_LIMIT_SETTINGS.auto.adaptive.speedTest.providers.find(	CODE
CRITICAL	src/main/window/renderer-supervisor.test.ts	196	f.wc.send.mock.calls.filter(([c]) => c === Events.RendererIntent)	CODE
CRITICAL	src/main/window/renderer-supervisor.test.ts	208	f.wc.send.mock.calls.filter(([c]) => c === Events.RendererIntent)	CODE
CRITICAL	src/main/window/renderer-supervisor.test.ts	317	const probe = f.wc.send.mock.calls.at(-1)?.[1]	CODE

Over-Commented Block121 hits · 118 pts

Severity	File	Line	Snippet	Context
LOW	vite.main.config.ts	21	// 41 bundles Node 22.14+), so merely declaring "type": "module" is no	COMMENT
LOW	pnpm-workspace.yaml	1	packages:	COMMENT
LOW	tests/integration/community-plugin-install.test.ts	1	// tests/integration/community-plugin-install.test.ts	COMMENT
LOW	flatpak/app.motrix.native.yml	201	pnpm_native="$pnpm_root/node_modules/@pnpm/exe.linux-${npm_config_target_arch}"	COMMENT
LOW	packages/native-host/src/runtime.rs	81	// attestation — a future refactor replacing `main.rs` with a call to it would	COMMENT
LOW	packages/native-host/src/caller.rs	1	//! Extracts the browser-supplied caller identity from Native Messaging argv	COMMENT
LOW	packages/native-host/src/ticket.rs	1	//! MBP1 NM attestation ticket minting (`docs/bridge-pairing-protocol.md` §9.2).	COMMENT
LOW	packages/native-host/src/ticket.rs	21		COMMENT
LOW	packages/native-host/src/canonical.rs	1	//! MBP1 canonical byte-level encoding primitives (`docs/bridge-pairing-protocol.md` §2).	COMMENT
LOW	packages/native-host/src/endpoint.rs	41	/// The Windows counterpart of the 0600 check, and **deliberately weaker than	COMMENT
LOW	packages/native-host/src/endpoint.rs	61	/// this permits an administrator to read the file's `localToken`. An	COMMENT
LOW	packages/native-host/src/endpoint.rs	141		COMMENT
LOW	packages/finalize-fs/src/sanitize.rs	1	//! Cross-platform filename sanitization for published artifacts.	COMMENT
LOW	.github/workflows/release.yml	1	# Motrix — native multi-platform build and release	COMMENT
LOW	e2e/bridge/cli-pair-and-download.spec.ts	1	// E2E acceptance: motrix-cli ↔ Electron app over the MDXP HTTP bridge.	COMMENT
LOW	src/renderer/hooks/use-transport-mirror.ts	101	// Generation guard: subscription-driven refreshes and reconnect/focus can	COMMENT
LOW	…ettings/cards/integration/use-pair-request-prompts.tsx	101	// Allow/Deny mark settled + close the toast optimistically, then await	COMMENT
LOW	…ettings/cards/integration/use-pair-request-prompts.tsx	141	}	COMMENT
LOW	…ettings/cards/integration/use-pair-request-prompts.tsx	221	transport.on(expiredChannel, onExpired)	COMMENT
LOW	src/renderer/routes/plugins/plugin-detail-page.tsx	161	<>	COMMENT
LOW	src/renderer/routes/plugins/store.ts	21	list: PluginListDTO[]	COMMENT
LOW	…c/renderer/routes/downloads/inspector/trackers-tab.tsx	161	// so an immediate re-query would land before that poll and cache the	COMMENT
LOW	src/core/bridge/credential-store.ts	1181	throw new Error(CREDENTIAL_STORAGE_REJECTED)	COMMENT
LOW	src/core/bridge/web-socket-bridge-server.ts	1881	const sessionKey = makeSessionKey(peer.browser, peer.extensionId)	COMMENT
LOW	src/core/bridge/endpoint-file-writer.ts	41	})	COMMENT
LOW	src/core/bridge/web-socket-message-stream.ts	21	// Minimal subset of ws.WebSocket we depend on. Avoids a hard dep on	COMMENT
LOW	src/core/bridge/mbp1/envelope.ts	1	// MBP1 AEAD envelope (docs/bridge-pairing-protocol.md §10).	COMMENT
LOW	src/core/bridge/mbp1/spake2-core.ts	1	// MBP1 group-generic SPAKE2 core (docs/bridge-pairing-protocol.md §3, §6.3–§6.6).	COMMENT
LOW	src/core/bridge/mbp1/spake2-core.ts	161	// torsion component `T`, and `h·scalar·d` kills it because `8 \| h·scalar`,	COMMENT
