A repository of models, textual inversions, and more
This report presents the forensic synthetic code analysis of civitai/civitai, a TypeScript project with 7,179 GitHub stars. SynthScan v2.0 examined 980,338 lines of code across 5184 source files, recording 2032 pattern matches distributed across 13 syntactic categories. The overall adjusted score of 3.0 places this repository in the Likely human-written band.
The scanner applied 160+ deterministic lexical heuristics, multi-line block detectors, abstract syntax tree depth profilers, and a cross-file Jaccard similarity matrix to construct a statistically normalised synthetic code estimate. All matches are individually weighted by severity coefficient and contextual multiplier before summation, and the resulting headline score is temporally discounted to account for the repository's development history relative to the commercial emergence of large language model coding tooling (November 2022 onward).
This chart maps the temporal evolution of the adjusted synthetic code score across successive scan runs. An upward trajectory indicates ongoing incorporation of AI-generated code or expanding LLM-assisted scaffolding; a stable or declining trajectory may reflect active human refactoring, code removal, or the adoption of stricter authorship policies. The dashed secondary line (right axis) independently tracks total raw pattern hit count, which can diverge from the normalised score when codebase size changes significantly between scans.
Classifies detected patterns by their diagnostic confidence and structural impact. CRITICAL patterns (coefficient 10) represent definitive synthetic signatures — hallucinated imports, explicit LLM attribution metadata — virtually never produced by human authors. HIGH (5) indicates strong structural tells such as cross-file repetition or cross-linguistic idioms. MEDIUM (2) covers recognisable conversational padding and AI-specific vocabulary. LOW (1) captures subtle indicators like tautological comments and generic boilerplate that require density to carry independent signal.
This horizontal bar chart decomposes the repository's raw synthetic code score by top-level directory, allowing you to pinpoint precisely which modules or components carry the highest AI authorship density. Directories with disproportionately high scores relative to their size warrant targeted manual review: concentrated AI signatures often trace back to mass-generated configuration layers, auto-ported test suites, LLM-scaffolded boilerplate classes, or entire subsystems authored under heavy copilot assistance. Use this view to prioritise your human code-review effort.
The scanner identified 2032 distinct pattern matches across 13 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a statistically significant AI authorship indicator. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the diagnostic confidence level (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — comment-context matches receive a ×1.5 weight because LLMs systematically over-annotate. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier as dense clusters constitute far stronger evidence of synthetic authorship than isolated hits.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | playwright.preview.config.ts | 21 | testDir: './tests', | COMMENT |
| LOW | .eslintrc.js | 21 | // "path argument must be undefined". Pointing the plugin at the project root | COMMENT |
| LOW | playwright.config.ts | 61 | // name: 'Mobile Chrome', | COMMENT |
| LOW | docker-compose.base.yml | 121 | COMMENT | |
| LOW | tests/preview-moderation.spec.ts | 81 | COMMENT | |
| LOW | tests/preview-buzz.spec.ts | 81 | // "Memberships | Civitai"> regardless of branch (green plans vs. yellow | COMMENT |
| LOW | tests/preview-remix.spec.ts | 41 | COMMENT | |
| LOW | tests/preview-membership.spec.ts | 41 | // land on the membership page itself (getServerSideProps only redirects | COMMENT |
| LOW | tests/preview-auth.setup.ts | 101 | // capped at 60s) so one route compiles at a time (parallel heavy renders OOM the | COMMENT |
| LOW | tests/preview-auth.setup.ts | 141 | } | COMMENT |
| LOW | tests/preview-apps-marketplace.spec.ts | 101 | // 404s for everyone else. Asserting it loads (status < 400) + shows the | COMMENT |
| LOW | tests/preview-apps-page.spec.ts | 121 | // the e2e proof the page-mint path works (two-flag gate cleared, synthetic | COMMENT |
| LOW | .claude/skills/deploy-status/deploy-chain.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | docs/adding-basemodel-ecosystem-guide.md | 741 | // Hidden: May start hidden (hidden: true) until ready | COMMENT |
| LOW | docs/features/prompt-snippets-schema.md | 101 | COMMENT | |
| LOW | docs/features/prompt-snippets.md | 201 | async function expandSnippetsToTargets(input: { | COMMENT |
| LOW | packages/civitai-telemetry/src/client.ts | 1 | import type { Counter, Gauge, Histogram, Metric, Registry } from 'prom-client'; | COMMENT |
| LOW | packages/civitai-telemetry/src/client.ts | 321 | labelNames: ['trigger', 'client'] as const, | COMMENT |
| LOW | packages/civitai-auth/src/sign.ts | 1 | // HUB sign side (Path C). The hub is the ONLY minter. ES256-signed JWS, so spokes verify with | COMMENT |
| LOW | packages/civitai-auth/src/constants.ts | 1 | // Shared auth-contract constants — single source of truth so the hub, the main app, and every | COMMENT |
