Open-source backend-as-a-service. Postgres, auth, storage, functions, AI gateway, MCP.
This report summarizes scanner evidence for butterbase-ai/butterbase, a TypeScript project with 3,688 GitHub stars. SynthScan examined 419,416 lines of code across 2167 source files, recording 1051 pattern matches distributed across 20 syntactic categories. The legacy adjusted pattern signal is 5.1 (Moderate pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Can maintainers explain intent, assumptions, and trade-offs? 489 finding(s).
Are imports declared and package/API names verified? 110 finding(s).
Are wrappers, guards, and repeated structures necessary? 685 finding(s).
Which changes need focused human review? 1051 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 1051 distinct pattern matches across 20 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | packages/cli/bin/butterbase.ts | 1089 | // ─── ai meetings ──────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/cli/src/__tests__/people.test.ts | 3 | // ─── SDK mock ───────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/cli/src/__tests__/people.test.ts | 34 | // ─── Fixtures ───────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/cli/src/__tests__/people.test.ts | 65 | // ─── search-person ──────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/cli/src/__tests__/people.test.ts | 127 | // ─── search-company ─────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | packages/cli/src/__tests__/people.test.ts | 174 | // ─── profile ────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/cli/src/__tests__/people.test.ts | 244 | // ─── email-lookup ───────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/cli/src/__tests__/people.test.ts | 286 | // ─── email-status ───────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/cli/src/lib/api-client.ts | 595 | // ─── RLS wrappers ──────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/cli/src/lib/api-client.ts | 634 | // ─── Billing wrappers ───────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/cli/src/lib/api-client.ts | 673 | // ─── Functions invoke + env wrappers ───────────────────────────────────────── | COMMENT |
| MEDIUM | packages/cli/src/lib/api-client.ts | 687 | // ─── RAG wrappers ───────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/cli/src/commands/rag.ts | 29 | // ─── Collections ──────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/cli/src/commands/rag.ts | 129 | // ─── Ingest ────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/cli/src/commands/rag.ts | 207 | // ─── Documents ─────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/cli/src/commands/rag.ts | 249 | // ─── Query ──────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/cli/src/commands/people.ts | 7 | // ─── Helpers ───────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/cli/src/commands/people.ts | 54 | // ─── search-person ──────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/cli/src/commands/people.ts | 127 | // ─── search-company ─────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/cli/src/commands/people.ts | 201 | // ─── profile ────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/cli/src/commands/people.ts | 277 | // ─── email-lookup ───────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/cli/src/commands/people.ts | 310 | // ─── email-status ───────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/cli/src/commands/app-billing.ts | 22 | // ─── Plans ─────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/cli/src/commands/app-billing.ts | 80 | // ─── Products ──────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/cli/src/commands/app-billing.ts | 138 | // ─── Subscriptions ─────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/cli/src/commands/app-billing.ts | 193 | // ─── Orders ────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/cli/src/commands/ai.ts | 124 | // ─── Meetings ──────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/sdk/src/kv.test.ts | 39 | // ─── existing tests ──────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/sdk/src/kv.test.ts | 114 | // ─── set with options ────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/sdk/src/kv.test.ts | 132 | // ─── setex ──────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/sdk/src/kv.test.ts | 143 | // ─── incr / decr ────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/sdk/src/kv.test.ts | 172 | // ─── setnx ──────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/sdk/src/kv.test.ts | 189 | // ─── cas ────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/sdk/src/kv.test.ts | 207 | // ─── exists ─────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/sdk/src/kv.test.ts | 217 | // ─── ttl ────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/sdk/src/kv.test.ts | 233 | // ─── expire ─────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/sdk/src/kv.test.ts | 245 | // ─── mget ───────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/sdk/src/kv.test.ts | 267 | // ─── mset ───────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/sdk/src/kv.test.ts | 284 | // ─── new error classes ──────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/sdk/src/kv.test.ts | 343 | // ─── quota / rate-limit error mapping ──────────────────────────────────── | COMMENT |
| MEDIUM | packages/sdk/src/auth/session-manager.ts | 149 | // ── Internal helpers ───────────────────────────────────── | COMMENT |
| MEDIUM | …lates/butterbaseCRM/frontend/src/hooks/useCampaigns.ts | 107 | // ─── Campaigns ──────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | templates/butterbaseCRM/frontend/src/lib/filterDsl.ts | 43 | // ─── Built-in field catalogs per object_type ────────────────────────────── | COMMENT |
| MEDIUM | templates/butterbaseCRM/frontend/src/lib/filterDsl.ts | 92 | // ─── Ops per kind ───────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | templates/butterbaseCRM/frontend/src/lib/filterDsl.ts | 129 | // ─── Custom field helpers ───────────────────────────────────────────────── | COMMENT |
| MEDIUM | templates/butterbaseCRM/frontend/src/lib/filterDsl.ts | 155 | // ─── Apply filters to a SDK query builder (built-in only) ───────────────── | COMMENT |
| MEDIUM | templates/butterbaseCRM/frontend/src/lib/agent.ts | 96 | // ── Proposal tool_name → REST endpoint map ─────────────────────────────── | COMMENT |