LOW	src/core/bridge/mbp1/spake2-core.test.ts	281	// sufficient to separate them. Writing `s = 8x mod ℓ`, the two forms differ	COMMENT
LOW	src/core/bridge/mbp1/reconnect-session.ts	1	// MBP1 reconnect session state machine	COMMENT
LOW	src/core/bridge/mbp1/reconnect-session.ts	21	// later expire and strand the client. An already-`committed` credential	COMMENT
LOW	src/core/bridge/mbp1/reconnect-session.ts	341	await this.deps.credentials.promoteOnReconnect(credential.credentialId)	COMMENT
LOW	src/core/bridge/mbp1/flood-control.ts	1	// MBP1 pairing flood control (docs/bridge-pairing-protocol.md §7.3).	COMMENT
LOW	src/core/bridge/mbp1/frames.ts	1	// MBP1 pre-channel wire frames (docs/bridge-pairing-protocol.md §6.1, §6.7,	COMMENT
LOW	src/core/bridge/mbp1/frames.ts	21	// 2. `protocolVersion` is NOT a `z.literal(1)`. §11 gives a wrong version	COMMENT
LOW	src/core/bridge/mbp1/pre-auth-table.ts	1	// MBP1 pre-authentication connection table (docs/bridge-pairing-protocol.md	COMMENT
LOW	src/core/bridge/mbp1/nonce-service.ts	1	// MBP1 pairing nonce issuance (docs/bridge-pairing-protocol.md §4.2).	COMMENT
LOW	src/core/bridge/mbp1/pair-session.ts	1	// MBP1 first-pair session state machine	COMMENT
LOW	src/core/bridge/mbp1/pair-session.ts	21	// 2. A ticket abort outranks identity. A presented-but-broken ticket	COMMENT
LOW	src/core/bridge/mbp1/pair-session.ts	621	// caller identity: "the Chromium verified `Origin` host, OR the	COMMENT
LOW	src/core/bridge/mbp1/reconnect-rate-limit.ts	1	// MBP1 reconnect rate limiting (docs/bridge-pairing-protocol.md §8).	COMMENT
LOW	src/core/bridge/mbp1/envelope-message-stream.ts	1	// MBP1 AEAD envelope as a WebSocket adapter	COMMENT
LOW	src/core/bridge/mbp1/envelope-message-stream.ts	21	// `isBinary` flag is. §10 makes a post-activation text frame a protocol	COMMENT
LOW	src/core/bridge/mbp1/ticket-verify.ts	1	// MBP1 NM attestation-ticket verification	COMMENT
LOW	src/core/bridge/mbp1/ticket-verify.ts	21	// attacker a semantic bypass.	COMMENT
LOW	src/core/bridge/mbp1/reconnect-mac.ts	1	// MBP1 reconnect transcript, MACs, and traffic keys	COMMENT
LOW	src/core/bridge/__tests__/mbp1-transport.test.ts	981	})	COMMENT
LOW	src/core/bridge/__tests__/mbp1-transport.test.ts	2381	// values instead of `deps.verifiedOrigin`. A client binding some arbitrary	COMMENT
LOW	src/core/bridge/__tests__/mbp1-transport.test.ts	2441	// "Terminating MITM (own PAKE with each side) cannot produce two confirmed	COMMENT
LOW	src/core/bridge/__tests__/mbp1-client.ts	1	// A client-side MBP1 implementation for the transport integration tests.	COMMENT
LOW	src/core/plugin/secret-store-libsodium.ts	1	// libsodium-backed SecretStore implementation shared by both shells.	COMMENT
LOW	src/core/plugin/queries.ts	1	// Provider helpers for the Phase 1A plugin read-side queries:	COMMENT
LOW	src/core/plugin/install/moext-reader.ts	1	// Hardened .moext (zip) extractor.	COMMENT
LOW	src/core/plugin/install/source-resolver.ts	1	// Normalizes every shape of plugin source into a canonical	COMMENT
LOW	src/core/plugin/install/plugin-installer.ts	1	// Orchestrates the install / upgrade / uninstall lifecycle for a plugin.	COMMENT
LOW	src/core/plugin/install/server-ack.ts	1	// Phase 1A server-runtime ack rules (I27): unsigned plugins must be	COMMENT
LOW	src/core/plugin/host/capability-bridge.ts	1	import type { OperationExecution } from '../operations/operation-files'	COMMENT
LOW	src/core/plugin/host/capability-bridge.ts	1341	// -------------------------------------------------------------------------	COMMENT
LOW	src/core/plugin/host/quick-js-worker.ts	1	// src/core/plugin/host/quick-js-worker.ts	COMMENT
61 more matches not shown…