| LOW | packages/civitai-auth/src/constants.ts | 21 | COMMENT | |
| LOW | packages/civitai-auth/src/client.ts | 1 | // BROWSER auth client (`@civitai/auth/client`) — STRICT hub fetches from a SAME-SITE spoke (e.g. | COMMENT |
| LOW | packages/civitai-auth/src/session-client.ts | 121 | // it's validated against a CONFIGURED trusted hub origin (AUTH_JWT_ISSUER / the AUTH_JWKS_URI origin) — see | COMMENT |
| LOW | packages/civitai-auth/src/index.ts | 1 | // @civitai/auth — verify/receive SDK (Path C: asymmetric JWT + JWKS). | COMMENT |
| LOW | packages/civitai-auth/src/token-scope.ts | 61 | // Vault | COMMENT |
| LOW | packages/civitai-auth/src/env.ts | 1 | // Package-owned env schema for @civitai/auth. Lazy + memoized — importing this | COMMENT |
| LOW | packages/civitai-db-schema/prisma/seed.ts | 81 | image: | COMMENT |
| LOW | packages/civitai-db-schema/src/index.ts | 1 | // Bare `@civitai/db-schema` exposes the generated Prisma client + types. | COMMENT |
| LOW | packages/civitai-axiom/src/client.ts | 61 | COMMENT | |
| LOW | packages/civitai-axiom/src/__tests__/logToAxiom.test.ts | 1 | import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'; | COMMENT |
| LOW | packages/civitai-db/src/kysely.ts | 1 | import { Kysely, PostgresDialect } from 'kysely'; | COMMENT |
| LOW | packages/civitai-redis/src/client.ts | 821 | dec = true; | COMMENT |
| LOW | packages/civitai-redis/src/client.ts | 841 | // guard can re-invoke it for a retry — safe because a transient routing error means the | COMMENT |
| LOW | packages/civitai-redis/src/client.ts | 1221 | // | COMMENT |
| LOW | packages/civitai-redis/src/client.ts | 1241 | // leaving the shared serving `client` completely untouched. Cluster + single-node keep the | COMMENT |
| LOW | packages/civitai-redis/src/client.ts | 1261 | bufferClient = bufferBaseClient.withTypeMapping({ | COMMENT |
| LOW | packages/civitai-redis/src/client.ts | 1501 | if (!Array.isArray(key)) key = [key]; | COMMENT |
| LOW | packages/civitai-redis/src/cluster-routing-retry.ts | 121 | COMMENT | |
| LOW | packages/civitai-redis/src/env.ts | 21 | // Required whenever REDIS_SYS_SENTINELS is set (cluster uses "sysmaster") — see superRefine. | COMMENT |
| LOW | packages/civitai-redis/src/env.ts | 41 | REDIS_CLUSTER_COMMAND_TIMEOUT_MS: z.coerce.number().default(15000), | COMMENT |
| LOW | packages/civitai-redis/src/env.ts | 61 | // SLOW-SETTLES within the window force a reconnect. <= 0 disables this trigger. | COMMENT |
| LOW | packages/civitai-redis/src/env.ts | 81 | REDIS_CLUSTER_SELFHEAL_RECONNECT_JITTER_MS: z.coerce.number().default(3000), | COMMENT |
| LOW | packages/civitai-redis/src/env.ts | 101 | REDIS_SYS_SELFHEAL_SUSTAINED_MS: z.coerce.number().default(20000), | COMMENT |
| LOW | packages/civitai-redis/src/env.ts | 121 | // Max RETRIES after the initial attempt. The transient window is ~1–2 min cluster-wide but | COMMENT |
| LOW | …itai-redis/src/__tests__/cluster-routing-retry.test.ts | 1 | import { describe, it, expect, vi, beforeEach } from 'vitest'; | COMMENT |
| LOW | apps/auth/src/lib/server/axiom.ts | 1 | // Axiom logger for the auth hub via @civitai/axiom. The hub had no Axiom path, so its captcha/auth telemetry | COMMENT |
| LOW | apps/auth/src/lib/server/cors.ts | 1 | import { dev } from '$app/environment'; | COMMENT |
| LOW | apps/auth/src/lib/server/metrics.ts | 1 | // Prometheus metrics for the auth hub. This is the hub's FIRST metrics endpoint — before this, the | COMMENT |
| LOW | apps/auth/src/lib/server/oauth/oidc-nonce.ts | 1 | import { createHash } from 'crypto'; | COMMENT |
| LOW | apps/auth/src/lib/server/oauth/block-guard.ts | 1 | // Ported from the main app's src/shared/constants/block-scope.constants.ts (only the A1 security gate is | COMMENT |
| LOW | apps/auth/src/lib/server/oauth/model.ts | 101 | // | COMMENT |
| LOW | apps/auth/src/lib/server/oauth/access.ts | 1 | import { db } from '$lib/server/db/db'; | COMMENT |
| LOW | apps/auth/src/lib/server/oauth/rate-limit.ts | 1 | import { checkRateLimit } from '$lib/server/auth/rate-limit'; | COMMENT |
| LOW | apps/auth/src/lib/server/auth/session-shape.ts | 1 | import { z } from 'zod'; | COMMENT |
| LOW | apps/auth/src/lib/server/auth/providers.ts | 121 | clientId: () => env.REDDIT_CLIENT_ID, | COMMENT |
| LOW | apps/auth/src/lib/server/auth/providers.ts | 141 | // (see listEnabledProviders' stubEnabled gate) — so with the flag unset (prod) it never appears in the | COMMENT |
| LOW | apps/auth/src/lib/server/auth/legacy-cookies.ts | 1 | import type { Cookies } from '@sveltejs/kit'; | COMMENT |
| LOW | apps/auth/src/lib/server/auth/captcha.ts | 1 | import { dev } from '$app/environment'; | COMMENT |
| LOW | apps/auth/src/lib/server/auth/cookie.ts | 1 | import { env } from '$env/dynamic/private'; | COMMENT |
| LOW | apps/auth/src/lib/server/auth/device.ts | 1 | import { randomUUID } from 'crypto'; | COMMENT |
| 839 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/preview-bootstrap.spec.ts | 76 | async function readBrowsingSettingsAddons(page: import('@playwright/test').Page) { | CODE |
| LOW | tests/preview-ssr-inject.spec.ts | 142 | function assertAnnouncementsSeedEqualsLive(seed: unknown, live: unknown, label: string) { | CODE |
| LOW | docs/article-ingestion-status-proposal.md | 121 | export async function recomputeArticleIngestion(articleId: number): Promise<void> { | CODE |