| MEDIUM | templates/butterbaseCRM/frontend/src/lib/agent.ts | 137 | // ── Drawer UI Zustand store ────────────────────────────────────────────── | COMMENT |
| MEDIUM | templates/butterbaseCRM/frontend/src/pages/Login.tsx | 28 | // ── Schemas ────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | templates/butterbaseCRM/frontend/src/pages/Login.tsx | 59 | // ── Signin form ─────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | templates/butterbaseCRM/frontend/src/pages/Login.tsx | 139 | // ── Magic link request form ─────────────────────────────────────────────────── | COMMENT |
| MEDIUM | templates/butterbaseCRM/frontend/src/pages/Login.tsx | 209 | // ── Magic link verify form ──────────────────────────────────────────────────── | COMMENT |
| MEDIUM | templates/butterbaseCRM/frontend/src/pages/Login.tsx | 265 | // ── Signup form ─────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | templates/butterbaseCRM/frontend/src/pages/Login.tsx | 357 | // ── Verify form ─────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | templates/butterbaseCRM/frontend/src/pages/Login.tsx | 421 | // ── Main Login page ─────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | templates/butterbaseCRM/frontend/src/pages/Onboard.tsx | 29 | // ── Helpers ─────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | templates/butterbaseCRM/frontend/src/pages/Onboard.tsx | 40 | // ── Schema ──────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | templates/butterbaseCRM/frontend/src/pages/Onboard.tsx | 53 | // ── Page ────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …ocs/superpowers/plans/2026-06-05-workspace-ai-agent.md | 2045 | // ── Agent ────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …ocs/superpowers/plans/2026-06-05-workspace-ai-agent.md | 2092 | // ── Agent SSE events ─────────────────────────────────────────────────── | COMMENT |
| 361 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/e2e/helpers/move-app-flow.ts | 191 | export async function runForwardMoveAppToCompleted(opts: { | CODE |
| LOW | packages/shared/src/regions.ts | 131 | export function butterbaseRegionToFlyRegion( | CODE |
| LOW | packages/cli/src/lib/api-client.ts | 477 | export async function rotateIntegrationCredentials( | CODE |
| LOW | packages/cli/src/lib/api-client.ts | 601 | export async function createUserIsolationPolicy(appId: string, body: { | CODE |
| LOW | packages/cli/src/lib/lockfile-hash.ts | 5 | export function detectPackageManagerAndLockfile(projectDir: string): { | CODE |
| LOW | packages/cli/src/commands/integrations.ts | 89 | export async function integrationsConfigCommand(options: { app?: string }) { | CODE |
| LOW | packages/cli/src/commands/integrations.ts | 114 | export async function integrationsConfigureCommand( | CODE |
| LOW | packages/cli/src/commands/integrations.ts | 144 | export async function integrationsRotateCommand( | CODE |
| LOW | packages/cli/src/commands/integrations.ts | 168 | export async function integrationsDisableCommand(toolkit: string, options: { app?: string }) { | CODE |
| LOW | packages/cli/src/commands/integrations.ts | 181 | export async function integrationsConnectCommand(toolkit: string, options: { app?: string; redirectUrl?: string; userId? | CODE |
| LOW | packages/cli/src/commands/integrations.ts | 199 | export async function integrationsConnectionsCommand(options: { app?: string }) { | CODE |
| LOW | packages/cli/src/commands/integrations.ts | 226 | export async function integrationsDisconnectCommand(connectionId: string, options: { app?: string }) { | CODE |
| LOW | packages/cli/src/commands/integrations.ts | 263 | export async function integrationsExecuteCommand(toolName: string, options: { app?: string; data?: string; userId?: stri | CODE |
| LOW | packages/cli/src/commands/rag.ts | 31 | export async function ragCollectionsListCommand(options: { app?: string; json?: boolean }) { | CODE |
| LOW | packages/cli/src/commands/rag.ts | 58 | export async function ragCollectionsCreateCommand( | CODE |
| LOW | packages/cli/src/commands/rag.ts | 116 | export async function ragCollectionsDeleteCommand(name: string, options: { app?: string }) { | CODE |
| LOW | packages/cli/src/commands/people.ts | 56 | export async function peopleSearchPersonCommand( | CODE |
| LOW | packages/cli/src/commands/people.ts | 129 | export async function peopleSearchCompanyCommand( | CODE |
| LOW | packages/cli/src/commands/apps.ts | 168 | export async function appsUnlinkSubstrateCommand(appId: string) { | CODE |
| LOW | packages/cli/src/commands/apps.ts | 187 | export async function appsSubstrateAutopropagateCommand(appId: string, opts: { users?: boolean }) { | CODE |
| LOW | packages/cli/src/commands/ai.ts | 199 | export async function aiMeetingsEstimateCommand(options: { app?: string; durationMinutes: number; transcript?: boolean; | CODE |
| LOW⚡ | packages/cli/src/commands/substrate.ts | 55 | export async function substrateEntitiesListCommand(opts: { type?: string; limit?: string; json?: boolean }) { | CODE |
| LOW⚡ | packages/cli/src/commands/substrate.ts | 64 | export async function substrateEntitiesGetCommand(id: string, opts: { json?: boolean }) { | CODE |
| LOW⚡ | packages/cli/src/commands/substrate.ts | 71 | export async function substrateArtifactsListCommand(opts: { kind?: string; q?: string; limit?: string; json?: boolean }) | CODE |
| LOW | packages/cli/src/commands/substrate.ts | 82 | export async function substrateArtifactsGetCommand(id: string, _opts: { json?: boolean }) { | CODE |
| LOW | packages/cli/src/commands/substrate.ts | 100 | export async function substrateMemoryListCommand(opts: { | CODE |
| LOW | packages/cli/src/commands/substrate.ts | 124 | export async function substrateOutboxListCommand(opts: { state?: string; json?: boolean }) { | CODE |
| LOW | packages/cli/src/commands/substrate.ts | 133 | export async function substrateRulesListCommand(opts: { enabled?: boolean; json?: boolean }) { | CODE |
| LOW⚡ | packages/cli/src/commands/substrate.ts | 149 | export async function substrateRulesFiringsCommand(id: string, opts: { limit?: string; json?: boolean }) { | CODE |
| LOW⚡ | packages/cli/src/commands/substrate.ts | 158 | export async function substrateSnapshotsCommand(opts: { days?: string; json?: boolean }) { | CODE |
| LOW⚡ | packages/cli/src/commands/substrate.ts | 167 | export async function substrateSettingsShowCommand(opts: { json?: boolean }) { | CODE |