Verbosity Indicators14 hits · 24 pts

Severity	File	Line	Snippet	Context
LOW	src/core/plugin/manifest/parse.ts	171	// Step 1: Read engines.motrix BEFORE strict schema validation.	COMMENT
LOW⚡	src/core/plugin/manifest/parse.ts	186	// Step 2: Apply strict schema validation.	COMMENT
LOW⚡	src/core/plugin/manifest/parse.ts	196	// Step 3: Enforce reserved-publisher invariant. Community plugins must not	COMMENT
LOW	src/core/plugin/manifest/parse.ts	213	// Step 4: Enforce command-id namespace invariant — every contributed	COMMENT
LOW	src/core/plugin/manifest/parse.ts	230	// Step 5: Typo detection vs forward-compat passthrough for contributes keys.	COMMENT
LOW	src/core/plugin/manifest/parse.ts	263	// Step 6: Hook-driven invariants — both the role-eligibility rules	COMMENT
LOW	src/core/plugin/manifest/parse.ts	314	// Step 7: Unknown activation events — forward-compat warning, NOT error	COMMENT
LOW	src/core/engine/engine-supervisor.ts	455	// Step 2: Ensure config and build args	COMMENT
LOW	src/core/engine/engine-supervisor.ts	510	// Step 3: Port check	COMMENT
LOW⚡	src/core/engine/engine-supervisor.ts	540	// Step 4: Spawn process (abort if stop() was called during earlier awaits)	COMMENT
LOW⚡	src/core/engine/engine-supervisor.ts	549	// Step 5: Connect RPC	COMMENT
LOW	src/core/engine/engine-supervisor.ts	605	// Step 6: Ready	COMMENT
LOW	src/core/engine/aria2/aria2-adapter.integration.test.ts	277	// Step 1: ask aria2 to stop the task	COMMENT
LOW	src/core/engine/aria2/aria2-adapter.integration.test.ts	293	// Step 2: removeDownloadResult should succeed on a stopped task	COMMENT

Structural Annotation Overuse14 hits · 24 pts

Severity	File	Line	Snippet	Context
LOW	src/core/plugin/manifest/parse.ts	171	// Step 1: Read engines.motrix BEFORE strict schema validation.	COMMENT
LOW⚡	src/core/plugin/manifest/parse.ts	186	// Step 2: Apply strict schema validation.	COMMENT
LOW⚡	src/core/plugin/manifest/parse.ts	196	// Step 3: Enforce reserved-publisher invariant. Community plugins must not	COMMENT
LOW	src/core/plugin/manifest/parse.ts	213	// Step 4: Enforce command-id namespace invariant — every contributed	COMMENT
LOW	src/core/plugin/manifest/parse.ts	230	// Step 5: Typo detection vs forward-compat passthrough for contributes keys.	COMMENT
LOW	src/core/plugin/manifest/parse.ts	263	// Step 6: Hook-driven invariants — both the role-eligibility rules	COMMENT
LOW	src/core/plugin/manifest/parse.ts	314	// Step 7: Unknown activation events — forward-compat warning, NOT error	COMMENT
LOW	src/core/engine/engine-supervisor.ts	455	// Step 2: Ensure config and build args	COMMENT
LOW	src/core/engine/engine-supervisor.ts	510	// Step 3: Port check	COMMENT
LOW⚡	src/core/engine/engine-supervisor.ts	540	// Step 4: Spawn process (abort if stop() was called during earlier awaits)	COMMENT
LOW⚡	src/core/engine/engine-supervisor.ts	549	// Step 5: Connect RPC	COMMENT
LOW	src/core/engine/engine-supervisor.ts	605	// Step 6: Ready	COMMENT
LOW	src/core/engine/aria2/aria2-adapter.integration.test.ts	277	// Step 1: ask aria2 to stop the task	COMMENT
LOW	src/core/engine/aria2/aria2-adapter.integration.test.ts	293	// Step 2: removeDownloadResult should succeed on a stopped task	COMMENT

Empty Error Handlers1 hit · 5 pts

Severity	File	Line	Snippet	Context
HIGH	tests/scripts/test_flatpak_node_generator.py	42	except (BrokenPipeError, ConnectionResetError):	CODE

agalwood/Motrix

Open-Source Code Quality, Security and Technical Debt Review