| LOW | docs/subscription-remaining-tasks.md | 266 | export async function hasActiveMembershipForBuzzType(userId: number, buzzType: string) { | CODE |
| LOW | docs/base-model-constants-management.md | 502 | async function getBaseModelConfigForClient() { | CODE |
| LOW⚡ | docs/subscription-multi-buzz-migration.md | 129 | async function getUserSubscriptionForBuzzType(userId: number, buzzType: BuzzSpendType) | CODE |
| LOW⚡ | docs/subscription-multi-buzz-migration.md | 135 | async function hasActiveMembershipForBuzzType(userId: number, buzzType: BuzzSpendType) | CODE |
| LOW⚡ | docs/subscription-multi-buzz-migration.md | 138 | async function getUserActiveSubscriptions(userId: number) | CODE |
| LOW | docs/feed-card-dom-audit.md | 97 | export function ImagesAsPostsInfiniteProvider({ | CODE |
| LOW | docs/plans/generator-filtering-options.md | 100 | export function getProcessTagFromWorkflow(workflow: string, hasSourceImage: boolean): string | undefined { | CODE |
| LOW | docs/plans/generator-filtering-options.md | 296 | export function useGetTextToImageRequests(/* ... */) { | CODE |
| LOW | docs/plans/live-metric-signals.md | 534 | export function useMetricSubscriptionContext() { | CODE |
| LOW | docs/plans/live-metric-signals.md | 545 | export function MetricSubscriptionProvider({ | CODE |
| LOW | docs/auth/session-refresh-debug-instrumentation.md | 120 | function checkAndSetSessionHeaders(session: Session | null, res: AuthResponse): Session | null { | CODE |
| LOW | docs/features/prompt-snippets-provisioning-job.md | 87 | async function importWildcardModelVersion(modelVersionId: number): Promise<{ | CODE |
| LOW | scripts/metric-migration/backfill-metrics.ts | 182 | async function deleteExistingBackfillData(entityType: string, dryRun: boolean): Promise<void> { | CODE |
| LOW | packages/civitai-auth/src/first-party-bridge.ts | 147 | export async function completeFirstPartyCallback(opts: { | CODE |
| LOW | packages/civitai-auth/src/impersonation-client.ts | 32 | export function createImpersonationClient(): ImpersonationClient { | CODE |
| LOW | packages/civitai-auth/src/legacy-cookie.ts | 19 | export async function decodeLegacySessionCookie( | CODE |
| LOW | packages/civitai-auth/src/trusted-domains.ts | 55 | export function createTrustedDomainRegistry( | CODE |
| LOW | packages/civitai-auth/src/device-client.ts | 29 | export function createDeviceAccountClient(): DeviceAccountClient { | CODE |
| LOW | packages/civitai-db/src/kysely.ts | 26 | function registerNumericTypeParsers() { | CODE |
| LOW | packages/civitai-notifications/src/client.ts | 172 | export function createNotificationsClient(config: NotificationsClientConfig = {}) { | CODE |
| LOW | packages/civitai-redis/src/cluster-deadline-hits.ts | 82 | export function recordClusterCommandSettle( | CODE |
| LOW | packages/civitai-redis/src/client.ts | 262 | function triggerTopologyRediscovery(clusterClient: any, reason: string) { | CODE |
| LOW | packages/civitai-redis/src/client.ts | 424 | function clearClusterRefreshInterval(type: 'cache' | 'system'): void { | CODE |
| LOW | packages/civitai-redis/src/client.ts | 701 | export function attachSysSentinelListeners( | CODE |
| LOW | packages/civitai-redis/src/cluster-routing-retry.ts | 116 | export function isTransientClusterRoutingError(err: unknown): boolean { | CODE |
| LOW | …itai-redis/src/__tests__/cluster-routing-retry.test.ts | 44 | function nodeClientConnectPromiseThrow(): TypeError { | CODE |
| LOW | apps/auth/e2e/hub-login.spec.ts | 14 | async function firstEnabledOAuthProvider(page: Page): Promise<string | null> { | CODE |
| LOW | apps/auth/src/lib/server/oauth/model.ts | 435 | function redirectOriginFromRequest(request?: Request): string | undefined { | CODE |
| LOW | apps/auth/src/lib/server/oauth/first-party.ts | 95 | export async function firstPartyClientForOrigin( | CODE |
| LOW | apps/auth/src/lib/server/auth/session.ts | 133 | async function resolvePriorSessionUserId(cookies: Cookies): Promise<number | undefined> { | CODE |
| LOW | apps/auth/src/lib/server/auth/device.ts | 40 | export function getOrCreateDeviceId(cookies: Cookies): string { | CODE |
| LOW | apps/auth/src/lib/server/auth/session-producer.ts | 138 | export async function getOrProduceSessionUser(userId: number): Promise<SessionUser | null> { | CODE |
| LOW | …strator-gateway/src/lib/server/clients/orchestrator.ts | 21 | export function getInternalOrchestratorClient() { | CODE |
| LOW | src/providers/mantine-css-variables.ts | 79 | function getColorSchemeCssVariables(selector: string) { | CODE |
| LOW | src/providers/mantine-css-variables.ts | 103 | export function buildMantineCssVariablesHtml( | CODE |
| LOW | src/providers/StripeProvider.tsx | 36 | export function StripeSetupSuccessProvider() { | CODE |
| LOW | src/providers/ThemeProvider.tsx | 247 | function StaticMantineCssVariables() { | CODE |
| LOW | src/providers/ActivityReportingProvider.tsx | 46 | export function ActivityReportingProvider({ children }: { children: ReactNode }) { | CODE |
| LOW | src/providers/BrowserSettingsProvider.tsx | 154 | function createContentSettingsStore(state: StoreState) { | CODE |
| LOW | src/server/eventloop-longtask.ts | 761 | export function registerEventLoopLongTaskDetector(): void { | CODE |
| LOW | src/server/liveness-heartbeat.ts | 44 | export function registerLivenessHeartbeat() { | CODE |
| LOW | src/server/cpu-profiler.ts | 434 | export function registerEventLoopStallProfiler(): void { | CODE |