| LOW⚡ | packages/cli/src/commands/substrate.ts | 174 | export async function substrateLedgerInspectCommand(actionId: string, _opts: { json?: boolean }) { | CODE |
| LOW | packages/cli/src/commands/substrate.ts | 211 | export async function substrateEntitiesUpdateCommand(id: string, opts: { patch?: string; json?: boolean }) { | CODE |
| LOW⚡ | packages/cli/src/commands/substrate.ts | 223 | export async function substrateOutboxCancelCommand(id: string, opts: { json?: boolean }) { | CODE |
| LOW⚡ | packages/cli/src/commands/substrate.ts | 230 | export async function substrateOutboxRetryCommand(id: string, opts: { json?: boolean }) { | CODE |
| LOW⚡ | packages/cli/src/commands/substrate.ts | 237 | export async function substrateRulesCreateCommand(opts: { file?: string; json?: boolean }) { | CODE |
| LOW⚡ | packages/cli/src/commands/substrate.ts | 246 | export async function substrateRulesUpdateCommand(id: string, opts: { file?: string; json?: boolean }) { | CODE |
| LOW⚡ | packages/cli/src/commands/substrate.ts | 255 | export async function substrateRulesDeleteCommand(id: string, opts: { json?: boolean }) { | CODE |
| LOW⚡ | packages/cli/src/commands/substrate.ts | 262 | export async function substrateRulesEnableCommand(id: string, opts: { json?: boolean }) { | CODE |
| LOW⚡ | packages/cli/src/commands/substrate.ts | 269 | export async function substrateRulesDisableCommand(id: string, opts: { json?: boolean }) { | CODE |
| LOW⚡ | packages/cli/src/commands/substrate.ts | 276 | export async function substrateSettingsYoloCommand(state: string, opts: { json?: boolean }) { | CODE |
| LOW | packages/cli/src/commands/preview.ts | 219 | export async function previewPromoteCheckCommand(opts: { app?: string; json?: boolean }) { | CODE |
| LOW | …es/butterbaseCRM/frontend/src/hooks/useMeetingNotes.ts | 89 | export function useIngestMeetingTranscript() { | CODE |
| LOW | …es/butterbaseCRM/frontend/src/hooks/useCustomFields.ts | 156 | export function useUpsertCustomFieldValue() { | CODE |
| LOW | …/backend/functions/execute-comment-campaign/handler.ts | 22 | async function resolveWorkspaceIntegration(ctx: any, workspaceId: string, toolkit: string) { | CODE |
| LOW | …RM/backend/functions/comment-on-social-post/handler.ts | 26 | async function resolveWorkspaceIntegration(ctx: any, workspaceId: string, toolkit: string) { | CODE |
| LOW | …CRM/backend/functions/run-comment-discovery/handler.ts | 59 | async function discoverRedditForCompetitor( | CODE |
| LOW | …tterbaseCRM/backend/functions/enrich-person/handler.ts | 70 | async function peopleSearchByCompanyName(ctx: any, companyName: string, roleTitle: string | null, pageSize = 25) { | CODE |
| LOW | …butterbaseCRM/backend/functions/lead-search/handler.ts | 199 | function mapPersonResultToSearchResult(p: PeopleApiPersonResult): SearchResult | null { | CODE |
| LOW | …RM/backend/functions/unregister-integration/handler.ts | 95 | async function resolveComposioConnectionId(ctx, req, userId, toolkit, accountIdSnapshot) { | CODE |
| LOW | …/backend/functions/discover-comment-targets/handler.ts | 8 | async function resolveWorkspaceIntegration(ctx: any, workspaceId: string, toolkit: string) { | CODE |
| LOW | …rbaseCRM/backend/functions/send-social-post/handler.ts | 78 | async function resolveWorkspaceIntegration(ctx, workspaceId, toolkit) { | CODE |
| LOW | services/mcp-server/src/create-server.ts | 87 | export async function createButterbaseMcpServer() { | CODE |
| LOW | services/mcp-server/src/request-auth-context.ts | 47 | export function getRequestAuthorizationHeader(): string | undefined { | CODE |
| LOW | services/mcp-server/src/active-window-cache.ts | 22 | export async function fetchAndCacheActiveWindow(): Promise<boolean> { | CODE |
| LOW | services/mcp-server/src/eligibility-listener.ts | 11 | export async function startActiveWindowListener(connectionString: string) { | CODE |
| LOW | services/mcp-server/src/tools/deploy-frontend.ts | 5 | export function registerCreateFrontendDeployment(server: McpServer) { | CODE |
| LOW | services/mcp-server/src/tools/submit-hackathon-entry.ts | 85 | export function registerSubmitHackathonEntry(server: McpServer) { | CODE |
| LOW | services/mcp-server/src/tools/manage-durable-objects.ts | 5 | export function registerManageDurableObjects(server: McpServer) { | CODE |
| LOW | services/control-api/src/config.ts | 363 | export function assertInternalEmailSecret(): void { | CODE |
| 173 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | scripts/rotate-do-invoker-token.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | …es/static-frontend-worker/src/worker.miniflare.test.ts | 1 | // Integration tests for the static frontend worker against a real workerd | COMMENT |
| LOW | …tatic-frontend-worker/src/worker-source.generated.d.ts | 1 | // Type declaration for the generated dist/worker-source.generated.js, written | COMMENT |
| LOW | packages/static-frontend-worker/src/redirects-parser.ts | 1 | // Cloudflare Pages-compatible `_redirects` parser. | COMMENT |
| LOW | packages/static-frontend-worker/src/worker.ts | 1 | // Per-app static frontend worker. | COMMENT |
| LOW | …plates/butterbaseCRM/frontend/src/hooks/useMeetings.ts | 1 | // Substrate-primary meeting hooks. | COMMENT |
| LOW | …es/butterbaseCRM/frontend/src/hooks/useCustomFields.ts | 61 | // All values for one object_type (cheap — small N for now). Returns a map | COMMENT |
| LOW | templates/butterbaseCRM/frontend/src/lib/realtime.ts | 1 | import { useEffect, useState } from 'react'; | COMMENT |
| LOW | templates/butterbaseCRM/frontend/src/lib/realtime.ts | 21 | // substrate stream will need its own loop with the same shape). | COMMENT |
| LOW | templates/butterbaseCRM/frontend/src/lib/substrate.ts | 1 | // Substrate access from the browser. All calls route through the substrate-proxy | COMMENT |
| LOW | …erbaseCRM/backend/functions/substrate-proxy/handler.ts | 1 | // Single-tenant substrate proxy. All ops act as the linked substrate owner via | COMMENT |
| LOW | …aseCRM/backend/functions/crm-upsert-meeting/handler.ts | 1 | // crm-upsert-meeting — single substrate-primary write path for meetings. | COMMENT |
| LOW | …tterbaseCRM/backend/functions/enrich-person/handler.ts | 1 | // Enrich a person entity using the Butterbase People API. | COMMENT |
| LOW | …terbaseCRM/backend/functions/enrich-company/handler.ts | 1 | // Enrich a company entity using the Butterbase People API. | COMMENT |
| LOW | …erbaseCRM/backend/functions/check-allowlist/handler.ts | 1 | // App-wide allowlist gate. The frontend calls this immediately after login. | COMMENT |
| LOW | templates/butterbaseCRM/dev/smoke-sync.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | templates/butterSupport/frontend/src/widget/Widget.tsx | 141 | useEffect(() => { | COMMENT |
| LOW | …ates/butterSupport/durable-objects/widget-ticket-do.ts | 1 | import { DurableObject } from 'cloudflare:workers'; | COMMENT |
| LOW | …rt/backend/durable-objects/widget-ticket-do/handler.ts | 1 | import { DurableObject } from 'cloudflare:workers'; | COMMENT |
| LOW | templates/butterSupport/docs/butterbase/02-plan.md | 841 | async function outboundFilter( | COMMENT |
| LOW | templates/butterSupport/docs/butterbase/02-plan.md | 861 | // 4. For each match: replace with [redacted] + record Violation. | COMMENT |
| LOW | services/storage-indexer/wrangler.toml | 21 | # NEON_RUNTIME_PROJECT_ID_US_EAST_1 — runtime DB URL for us-east-1 | COMMENT |
| LOW | services/storage-indexer/worker-configuration.d.ts | 11881 | // auth was used. | COMMENT |
| LOW | services/storage-indexer/worker-configuration.d.ts | 11941 | // Types that can be used through `Stub`s | COMMENT |
| LOW | services/storage-indexer/worker-configuration.d.ts | 11981 | [K in keyof T]: Unstubify<T[K]>; | COMMENT |
| LOW | services/storage-indexer/worker-configuration.d.ts | 12001 | // Unwrapping `Stub`s allows calling with `Stubable` arguments. | COMMENT |
| LOW | services/storage-indexer/worker-configuration.d.ts | 12021 | // You can use `wrangler types` to generate the `Env` type automatically. | COMMENT |
| LOW | services/storage-indexer/worker-configuration.d.ts | 13101 | } | COMMENT |
| LOW | services/mcp-server/src/request-auth-context.ts | 1 | import { AsyncLocalStorage } from 'node:async_hooks'; | COMMENT |
| LOW | services/control-api/src/plugins/helmet.ts | 1 | import fp from 'fastify-plugin'; | COMMENT |
| LOW | services/control-api/src/plugins/cors.ts | 21 | // preflight with 204 instead of falling through to its wildcard OPTIONS | COMMENT |
| LOW | services/control-api/src/plugins/cors.ts | 41 | // Endpoints any origin must be able to read for OAuth discovery to work from a | COMMENT |
| LOW | services/control-api/src/plugins/auth.ts | 181 | scopes: [], | COMMENT |
| LOW | …ontrol-api/src/__tests__/clone-preflight-route.test.ts | 1 | // Unit tests for GET /v1/templates/:source_app_id/clone-preflight | COMMENT |
| LOW | …vices/control-api/src/__tests__/execute-update.test.ts | 1 | import { describe, it, expect, beforeAll, beforeEach, vi } from 'vitest'; | COMMENT |
| LOW | …vices/control-api/src/__tests__/execute-update.test.ts | 141 | it('aborts when divergence could not be computed at all', () => { | COMMENT |
| LOW | …ices/control-api/src/__tests__/edge-ssr-routes.test.ts | 461 | // --------------------------------------------------------------------------- | COMMENT |
| LOW | services/control-api/src/__tests__/clone-routes.test.ts | 361 | // count update-mode rows | COMMENT |
| LOW | services/control-api/src/__tests__/clone-routes.test.ts | 561 | expect(enqueued).toContain('incrementRetry'); | COMMENT |
| LOW | …rvices/control-api/src/__tests__/agent-test-helpers.ts | 1 | // Shared test fixtures for the agent route tests. | COMMENT |
| LOW | …pi/src/__tests__/app-state-capture.integration.test.ts | 41 | // Regression coverage for the schema drift that let captureAppState ship | COMMENT |
| LOW | …rvices/control-api/src/__tests__/clone-lineage.test.ts | 41 | }); | COMMENT |
| LOW | services/control-api/src/routes/clone.ts | 161 | } | COMMENT |
| LOW | services/control-api/src/routes/people-webhook.ts | 1 | // services/control-api/src/routes/people-webhook.ts | COMMENT |
| LOW | services/control-api/src/routes/staging.ts | 161 | }, | COMMENT |
| LOW | services/control-api/src/routes/staging.ts | 321 | })); | COMMENT |
| LOW | services/control-api/src/routes/staging.ts | 381 | }); | COMMENT |
| LOW | services/control-api/src/routes/init.ts | 141 | app.post('/init', { schema: initSchema }, async (request, reply) => { | COMMENT |
| LOW | services/control-api/src/routes/template-update.ts | 181 | // The getActiveUpdateJob pre-check above is a read-then-write; two | COMMENT |
| LOW | services/control-api/src/routes/template-update.ts | 261 | created_at: job.created_at.toISOString(), | COMMENT |
| LOW | services/control-api/src/routes/people.e2e.test.ts | 1 | // services/control-api/src/routes/people.e2e.test.ts | COMMENT |
| LOW | services/control-api/src/routes/auto-api.ts | 481 | if (auth) { | COMMENT |
| LOW | services/control-api/src/routes/auto-api.ts | 521 | // Continue without user ID - function can handle auth | COMMENT |
| LOW | services/control-api/src/routes/templates-discovery.ts | 1 | // Anonymous-readable template discovery — fans out across all runtime regions | COMMENT |
| LOW | services/control-api/src/routes/templates-discovery.ts | 121 | [unique], | COMMENT |
| LOW | services/control-api/src/routes/templates-discovery.ts | 241 | COMMENT | |
| LOW | services/control-api/src/routes/people.ts | 601 | // }); | COMMENT |
| LOW | services/control-api/src/routes/dashboard-agent.ts | 381 | // success cache keyed on approval_id. Because a repeated execution is | COMMENT |
| LOW | services/control-api/src/routes/dashboard-agent.ts | 1161 | // turn by turn, for the dev-mode trace viewer in the dashboard. Delete this | COMMENT |
| LOW | services/control-api/src/routes/notification-actions.ts | 1 | // Public, token-gated endpoint that backs the inline action buttons in | COMMENT |
| 93 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | Examples/agents/support-readonly/README.md | 30 | -d '{"input": {"message": "Why was I charged twice last month?", "email": "user@example.com"}}' | CODE |
| LOW | packages/cli/src/__tests__/people.test.ts | 59 | name: 'Acme Corp', | CODE |
| LOW⚡ | packages/cli/src/__tests__/people.test.ts | 160 | expect(output).toContain('Acme Corp'); | CODE |
| LOW⚡ | packages/cli/src/__tests__/people.test.ts | 170 | expect(parsed.data.results[0].name).toBe('Acme Corp'); | CODE |
| LOW | packages/sdk/README.md | 79 | email: 'user@example.com', | CODE |
| LOW | packages/sdk/README.md | 85 | email: 'user@example.com', | CODE |
| LOW | packages/sdk/README.md | 310 | to: 'user@example.com', | CODE |
| LOW | …s/butterbaseCRM/frontend/src/pages/AgentOnboarding.tsx | 99 | placeholder="Acme Corp" | CODE |