| LOW | src/server/routers/blocks.router.ts | 174 | async function assertViewerIsAppDeveloper(userId: number): Promise<void> { | CODE |
| LOW | src/server/routers/blocks.router.ts | 227 | async function assertAppBlocksEnabledForTokenUser(userId: number): Promise<void> { | CODE |
| LOW | src/server/routers/blocks.router.ts | 323 | async function assertViewerCanGeneratePageResources(opts: { | CODE |
| LOW | src/server/routers/blocks.router.ts | 597 | async function checkEphemeralDevTunnelRateLimit(userId: number): Promise<boolean> { | CODE |
| LOW | src/server/routers/blocks.router.ts | 665 | function assertLaunchSlotForCaller( | CODE |
| LOW | src/server/routers/blocks.router.ts | 719 | async function resolveModelIdFromBlockInstance(blockInstanceId: string): Promise<number> { | CODE |
| LOW | src/server/routers/blocks.router.ts | 751 | async function createBlockTextToImageStep(opts: { | CODE |
| LOW | src/server/routers/blocks.router.ts | 4104 | function resolveBlockCurrenciesForAccount( | CODE |
| LOW | src/server/routers/orchestrator.router.ts | 86 | function resolveGenerationCurrencies( | CODE |
| LOW | src/server/routers/comics.router.ts | 256 | function normalizeCandidateNsfwLevel(value: unknown): number | undefined { | CODE |
| LOW | src/server/routers/comics.router.ts | 266 | function getOrchestratorErrorMessage(error: unknown): string { | CODE |
| LOW | src/server/routers/comics.router.ts | 611 | async function getUserEarlyAccessChapters(userId: number) { | CODE |
| LOW | src/server/routers/comics.router.ts | 629 | async function assertCanGrantEarlyAccess({ | CODE |
| LOW | src/server/routers/apps.router.ts | 43 | async function assertViewerIsAppDeveloper(userId: number): Promise<void> { | CODE |
| LOW | src/server/routers/referral.router.ts | 21 | async function getOrCreateCode(userId: number) { | CODE |
| 655 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | docs/features/prompt-snippets-nested-resolution.md | 166 | ┌─ expandValue(#hero, sourceSetId=MyFantasyPack, depth=1) ──────────────┐ | CODE |
| MEDIUM | docs/features/prompt-snippets-nested-resolution.md | 176 | ┌─ expandValue(#weapon, sourceSetId=MyFantasyPack, depth=2) ────────────┐ | CODE |
| MEDIUM | docs/features/prompt-snippets-nested-resolution.md | 191 | ┌─ expandValue(#location, sourceSetId=MyFantasyPack, depth=1) ──────────┐ | CODE |
| MEDIUM | scripts/seed-comics.ts | 82 | // ── Comic 1: SFW (PG) ──────────────────────────────────────────────── | COMMENT |
| MEDIUM | scripts/seed-comics.ts | 186 | // ── Comic 2: PG-13 (mild content) ──────────────────────────────────── | COMMENT |
| MEDIUM | scripts/seed-comics.ts | 264 | // ── Comic 3: R-rated (violence, noir themes) ───────────────────────── | COMMENT |
| MEDIUM | packages/civitai-redis/src/cluster-selfheal.ts | 204 | // ── TRIGGER 1: DEADLINE-HIT RATE (sawtooth-immune — the real-wave signal) ────────── | COMMENT |
| MEDIUM | packages/civitai-redis/src/cluster-selfheal.ts | 216 | // ── TRIGGER 2: SUSTAINED INFLIGHT (legacy continuous-breach path) ────────────────── | COMMENT |
| MEDIUM | packages/civitai-redis/src/cluster-selfheal.ts | 235 | // ── TRIGGER ────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/civitai-redis/src/env.ts | 42 | // ── CLUSTER SELF-HEAL WATCHDOG (FIX #1/#2/#3) ────────────────────────────────────── | COMMENT |
| MEDIUM | packages/civitai-redis/src/env.ts | 42 | // ── CLUSTER SELF-HEAL WATCHDOG (FIX #1/#2/#3) ────────────────────────────────────── | COMMENT |
| MEDIUM | packages/civitai-redis/src/env.ts | 82 | // ── SYS (SENTINEL) SELF-HEAL WATCHDOG ────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/civitai-redis/src/env.ts | 113 | // ── CLUSTER ROUTING RETRY-AFTER-REDISCOVER (the topology-churn 500 wave) ──────────── | COMMENT |
| MEDIUM | …s/civitai-redis/src/__tests__/cluster-selfheal.test.ts | 236 | // ── DEADLINE-HIT TRIGGER (the fix for the real-wave non-firing bug) ──────────────── | COMMENT |
| MEDIUM | …s/civitai-redis/src/__tests__/cluster-selfheal.test.ts | 360 | // ── PER-POD RECONNECT JITTER (fleet-stampede brake) ──────────────────────────────── | COMMENT |
| MEDIUM | apps/auth/src/lib/server/oauth/http.ts | 62 | // ─── CORS ───────────────────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | apps/auth/src/lib/server/oauth/model.ts | 46 | // ─── Client ───────────────────────────────────────────────── | COMMENT |
| MEDIUM | apps/auth/src/lib/server/oauth/model.ts | 163 | // ─── Authorization Code ───────────────────────────────────── | COMMENT |
| MEDIUM | apps/auth/src/lib/server/oauth/model.ts | 254 | // ─── Tokens ───────────────────────────────────────────────── | COMMENT |
| MEDIUM | apps/auth/src/lib/server/oauth/model.ts | 338 | // ─── Client Credentials ───────────────────────────────────── | COMMENT |
| MEDIUM | apps/auth/src/lib/server/oauth/model.ts | 355 | // ─── Scope Validation ────────────────────────────────────── | COMMENT |
| MEDIUM | apps/auth/src/lib/server/oauth/first-party.ts | 48 | // ── Trusted-spoke-domain registry ───────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | apps/auth/src/lib/server/oauth/__tests__/model.test.ts | 10 | // ── Kysely db mock ──────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | src/tests/api/v1/blocks/images-endpoint.test.ts | 278 | // ── Transient Meili → retryable 503 (audit 🟡 #2) ────────────────────────── | COMMENT |
| MEDIUM | src/tests/api/v1/blocks/images-endpoint.test.ts | 278 | // ── Transient Meili → retryable 503 (audit 🟡 #2) ────────────────────────── | COMMENT |
| MEDIUM | src/tests/api/v1/images/index.test.ts | 459 | // ─── Transient upstream → retryable 503 (500→503 reclassification) ─────────── | COMMENT |
| MEDIUM | src/tests/api/v1/block-tokens/page-mint.test.ts | 431 | // ───────────────────────── W10 generation spend ────────────────────────── | COMMENT |
| MEDIUM | src/tests/api/v1/block-tokens/page-mint.test.ts | 512 | // ── Audit should-fix: integer enforcement in resolveBuzzBudget ────────── | COMMENT |
| MEDIUM | src/tests/api/v1/block-tokens/page-mint.test.ts | 615 | // verbatim (clamped only by the cap). ──────────────────────────────────── | COMMENT |
| MEDIUM | src/tests/api/v1/block-tokens/page-mint.test.ts | 725 | // showed can silently fail. ──────────────────────────────────────────────── | COMMENT |
| MEDIUM | src/tests/api/internal/blocks/mod-gate.test.ts | 86 | // ── ENTRY path (requires a valid mr token) ──────────────────────────────── | COMMENT |
| MEDIUM | src/tests/api/internal/blocks/mod-gate.test.ts | 167 | // ── ABSENT Sec-Fetch-Dest → treated as ENTRY (fail-safe) ────────────────── | COMMENT |
| MEDIUM | src/tests/api/internal/blocks/mod-gate.test.ts | 184 | // ── SUBRESOURCE path (allowed without any token/cookie) ─────────────────── | COMMENT |
| MEDIUM | src/tests/api/internal/blocks/mod-gate.test.ts | 211 | // ── fail-closed on missing host ─────────────────────────────────────────── | COMMENT |
| MEDIUM | src/server/routers/apps-shared.router.ts | 49 | // ── Limits (design M2/M3) ───────────────────────────────────────────────────── | COMMENT |
| MEDIUM | src/server/routers/apps-shared.router.ts | 61 | // ── Min-trust gate (design H3 / MIN-TRUST GATE) ─────────────────────────────── | COMMENT |
| MEDIUM | src/server/routers/apps-shared.router.ts | 714 | // ── App Blocks play-counts (block REST endpoints) ───────────────────────────── | COMMENT |
| MEDIUM | src/server/routers/apps-shared.router.ts | 898 | // ── helpers ─────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …erver/routers/__tests__/blocks.router.workflow.test.ts | 2477 | // ──────────────────── GA-gap: orchestrator resource belt ───────────────── | COMMENT |
| MEDIUM | …erver/routers/__tests__/blocks.router.workflow.test.ts | 2550 | // ───────────────────── Page-LoRA (Increment 1) ─────────────────────────── | COMMENT |
| MEDIUM | …erver/routers/__tests__/blocks.router.workflow.test.ts | 2933 | // ── FIX 2: an unrecognized base-model FAILS CLOSED under the GA check ────── | COMMENT |
| MEDIUM | …erver/routers/__tests__/blocks.router.workflow.test.ts | 2986 | // ── LOW-1: the literal 'Other' base-model group FAILS CLOSED ────────────── | COMMENT |
| MEDIUM | …erver/routers/__tests__/blocks.router.workflow.test.ts | 3046 | // ── GA: platform-VALID cross-ecosystem LoRA is now ACCEPTED ──────────────── | COMMENT |
| MEDIUM | …erver/routers/__tests__/blocks.router.workflow.test.ts | 3099 | // ── Model-path guard: additionalResources is page-only ───────────────── | COMMENT |
| MEDIUM | src/server/auth/civ-cookie.ts | 179 | // ── First-party login loop recovery ─────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | src/server/auth/oauth-bridge.ts | 42 | // ── Bridge-cookie delivery PROBE (temporary diagnostic) ───────────────────────────────────────────────────── | COMMENT |
| MEDIUM | src/server/signals/wrapper.ts | 68 | // ──────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | src/server/signals/wrapper.ts | 70 | // ──────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | src/server/signals/wrapper.ts | 150 | // ──────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | src/server/signals/wrapper.ts | 152 | // ──────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | src/server/utils/block-tip-rate-limit.ts | 76 | // ── Tip amount caps (what makes block tipping PAGE-SAFE) ────────────────────── | COMMENT |
| MEDIUM | …erver/freshdesk-agent/freshdesk-investigation-tools.ts | 24 | // ─── Query result types ────────────────────────────────────────────── | COMMENT |
| MEDIUM | …erver/freshdesk-agent/freshdesk-investigation-tools.ts | 211 | // ─── TOOL: investigate_user_account ─────────────────────────────────── | COMMENT |
| MEDIUM | …erver/freshdesk-agent/freshdesk-investigation-tools.ts | 314 | // ─── TOOL: investigate_cosmetics ────────────────────────────────────── | COMMENT |
| MEDIUM | …erver/freshdesk-agent/freshdesk-investigation-tools.ts | 388 | // ─── TOOL: investigate_content ──────────────────────────────────────── | COMMENT |
| MEDIUM | …erver/freshdesk-agent/freshdesk-investigation-tools.ts | 510 | // ─── TOOL: investigate_subscription ─────────────────────────────────── | COMMENT |
| MEDIUM | …erver/freshdesk-agent/freshdesk-investigation-tools.ts | 601 | // ─── TOOL: investigate_moderation ───────────────────────────────────── | COMMENT |
| MEDIUM | …erver/freshdesk-agent/freshdesk-investigation-tools.ts | 707 | // ─── TOOL: check_site_status ────────────────────────────────────────── | COMMENT |
| MEDIUM | …erver/freshdesk-agent/freshdesk-investigation-tools.ts | 801 | // ─── TOOL: investigate_crypto_payments ──────────────────────────────── | COMMENT |
| MEDIUM | src/server/meilisearch/client.ts | 656 | // ──────────────────────────────────────────────────────────────────────────── | COMMENT |