| LOW | templates/butterbaseCRM/frontend/src/pages/Onboard.tsx | 138 | placeholder="Acme Corp" | CODE |
| LOW | templates/butterbaseCRM/docs/butterbase/02-plan.md | 155 | - **Seed data:** template ships with a demo workspace ("Acme Inc") containing sample companies, people, deals, notes, me | CODE |
| LOW⚡ | templates/butterbaseCRM/docs/butterbase/02-plan.md | 177 | **Seed-workspace exception (D1):** logos uploaded to the demo "Acme Inc" workspace are flagged public-read so they can r | CODE |
| LOW | templates/butterbaseCRM/docs/butterbase/02-plan.md | 220 | 11. **deploy** — deploy frontend, run the seed-data script for the "Acme Inc" demo workspace, smoke-test the live URL. | CODE |
| LOW | …ocs/superpowers/plans/2026-06-05-workspace-ai-agent.md | 3422 | Ask the agent "Add a company called Acme based in San Francisco". A `ProposalCard` appears. Edit "Acme" to "Acme Inc", c | CODE |
| LOW | …ocs/superpowers/plans/2026-06-05-workspace-ai-agent.md | 3627 | <Input placeholder="Acme Corp" {...field} onBlur={() => { field.onBlur(); if (!form.getValues('slu | CODE |
| LOW | …tes/butterSupport/frontend/src/console/routes/Docs.tsx | 23 | email: 'user@example.com', | CODE |
| LOW | …upport/frontend/src/console/routes/settings/Widget.tsx | 22 | email: 'user@example.com', | CODE |
| LOW | templates/butterSupport/docs/butterbase/02-plan.md | 1432 | name: 'Jane Doe', | CODE |
| LOW | services/mcp-server/src/tools/integrations.ts | 72 | Input: { app_id: "app_abc123", action: "execute_action", tool_name: "GMAIL_SEND_EMAIL", params: { to: "user@example.c | CODE |
| LOW | services/mcp-server/src/tools/invoke-function.ts | 14 | body: { email: "user@example.com", message: "hello" } | CODE |
| LOW | services/mcp-server/src/docs/user-documentation.ts | 440 | "client_secret": "placeholder", | CODE |
| LOW | services/mcp-server/src/docs/user-documentation.ts | 522 | "email": "user@example.com", | CODE |
| LOW | services/mcp-server/src/docs/user-documentation.ts | 524 | "display_name": "Jane Doe" | CODE |
| LOW | services/mcp-server/src/docs/user-documentation.ts | 545 | "email": "user@example.com", | CODE |
| LOW | services/mcp-server/src/docs/user-documentation.ts | 559 | "email": "user@example.com", | CODE |
| LOW | services/mcp-server/src/docs/user-documentation.ts | 561 | "display_name": "Jane Doe", | CODE |
| LOW | services/mcp-server/src/docs/user-documentation.ts | 607 | "email": "user@example.com", | CODE |
| LOW | services/mcp-server/src/docs/user-documentation.ts | 624 | "email": "user@example.com" | CODE |
| LOW | services/mcp-server/src/docs/user-documentation.ts | 638 | "email": "user@example.com", | CODE |
| LOW | services/mcp-server/src/docs/user-documentation.ts | 2954 | email: 'user@example.com', | CODE |
| LOW | services/mcp-server/src/docs/user-documentation.ts | 2960 | email: 'user@example.com', | CODE |
| LOW | services/mcp-server/src/docs/user-documentation.ts | 3757 | butterbase integrations execute <tool-name> --data '{"to":"user@example.com","subject":"Hi"}' [--user-id <id>] [--app <a | CODE |
| LOW | services/control-api/src/routes/people.test.ts | 117 | fullName: 'Jane Doe', | CODE |
| LOW | …ces/control-api/src/routes/admin/organizations.test.ts | 33 | return { rows: [{ id: 'admin-uid', email: 'admin@example.com', display_name: null, is_admin: isAdmin }] }; | CODE |
| LOW | …s/control-api/src/routes/admin/special-pricing.test.ts | 20 | return { rows: [{ id: 'admin-uid', email: 'admin@example.com', display_name: null, is_admin: isAdmin }] }; | CODE |
| LOW | …ntrol-api/src/routes/__tests__/admin-apps-orgs.test.ts | 69 | return { rows: [{ id: 'admin-uid', email: 'admin@example.com', display_name: null, is_admin: isAdmin }] }; | CODE |
| LOW | …trol-api/src/routes/__tests__/admin-users-orgs.test.ts | 62 | email: 'user@example.com', | CODE |
| LOW | …trol-api/src/routes/__tests__/admin-users-orgs.test.ts | 135 | email: 'user@example.com', | CODE |
| LOW | …trol-api/src/routes/__tests__/admin-users-orgs.test.ts | 216 | email: 'user@example.com', | CODE |
| LOW | …trol-api/src/routes/__tests__/admin-users-orgs.test.ts | 260 | email: 'user@example.com', | CODE |
| LOW | …/src/routes/__tests__/admin-billing-plans-orgs.test.ts | 69 | organization_name: 'Acme Corp', | CODE |
| LOW | …/src/routes/__tests__/admin-billing-plans-orgs.test.ts | 106 | expect(sub1.organization_name).toBe('Acme Corp'); | CODE |
| LOW | …/src/routes/__tests__/admin-billing-plans-orgs.test.ts | 135 | owner_email: 'user@example.com', | CODE |
| LOW | …/src/routes/__tests__/admin-billing-plans-orgs.test.ts | 277 | email: 'user@example.com', | CODE |
| LOW | …/src/routes/__tests__/admin-billing-plans-orgs.test.ts | 300 | expect(body.recentEvents[0].email).toBe('user@example.com'); | CODE |
| LOW⚡ | …auth/__tests__/email-service-suggestion-status.test.ts | 20 | await sendSuggestionStatusUpdateEmail('user@example.com', { | CODE |
| LOW⚡ | …auth/__tests__/email-service-suggestion-status.test.ts | 28 | expect(command.Destination.ToAddresses).toEqual(['user@example.com']); | CODE |
| LOW⚡ | …auth/__tests__/email-service-suggestion-status.test.ts | 37 | await sendSuggestionStatusUpdateEmail('user@example.com', { | CODE |
| LOW | …auth/__tests__/email-service-suggestion-status.test.ts | 53 | sendSuggestionStatusUpdateEmail('user@example.com', { | CODE |
| LOW | …i/src/services/__tests__/clone-replay-env-vars.test.ts | 151 | JSON.stringify({ BUTTERBASE_API_KEY: 'placeholder' }), | CODE |
| LOW | …/services/__tests__/durable-objects-clone-mint.test.ts | 188 | BUTTERBASE_API_KEY: 'placeholder', | CODE |
| LOW | …/services/__tests__/durable-objects-clone-mint.test.ts | 256 | BUTTERBASE_API_KEY: 'placeholder', | CODE |
| LOW | services/control-api/src/services/people/cache.test.ts | 12 | fullName: 'Jane Doe', | CODE |
| LOW | …ices/docs/src/content/docs/api-reference/people-api.md | 104 | "fullName": "Jane Doe", | CODE |
| LOW | …ices/docs/src/content/docs/api-reference/people-api.md | 230 | "fullName": "Jane Doe", | CODE |
| LOW | …rvices/docs/src/content/docs/api-reference/auth-api.md | 70 | "client_secret": "placeholder", | CODE |
| LOW | …rvices/docs/src/content/docs/api-reference/auth-api.md | 88 | "email": "user@example.com", | CODE |
| LOW | …rvices/docs/src/content/docs/api-reference/auth-api.md | 90 | "display_name": "Jane Doe" | CODE |
| LOW | …rvices/docs/src/content/docs/api-reference/auth-api.md | 106 | "email": "user@example.com", | CODE |