| 102 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| CRITICAL | src/tests/api/v1/developer/block-manifests.test.ts | 101 | const upsertArgs = mockDbWrite.appBlock.upsert.mock.calls.at(-1)?.[0] as { | CODE |
| CRITICAL | src/tests/api/v1/developer/block-manifests.test.ts | 120 | const upsertArgs = mockDbWrite.appBlock.upsert.mock.calls.at(-1)?.[0] as { | CODE |
| CRITICAL | src/tests/api/v1/developer/block-manifests.test.ts | 140 | const upsertArgs = mockDbWrite.appBlock.upsert.mock.calls.at(-1)?.[0] as { | CODE |
| CRITICAL | …/blocks/__tests__/offsite-listing.edit.service.test.ts | 232 | const updateCalls = mockWrite.appListing.update.mock.calls.map((c) => c[0]); | CODE |
| CRITICAL | …/blocks/__tests__/offsite-listing.edit.service.test.ts | 284 | const updateCalls = mockWrite.appListing.update.mock.calls.map((c) => c[0]); | CODE |
| CRITICAL | …blocks/__tests__/publish-request.orchestration.test.ts | 486 | const call = mockDbWrite.appBlockPublishRequest.create.mock.calls.at(-1); | CODE |
| CRITICAL | …blocks/__tests__/publish-request.orchestration.test.ts | 1352 | const reqUpdate = mockDbWrite.appBlockPublishRequest.update.mock.calls.find( | CODE |
| CRITICAL | …blocks/__tests__/publish-request.orchestration.test.ts | 1452 | const shaStamp = mockDbWrite.appBlock.update.mock.calls.find( | CODE |
| CRITICAL | …blocks/__tests__/publish-request.orchestration.test.ts | 1560 | const tierUpdate = mockDbWrite.appBlock.update.mock.calls.find( | CODE |
| CRITICAL | …blocks/__tests__/publish-request.orchestration.test.ts | 1583 | const tierUpdate = mockDbWrite.appBlock.update.mock.calls.find( | CODE |
| CRITICAL | …blocks/__tests__/publish-request.orchestration.test.ts | 1805 | const shaStamp = mockDbWrite.appBlock.update.mock.calls.find( | CODE |
| CRITICAL | …ver/services/blocks/__tests__/showcase.service.test.ts | 40 | const last = mockDbRead.imageResourceNew.findMany.mock.results.at(-1); | CODE |
| CRITICAL | …vices/blocks/__tests__/offsite-listing.service.test.ts | 763 | const flip = mockWrite.appListing.updateMany.mock.calls.find( | CODE |
| CRITICAL | …blocks/__tests__/publish-request.reviewSandbox.test.ts | 102 | const buildingCall = mockDbWrite.appBlockPublishRequest.updateMany.mock.calls.find( | CODE |
| CRITICAL | …blocks/__tests__/publish-request.reviewSandbox.test.ts | 130 | const failedCall = mockDbWrite.appBlockPublishRequest.updateMany.mock.calls.find( | CODE |
| CRITICAL | …rver/services/blocks/__tests__/backpay.service.test.ts | 421 | const calls = mockDbWrite.blockSpendAttribution.updateMany.mock.calls.map((c) => c[0]); | CODE |
| CRITICAL | …sts__/offsite-listing.edit-consolidate.service.test.ts | 153 | const viewCall = mockRead.appListing.findUnique.mock.calls.find( | CODE |
| CRITICAL | …sts__/offsite-listing.edit-consolidate.service.test.ts | 186 | const viewCall = mockRead.appListing.findUnique.mock.calls.find( | CODE |
| CRITICAL | …ces/blocks/__tests__/spend-attribution.service.test.ts | 257 | const { data } = mockDbWrite.blockSpendAttribution.create.mock.calls.at(-1)![0]; | CODE |
| CRITICAL | …es/blocks/__tests__/app-listing-assets.service.test.ts | 369 | const orders = mockDb.appListingScreenshot.update.mock.calls.map( | CODE |
| CRITICAL | …es/blocks/__tests__/app-listing-assets.service.test.ts | 403 | const orders = mockDb.appListingScreenshot.update.mock.calls.map( | CODE |
| CRITICAL | …locks/__tests__/app-listing.moderation.service.test.ts | 59 | return mockDbRead.appListing.findMany.mock.calls.at(-1)?.[0] as { | CODE |
| CRITICAL⚡ | …/services/blocks/__tests__/app-listing.service.test.ts | 648 | const where = (mockDbRead.appListing.findFirst.mock.calls.at(-1)?.[0] as { where?: unknown }) | CODE |
| CRITICAL⚡ | …/services/blocks/__tests__/app-listing.service.test.ts | 657 | const where = (mockDbRead.appListing.findFirst.mock.calls.at(-1)?.[0] as { where?: unknown }) | CODE |
| CRITICAL⚡ | …/services/blocks/__tests__/app-listing.service.test.ts | 665 | const bySlug = (mockDbRead.appListing.findFirst.mock.calls.at(-1)?.[0] as { where?: { revisionOfId?: unknown } })?.w | CODE |
| CRITICAL | …es/__tests__/get-engaged-models-by-ids.service.test.ts | 241 | const call = mockDb.resourceReview.findMany.mock.calls.at(-1)?.[0]; | CODE |
| CRITICAL | …es/__tests__/get-engaged-models-by-ids.service.test.ts | 248 | const call = mockDb.resourceReview.findMany.mock.calls.at(-1)?.[0]; | CODE |
| CRITICAL | …services/__tests__/block-registry.resolve-page.test.ts | 125 | const call = mockDbRead.appBlock.findFirst.mock.calls.at(-1)?.[0] as { | CODE |
| CRITICAL | …services/__tests__/block-registry.resolve-page.test.ts | 192 | const call = mockDbRead.appBlock.findFirst.mock.calls.at(-1)?.[0] as { | CODE |
| CRITICAL | …s/__tests__/block-registry.subscriptions.write.test.ts | 106 | const callArgs = mockDbRead.blockUserSubscription.findMany.mock.calls.at(-1)?.[0] as { | CODE |
| CRITICAL | …s/__tests__/block-registry.subscriptions.write.test.ts | 249 | const findArgs = mockDbWrite.blockUserSubscription.findFirst.mock.calls.at(-1)?.[0] as { | CODE |
| CRITICAL | …s/__tests__/block-registry.subscriptions.write.test.ts | 255 | const createArgs = mockDbWrite.blockUserSubscription.create.mock.calls.at(-1)?.[0] as { | CODE |
| CRITICAL | …rver/services/__tests__/block-registry.service.test.ts | 199 | const args = mockDbWrite.blockUserSubscription.update.mock.calls.at(-1)?.[0] as { | CODE |