| LOW | …rvices/docs/src/content/docs/api-reference/auth-api.md | 108 | "display_name": "Jane Doe", | CODE |
| LOW | …rvices/docs/src/content/docs/api-reference/auth-api.md | 119 | { "email": "user@example.com" } | CODE |
| 24 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | README.md | 72 | - **Claude Code plugin** — `packages/plugin` (submodule of [butterbase-skills](https://github.com/butterbase-ai/butterba | CODE |
| MEDIUM⚡ | templates/butterbaseCRM/docs/butterbase/02-plan.md | 179 | ## AI / RAG / realtime / durable | COMMENT |
| MEDIUM⚡ | templates/butterbaseCRM/docs/butterbase/02-plan.md | 189 | ### RAG — not used (Q8). | COMMENT |
| MEDIUM | …ocs/superpowers/plans/2026-06-05-workspace-ai-agent.md | 59 | ## Phase 0 — Migration scaffolding | COMMENT |
| MEDIUM | …ocs/superpowers/plans/2026-06-05-workspace-ai-agent.md | 770 | ## Phase 3 — Tool-use loop scaffolding + first 3 read tools | COMMENT |
| MEDIUM | …s/superpowers/plans/2026-06-29-lead-finder-scaffold.md | 232 | ## Task 2: `lead-search` function — orchestration with mock provider | COMMENT |
| MEDIUM | …erpowers/specs/2026-06-05-workspace-ai-agent-design.md | 461 | ### Cost guardrails | COMMENT |
| MEDIUM | templates/butterSupport/docs/butterbase/02-plan.md | 98 | ### Commodity-tier knowledge (RAG) | COMMENT |
| MEDIUM | templates/butterSupport/docs/butterbase/02-plan.md | 332 | ### 4. Commodity tier — RAG / docs ingestion (the front door) | COMMENT |
| MEDIUM | templates/butterSupport/docs/butterbase/02-plan.md | 499 | ### Per-ticket budget guardrails (hardcoded in DO for v1) | COMMENT |
| MEDIUM | templates/butterSupport/docs/butterbase/02-plan.md | 550 | ## RAG | COMMENT |
| MEDIUM | templates/butterSupport/docs/butterbase/02-plan.md | 648 | ### What we deliberately do NOT do with RAG in v1 | COMMENT |
| MEDIUM | services/mcp-server/src/docs/user-documentation.ts | 2310 | ### Webhooks (event-driven flow) | COMMENT |
| MEDIUM | services/mcp-server/src/docs/user-documentation.ts | 3411 | rag: `## RAG (Retrieval-Augmented Generation) | CODE |
| MEDIUM | …c/routes/__tests__/dashboard-agent-builder.e2e.test.ts | 179 | // Return empty repo — triggers template scaffold path | COMMENT |
| MEDIUM | …vices/control-api/src/services/dashboard-agent/loop.ts | 943 | // Capture baseline BEFORE scaffold so every template file counts as | COMMENT |
| MEDIUM | …ol-api/src/services/dashboard-agent/build-hydration.ts | 157 | // empty" would send the build down a path that compiles a scaffold in | COMMENT |
| MEDIUM | …c/services/dashboard-agent/__tests__/repo-http.test.ts | 177 | // on a false here, and MUST NOT see a throw, or it would skip the scaffold. | COMMENT |
| MEDIUM | …c/services/dashboard-agent/__tests__/repo-http.test.ts | 191 | // scaffold behaviour is identical whichever implementation is in play. | COMMENT |
| MEDIUM | …c/services/dashboard-agent/__tests__/repo-http.test.ts | 204 | // the turn down the scaffold path and then try to PUSH a template into | COMMENT |
| MEDIUM | …vices/docs/src/content/docs/api-reference/mcp-tools.md | 241 | ## RAG (Retrieval-Augmented Generation) | COMMENT |
| MEDIUM | …ices/docs/src/content/docs/templates/butter-support.md | 25 | ### Docs ingestion and RAG | COMMENT |
| MEDIUM | …ices/docs/src/content/docs/templates/butter-support.md | 157 | ### 3. Create the RAG collection and ingest your docs | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | Examples/grocery-list-2026-04-03/BUTTERBASE_SETUP.md | 5 | ## Step 1: Initialize app | COMMENT |
| LOW | Examples/grocery-list-2026-04-03/BUTTERBASE_SETUP.md | 20 | ## Step 2: Apply schema | COMMENT |
| LOW | Examples/grocery-list-2026-04-03/BUTTERBASE_SETUP.md | 85 | ## Step 3: Row-level security | COMMENT |
| LOW | Examples/grocery-list-2026-04-03/BUTTERBASE_SETUP.md | 97 | ## Step 4: CORS | COMMENT |
| LOW | Examples/grocery-list-2026-04-03/BUTTERBASE_SETUP.md | 108 | ## Step 5: Recipe assistant (serverless function) | COMMENT |
| LOW | Examples/todo-2026-04-02/BUTTERBASE_SETUP.md | 5 | ## Step 1: Initialize App | COMMENT |
| LOW | Examples/todo-2026-04-02/BUTTERBASE_SETUP.md | 15 | ## Step 2: Apply Schema | COMMENT |
| LOW | Examples/todo-2026-04-02/BUTTERBASE_SETUP.md | 77 | ## Step 3: Enable RLS | COMMENT |
| LOW | Examples/todo-2026-04-02/BUTTERBASE_SETUP.md | 94 | ## Step 4: Configure CORS | COMMENT |
| LOW⚡ | packages/cli/src/commands/deploy-edge-ssr.ts | 98 | // Step 1: Create deployment (get upload URL) | COMMENT |
| LOW⚡ | packages/cli/src/commands/deploy-edge-ssr.ts | 101 | // Step 2: Zip the directory | COMMENT |
| LOW⚡ | packages/cli/src/commands/deploy-edge-ssr.ts | 105 | // Step 3: Upload zip to presigned URL | COMMENT |
| LOW⚡ | packages/cli/src/commands/deploy-edge-ssr.ts | 109 | // Step 4: Start the deployment pipeline | COMMENT |
| LOW⚡ | packages/cli/src/commands/deploy-edge-ssr.ts | 113 | // Step 5: Poll until terminal state (5 s × 60 = 5 min max) | COMMENT |
| LOW⚡ | packages/cli/src/commands/deploy.ts | 81 | // Step 1: Create deployment | COMMENT |
| LOW⚡ | packages/cli/src/commands/deploy.ts | 84 | // Step 2: Zip directory | COMMENT |
| LOW⚡ | packages/cli/src/commands/deploy.ts | 88 | // Step 3: Upload | COMMENT |
| LOW⚡ | packages/cli/src/commands/deploy.ts | 92 | // Step 4: Start deployment | COMMENT |
| LOW⚡ | packages/cli/src/commands/deploy.ts | 96 | // Step 5: Poll until done | COMMENT |
| LOW | packages/sdk/src/rag/rag-client.ts | 105 | // Step 1: Upload file to storage to get an object ID | COMMENT |
| LOW | packages/sdk/src/rag/rag-client.ts | 123 | // Step 2: Upload the file to the presigned URL | COMMENT |
| LOW | packages/sdk/src/rag/rag-client.ts | 134 | // Step 3: Ingest using the storage object ID | COMMENT |
| LOW⚡ | services/control-api/src/plugins/auth.ts | 346 | // Step 1: Create a candidate personal org (may be discarded on conflict). | COMMENT |
| LOW⚡ | services/control-api/src/plugins/auth.ts | 355 | // Step 2: Upsert platform_users. | COMMENT |
| LOW | services/control-api/src/routes/rag.ts | 807 | // Step 1: Embed the query | COMMENT |
| LOW | services/control-api/src/routes/rag.ts | 818 | // Step 2: Similarity search with RLS | COMMENT |
| LOW | services/control-api/src/routes/rag.ts | 851 | // Step 3: Optional synthesis | COMMENT |
| LOW⚡ | …l-api/src/routes/__tests__/dashboard-agent.e2e.test.ts | 338 | // Step 1: USER_A creates conversation | COMMENT |