| CRITICAL | …rver/services/__tests__/block-registry.service.test.ts | 230 | const args = mockDbWrite.blockUserSubscription.update.mock.calls.at(-1)?.[0] as { | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | docs/workflow-metadata-refactor.md | 265 | // Step 1: named step | COMMENT |
| LOW | docs/workflow-metadata-refactor.md | 268 | // Step 2: references step 1's output | COMMENT |
| LOW | docs/adding-basemodel-ecosystem-guide.md | 144 | ### Step 1: Add Ecosystem ID Constant (if new ecosystem) | COMMENT |
| LOW | docs/adding-basemodel-ecosystem-guide.md | 161 | ### Step 2: Add Base Model ID Constant | COMMENT |
| LOW | docs/adding-basemodel-ecosystem-guide.md | 173 | ### Step 3: Add License (if new license) | COMMENT |
| LOW | docs/adding-basemodel-ecosystem-guide.md | 188 | ### Step 4: Add Ecosystem Family (if new family) | COMMENT |
| LOW | docs/adding-basemodel-ecosystem-guide.md | 200 | ### Step 5: Add Ecosystem Record | COMMENT |
| LOW | docs/adding-basemodel-ecosystem-guide.md | 217 | ### Step 6: Add Base Model Record | COMMENT |
| LOW | docs/adding-basemodel-ecosystem-guide.md | 235 | ### Step 7: Add Ecosystem Support | COMMENT |
| LOW | docs/adding-basemodel-ecosystem-guide.md | 299 | ### Step 8: Add Ecosystem Settings (if needed) | COMMENT |
| LOW | docs/adding-basemodel-ecosystem-guide.md | 328 | ### Step 9: Add Cross-Ecosystem Rules (if applicable) | COMMENT |
| LOW | docs/article-content-scanning.md | 694 | #### Step 1: Deploy Code (Feature Flag OFF) | COMMENT |
| LOW | docs/article-content-scanning.md | 705 | #### Step 2: Run Image Migration | COMMENT |
| LOW | docs/article-content-scanning.md | 732 | #### Step 3: Validate Migration | COMMENT |
| LOW | docs/article-content-scanning.md | 753 | #### Step 4: Enable Feature Flag | COMMENT |
| LOW | docs/article-content-scanning.md | 768 | #### Step 5: Monitor (First 24 Hours) | COMMENT |
| LOW⚡ | docs/testing-feed-createdocs.md | 126 | ### Step 1: Test with Mocked Data | COMMENT |
| LOW⚡ | docs/testing-feed-createdocs.md | 135 | ### Step 2: Test with Real Data | COMMENT |
| LOW⚡ | docs/testing-feed-createdocs.md | 145 | ### Step 3: Compare with Legacy | COMMENT |
| LOW | docs/testing-feed-createdocs.md | 157 | ### Step 4: Test Metrics-Only | COMMENT |
| LOW | docs/auth/oauth-developer-docs.md | 32 | ### Step 1: Generate PKCE Values | COMMENT |
| LOW | docs/auth/oauth-developer-docs.md | 42 | ### Step 2: Redirect User to Authorization | COMMENT |
| LOW | docs/auth/oauth-developer-docs.md | 71 | ### Step 3: Exchange Code for Token | COMMENT |
| LOW | docs/auth/oauth-developer-docs.md | 97 | ### Step 4: Use the Access Token | COMMENT |
| LOW | docs/auth/oauth-developer-docs.md | 148 | ### Step 1: Request Device Code | COMMENT |
| LOW | docs/auth/oauth-developer-docs.md | 171 | ### Step 2: Display Code to User | COMMENT |
| LOW | docs/auth/oauth-developer-docs.md | 175 | ### Step 3: Poll for Token | COMMENT |
| LOW⚡ | scripts/oneoffs/reindex-missing-images.ts | 208 | // Step 1: Get all eligible images from database | COMMENT |
| LOW⚡ | scripts/oneoffs/reindex-missing-images.ts | 216 | // Step 2: Process in batches to avoid overwhelming DB and Meilisearch | COMMENT |
| LOW | scripts/oneoffs/reindex-missing-images.ts | 285 | // Step 3: Print summary | COMMENT |
| LOW | scripts/oneoffs/reindex-missing-images.ts | 301 | // Step 4: Queue for re-indexing | COMMENT |
| LOW⚡ | scripts/metric-migration/backfill-metrics.ts | 392 | // Step 1: Delete existing backfill data | COMMENT |
| LOW⚡ | scripts/metric-migration/backfill-metrics.ts | 395 | // Step 2: Get ID range (from args or query) | COMMENT |
| LOW | scripts/metric-migration/backfill-metrics.ts | 426 | // Step 3: Process in ID ranges | COMMENT |
| LOW | .vscode/rules/migrate-createStyles.md | 3 | ## Step 1: Convert Styles to SCSS | COMMENT |
| LOW | .vscode/rules/migrate-createStyles.md | 9 | ## Step 2: Integrate the SCSS File | COMMENT |
| LOW | src/server/jobs/new-order-jobs.ts | 62 | // Step 1: Grant buzz for judgments from 3 days ago | COMMENT |
| LOW | src/server/jobs/new-order-jobs.ts | 134 | // Step 2: Reconcile stale blessedBuzz counters for inactive users | COMMENT |
| LOW⚡ | src/server/jobs/new-order-jobs.ts | 228 | // Step 1: Batch fetch all counters efficiently (checks cache first, then batched DB queries) | COMMENT |
| LOW⚡ | src/server/jobs/new-order-jobs.ts | 236 | // Step 2: Build player stats from the batch-fetched data | COMMENT |
| LOW | src/server/jobs/new-order-jobs.ts | 255 | // Step 3: Update Redis fervor counter for players whose fervor changed | COMMENT |
| LOW | src/server/jobs/new-order-jobs.ts | 276 | // Step 4: Bulk update PostgreSQL with exp and recalculated fervor | COMMENT |
| LOW | src/server/jobs/new-order-jobs.ts | 293 | // Step 5: Clear rated images cache for all players in this batch | COMMENT |
| LOW | src/server/jobs/remove-old-drafts.ts | 10 | // Step 1: Query replica (dbRead) for model IDs to delete | COMMENT |
| LOW | src/server/jobs/remove-old-drafts.ts | 29 | // Step 2: Delete in batches using dbWrite to minimize lock duration | COMMENT |
| LOW | src/server/jobs/push-discord-metadata.ts | 10 | // Step 1: Get userIds with recent images and their last image date from ClickHouse (fast) | COMMENT |
| LOW | src/server/jobs/push-discord-metadata.ts | 24 | // Step 2: Get userIds with recent model activity and their last upload date from Postgres (fast) | COMMENT |
| LOW⚡ | src/server/jobs/push-discord-metadata.ts | 36 | // Step 3: Combine unique userIds | COMMENT |