| LOW⚡ | …l-api/src/routes/__tests__/dashboard-agent.e2e.test.ts | 348 | // Step 2: USER_A posts one message (mock a simple no-tool-call pass) | COMMENT |
| LOW | …l-api/src/routes/__tests__/dashboard-agent.e2e.test.ts | 391 | // Step 4: USER_A can still access their conversation (DELETE was a no-op) | COMMENT |
| LOW | services/control-api/src/services/neon-task-worker.ts | 1317 | // Step 7: replay the source's most recent published frontend by copying | COMMENT |
| LOW⚡ | services/control-api/src/services/app-plan-resolver.ts | 33 | // Step 1: get owner_id from runtime DB (apps is a runtime-tier table) | COMMENT |
| LOW⚡ | services/control-api/src/services/app-plan-resolver.ts | 40 | // Step 2: get plan_id from the owner's personal org (Plan 07 moved | COMMENT |
| LOW | services/control-api/src/services/rag-worker.ts | 189 | // Step 1: Download and parse the document | COMMENT |
| LOW | services/control-api/src/services/rag-worker.ts | 208 | // Step 2: Chunk the text | COMMENT |
| LOW | services/control-api/src/services/rag-worker.ts | 224 | // Step 3: Batch embed chunks | COMMENT |
| LOW | services/control-api/src/services/rag-worker.ts | 246 | // Step 4: Insert chunks into app database | COMMENT |
| LOW | services/docs/src/content/docs/guides/monetization.md | 20 | ### Step 1: Onboard your Connect account | COMMENT |
| LOW | services/docs/src/content/docs/guides/monetization.md | 28 | ### Step 2: Check onboarding status | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | packages/cli/src/commands/deploy-edge-ssr.ts | 98 | // Step 1: Create deployment (get upload URL) | COMMENT |
| LOW⚡ | packages/cli/src/commands/deploy-edge-ssr.ts | 101 | // Step 2: Zip the directory | COMMENT |
| LOW⚡ | packages/cli/src/commands/deploy-edge-ssr.ts | 105 | // Step 3: Upload zip to presigned URL | COMMENT |
| LOW⚡ | packages/cli/src/commands/deploy-edge-ssr.ts | 109 | // Step 4: Start the deployment pipeline | COMMENT |
| LOW⚡ | packages/cli/src/commands/deploy-edge-ssr.ts | 113 | // Step 5: Poll until terminal state (5 s × 60 = 5 min max) | COMMENT |
| LOW⚡ | packages/cli/src/commands/deploy.ts | 81 | // Step 1: Create deployment | COMMENT |
| LOW⚡ | packages/cli/src/commands/deploy.ts | 84 | // Step 2: Zip directory | COMMENT |
| LOW⚡ | packages/cli/src/commands/deploy.ts | 88 | // Step 3: Upload | COMMENT |
| LOW⚡ | packages/cli/src/commands/deploy.ts | 92 | // Step 4: Start deployment | COMMENT |
| LOW⚡ | packages/cli/src/commands/deploy.ts | 96 | // Step 5: Poll until done | COMMENT |
| LOW | packages/sdk/src/rag/rag-client.ts | 105 | // Step 1: Upload file to storage to get an object ID | COMMENT |
| LOW | packages/sdk/src/rag/rag-client.ts | 123 | // Step 2: Upload the file to the presigned URL | COMMENT |
| LOW | packages/sdk/src/rag/rag-client.ts | 134 | // Step 3: Ingest using the storage object ID | COMMENT |
| LOW⚡ | services/control-api/src/plugins/auth.ts | 346 | // Step 1: Create a candidate personal org (may be discarded on conflict). | COMMENT |
| LOW⚡ | services/control-api/src/plugins/auth.ts | 355 | // Step 2: Upsert platform_users. | COMMENT |
| LOW | services/control-api/src/routes/rag.ts | 807 | // Step 1: Embed the query | COMMENT |
| LOW | services/control-api/src/routes/rag.ts | 818 | // Step 2: Similarity search with RLS | COMMENT |
| LOW | services/control-api/src/routes/rag.ts | 851 | // Step 3: Optional synthesis | COMMENT |
| LOW⚡ | …l-api/src/routes/__tests__/dashboard-agent.e2e.test.ts | 338 | // Step 1: USER_A creates conversation | COMMENT |
| LOW⚡ | …l-api/src/routes/__tests__/dashboard-agent.e2e.test.ts | 348 | // Step 2: USER_A posts one message (mock a simple no-tool-call pass) | COMMENT |
| LOW | …l-api/src/routes/__tests__/dashboard-agent.e2e.test.ts | 391 | // Step 4: USER_A can still access their conversation (DELETE was a no-op) | COMMENT |
| LOW | services/control-api/src/services/neon-task-worker.ts | 1317 | // Step 7: replay the source's most recent published frontend by copying | COMMENT |
| LOW⚡ | services/control-api/src/services/app-plan-resolver.ts | 33 | // Step 1: get owner_id from runtime DB (apps is a runtime-tier table) | COMMENT |
| LOW⚡ | services/control-api/src/services/app-plan-resolver.ts | 40 | // Step 2: get plan_id from the owner's personal org (Plan 07 moved | COMMENT |
| LOW | services/control-api/src/services/rag-worker.ts | 189 | // Step 1: Download and parse the document | COMMENT |
| LOW | services/control-api/src/services/rag-worker.ts | 208 | // Step 2: Chunk the text | COMMENT |
| LOW | services/control-api/src/services/rag-worker.ts | 224 | // Step 3: Batch embed chunks | COMMENT |
| LOW | services/control-api/src/services/rag-worker.ts | 246 | // Step 4: Insert chunks into app database | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | services/agent-runtime/tests/test_runner.py | 0 | insert into agent_runs (app_id, agent_id, caller_kind, input, status) values ($1, $2, 'function', $3::jsonb, 'queued') r | STRING |
| HIGH | services/agent-runtime/tests/test_e2e_smoke.py | 0 | insert into agent_runs (app_id, agent_id, caller_kind, input, status) values ($1, $2, 'function', $3::jsonb, 'queued') r | STRING |
| HIGH | services/agent-runtime/tests/live/e2e_workflow.py | 0 | insert into agent_runs (app_id, agent_id, caller_kind, input, status) values ($1, $2, 'function', $3::jsonb, 'queued') r | STRING |
| HIGH | services/agent-runtime/tests/live/e2e_run.py | 0 | insert into agent_runs (app_id, agent_id, caller_kind, input, status) values ($1, $2, 'function', $3::jsonb, 'queued') r | STRING |
| HIGH | services/agent-runtime/tests/live/e2e_tools.py | 0 | insert into agent_runs (app_id, agent_id, caller_kind, input, status) values ($1, $2, 'function', $3::jsonb, 'queued') r | STRING |
| HIGH | services/agent-runtime/tests/test_e2e_smoke.py | 0 | insert into platform_users (id, email) values (gen_random_uuid(), $1) on conflict (email) do update set email = excluded | STRING |
| HIGH | services/agent-runtime/tests/live/e2e_workflow.py | 0 | insert into platform_users (id, email) values (gen_random_uuid(), $1) on conflict (email) do update set email = excluded | STRING |
| HIGH | services/agent-runtime/tests/live/e2e_run.py | 0 | insert into platform_users (id, email) values (gen_random_uuid(), $1) on conflict (email) do update set email = excluded | STRING |
| HIGH | services/agent-runtime/tests/live/e2e_tools.py | 0 | insert into platform_users (id, email) values (gen_random_uuid(), $1) on conflict (email) do update set email = excluded | STRING |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| CRITICAL | …ontrol-api/src/services/move-app/saga-executor.test.ts | 59 | const calls: string[] = ctx._client.query.mock.calls.map((c: any[]) => | CODE |
| CRITICAL | …ontrol-api/src/services/move-app/saga-executor.test.ts | 62 | const updateCall = ctx._client.query.mock.calls.find( | CODE |
| CRITICAL | …ontrol-api/src/services/move-app/saga-executor.test.ts | 84 | const updateCall = ctx._client.query.mock.calls.find( | CODE |
| CRITICAL | …ontrol-api/src/services/move-app/saga-executor.test.ts | 105 | const errorUpdateCall = ctx._client.query.mock.calls.find( | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | services/agent-runtime/tests/test_hitl.py | 7 | CODE | |
| LOW | services/agent-runtime/tests/test_safe_request.py | 2 | CODE | |
| LOW | services/agent-runtime/tests/test_recovery.py | 4 | CODE | |
| LOW | services/agent-runtime/tests/test_recovery.py | 4 | CODE | |
| LOW | services/agent-runtime/tests/test_recovery.py | 4 | CODE | |
| LOW | services/agent-runtime/tests/test_heartbeat.py | 3 | CODE | |
| LOW | services/agent-runtime/tests/test_webhooks.py | 3 | CODE | |
| LOW | services/agent-runtime/tests/test_runner.py | 9 | CODE | |
| LOW | services/agent-runtime/tests/test_tools_base.py | 2 | CODE | |
| LOW | services/agent-runtime/tests/test_routes_lifecycle.py | 12 | CODE | |
| LOW | services/agent-runtime/src/agent_runtime/compiler.py | 8 | CODE | |
| LOW | …ices/agent-runtime/src/agent_runtime/tools/__init__.py | 3 | CODE | |
| LOW | …ices/agent-runtime/src/agent_runtime/tools/__init__.py | 3 | CODE | |
| LOW | …ices/agent-runtime/src/agent_runtime/tools/__init__.py | 3 | CODE | |
| LOW | …ices/agent-runtime/src/agent_runtime/tools/__init__.py | 3 | CODE | |
| LOW | …ices/agent-runtime/src/agent_runtime/tools/__init__.py | 3 | CODE | |
| LOW | …ices/agent-runtime/src/agent_runtime/tools/__init__.py | 3 | CODE | |
| LOW | …ices/agent-runtime/src/agent_runtime/tools/__init__.py | 3 | CODE | |
| LOW | …ices/agent-runtime/src/agent_runtime/tools/__init__.py | 3 | CODE | |
| LOW | …ices/agent-runtime/src/agent_runtime/tools/__init__.py | 3 | CODE | |
| LOW | …ices/agent-runtime/src/agent_runtime/tools/__init__.py | 3 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | services/mcp-server/src/docs/user-documentation.ts | 1563 | ### Creating the zip file correctly (Windows and AI assistants) | COMMENT |
| MEDIUM | services/mcp-server/src/docs/user-documentation.ts | 3098 | # Create a new app | COMMENT |
| MEDIUM | services/control-api/src/routes/llms-txt.ts | 20 | ### Creating a Todo App Backend | COMMENT |
| MEDIUM | services/agent-runtime/tests/test_hitl.py | 86 | # Create a registry with the interrupt tool | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | services/agent-runtime/src/agent_runtime/runner.py | 299 | except Exception as exc: | CODE |
| LOW | services/agent-runtime/src/agent_runtime/compiler.py | 78 | except Exception as e: | CODE |
| LOW | services/agent-runtime/src/agent_runtime/compiler.py | 154 | except Exception as e: | CODE |
| LOW | services/agent-runtime/src/agent_runtime/cancel.py | 43 | except Exception: | CODE |
| LOW | services/agent-runtime/src/agent_runtime/events.py | 45 | except Exception: | CODE |
| LOW | …rvices/agent-runtime/src/agent_runtime/safe_request.py | 41 | except Exception as exc: | CODE |
| LOW | …rvices/agent-runtime/src/agent_runtime/redis_client.py | 17 | except Exception: | CODE |
| LOW | services/agent-runtime/src/agent_runtime/heartbeat.py | 41 | except Exception: | CODE |
| LOW | services/agent-runtime/src/agent_runtime/webhooks.py | 54 | except Exception: | CODE |
| LOW | services/agent-runtime/src/agent_runtime/webhooks.py | 62 | except Exception: | CODE |
| LOW | services/agent-runtime/src/agent_runtime/webhooks.py | 92 | except Exception as exc: | CODE |
| LOW | services/agent-runtime/src/agent_runtime/routes/runs.py | 79 | except Exception: | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | services/agent-runtime/src/agent_runtime/cancel.py | 41 | except asyncio.CancelledError: | CODE |
| HIGH | services/agent-runtime/src/agent_runtime/heartbeat.py | 41 | except Exception: | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | services/agent-runtime/tests/test_runner_lifecycle.py | 158 | async def _set_graph_spec(pg_pool, run_id: str, graph_spec: dict) -> None: | CODE |
| LOW⚡ | services/agent-runtime/tests/test_runner_lifecycle.py | 171 | async def _set_run_input(pg_pool, run_id: str, input_data: dict) -> None: | CODE |
| LOW | services/agent-runtime/src/agent_runtime/cancel.py | 5 | logger = logging.getLogger(__name__) | CODE |
| LOW | services/agent-runtime/src/agent_runtime/events.py | 8 | logger = logging.getLogger(__name__) | CODE |
| LOW | services/agent-runtime/src/agent_runtime/app.py | 17 | logger = logging.getLogger(__name__) | CODE |
| LOW | services/agent-runtime/src/agent_runtime/webhooks.py | 11 | logger = logging.getLogger(__name__) | CODE |
| LOW | …ices/agent-runtime/src/agent_runtime/tools/__init__.py | 16 | __all__ = [ | CODE |
| LOW | services/agent-runtime/src/agent_runtime/routes/runs.py | 21 | logger = logging.getLogger(__name__) | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | …tterSupport/backend/functions/widget-ingest/handler.ts | 101 | // detail view runs a nicer AI-generated retitle async, but we still want a | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | services/agent-runtime/tests/live/fake_openrouter.py | 21 | CODE | |
| LOW | services/agent-runtime/src/agent_runtime/runner.py | 90 | CODE | |
| LOW | services/agent-runtime/src/agent_runtime/compiler.py | 28 | CODE | |
| LOW | services/agent-runtime/src/agent_runtime/compiler.py | 174 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | scripts/rotate-do-invoker-token.sh | 14 | # Usage: | COMMENT |
| LOW | templates/butterbaseCRM/dev/smoke-sync.sh | 20 | # Usage: | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | services/control-api/src/services/neon-task-worker.ts | 1341 | // robust to any future refactor that might decouple those two writes. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | .gitleaks.toml | 17 | '''YOUR_API_KEY''', | STRING |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | dispatch-worker/index.js | 97 | export async function handleRequest(request, env, ctx) { | CODE |