| LOW⚡ | src/server/jobs/push-discord-metadata.ts | 44 | // Step 4: Get Discord metadata for active users (uses partial index on Account) | COMMENT |
| LOW | src/server/jobs/push-discord-metadata.ts | 64 | // Step 5: Enrich with activity dates and push to Discord | COMMENT |
| LOW⚡ | …erver/services/orchestrator/__tests__/step-ref.test.ts | 238 | // Step 0: txt2img — outputs images | COMMENT |
| LOW⚡ | …erver/services/orchestrator/__tests__/step-ref.test.ts | 239 | // Step 1: hires-fix — takes image input from step 0, outputs images | COMMENT |
| LOW⚡ | …erver/services/orchestrator/__tests__/step-ref.test.ts | 240 | // Step 2: face-fix — takes image input from step 1, outputs images | COMMENT |
| LOW⚡ | …erver/services/orchestrator/__tests__/step-ref.test.ts | 280 | // Step 0: txt2img — outputs images | COMMENT |
| LOW⚡ | …erver/services/orchestrator/__tests__/step-ref.test.ts | 281 | // Step 1: img2vid — takes image input from step 0, outputs video | COMMENT |
| LOW⚡ | …erver/services/orchestrator/__tests__/step-ref.test.ts | 313 | // Step 0: text-to-image generation | COMMENT |
| LOW⚡ | …erver/services/orchestrator/__tests__/step-ref.test.ts | 320 | // Step 1: face-fix referencing step 0's output | COMMENT |
| LOW | …/services/orchestrator/ecosystems/ace-audio.handler.ts | 118 | // Step 3: aceStepAudio — the actual generation. Mode-specific fields are | COMMENT |
| LOW | src/components/generation_v2/GenerationFormProvider.tsx | 693 | // Step 1: Switch workflow and ecosystem so the graph restores stored | COMMENT |
| LOW | src/components/generation_v2/GenerationFormProvider.tsx | 704 | // Step 2: Read the restored resources and merge incoming on top. | COMMENT |
| 19 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | tests/preview-moderation.spec.ts | 73 | // Be tolerant of 0..N rows on the prod clone — assert the grid scaffold exists, | COMMENT |
| MEDIUM | .claude/skills/xguard-manager/SKILL.md | 50 | # See what the defaults look like (useful for scaffolding a new label) | COMMENT |
| MEDIUM | docs/auto-label-orchestrator-revamp.md | 24 | ## Existing scaffolding to reuse | COMMENT |
| MEDIUM | docs/event-bus-discovery.md | 378 | **Recommended middle path:** don't block it on a full platform (failure mode #1), but make it the **Phase-0 driving feat | CODE |
| MEDIUM | docs/monorepo-directory-snapshot.md | 209 | │ └── moderator/ # Next.js content-moderation app (scaffold): a spoke that verifies | CODE |
| MEDIUM | docs/moderator-app-package-extraction-plan.md | 106 | ### Commit 2 — post-move changes (scaffolding + shims + import rewrites + member extractions) | COMMENT |
| MEDIUM | docs/moderator-app-package-extraction-plan.md | 211 | ### D. New package scaffolding (mirror `@civitai/db-schema`) | COMMENT |
| MEDIUM | docs/auth/oauth-security-review-2026-06-22.md | 1 | # OAuth implementation — multi-agent security review (2026-06-22) | COMMENT |
| MEDIUM | docs/features/scanner-policy-changes-2026-05-pass2.md | 71 | ### 3. Add few-shot examples to every rewritten policy | COMMENT |
| MEDIUM | docs/features/multi-image-upscale.md | 124 | ### 3. Backend: Multi-Step Fan-Out in `orchestration-new.service.ts` | COMMENT |
| MEDIUM | docs/features/prompt-snippets.md | 297 | ### Phase 1 — schema + tRPC scaffolding (backend only) | COMMENT |
| MEDIUM | src/tests/api/v1/blocks/dev-token.test.ts | 687 | // The exact root-cause scenario: the page-money scaffold manifest declares | COMMENT |
| MEDIUM | src/tests/pages/payment/success.browser.test.tsx | 26 | // The scaffold mocks `next/router` with a shared router object (spy `replace`, | COMMENT |
| MEDIUM | …sts__/bust-public-model-response-cache.service.test.ts | 7 | // ingest) to unit-test in isolation without a brittle scaffold, so its bust | COMMENT |
| MEDIUM | …ion_v2/inputs/MetadataExtractionPanel.browser.test.tsx | 101 | // We do NOT mock Mantine (resolve.dedupe handles dual-React at the scaffold). | COMMENT |
| MEDIUM | …eration_v2/inputs/ResourceItemContent.browser.test.tsx | 21 | // scaffold providers (MantineProvider + QueryClient + next/router). To stand | COMMENT |
| MEDIUM | …eration_v2/inputs/ResourceItemContent.browser.test.tsx | 53 | // Mantine is NOT mocked (resolve.dedupe handles dual-React at the scaffold). | COMMENT |
| MEDIUM | …eration_v2/inputs/ResourceSelectInput.browser.test.tsx | 79 | // We do NOT mock Mantine (resolve.dedupe handles dual-React at the scaffold). | COMMENT |
| MEDIUM | …ts/generation_v2/inputs/WorkflowInput.browser.test.tsx | 62 | // client needed. (The scaffold is network-free; mocking the hook is cheaper than | COMMENT |
| MEDIUM | …ts/generation_v2/inputs/WorkflowInput.browser.test.tsx | 98 | // We do NOT mock Mantine core (resolve.dedupe handles dual-React at the scaffold). | COMMENT |
| MEDIUM | …onents/generation_v2/inputs/SeedInput.browser.test.tsx | 10 | // props (no tRPC/router) — it anchors the scaffold while exercising Mantine | COMMENT |
| MEDIUM | …s/generation_v2/inputs/BaseModelInput.browser.test.tsx | 87 | // We do NOT mock Mantine core (resolve.dedupe handles dual-React at the scaffold). | COMMENT |
| MEDIUM | …nents/generation_v2/inputs/VideoInput.browser.test.tsx | 10 | // The component-setup scaffold deliberately does NOT wire a tRPC provider; a | COMMENT |
| MEDIUM | …nents/generation_v2/inputs/VideoInput.browser.test.tsx | 54 | // copy on a cold optimizeDeps cache. That's fixed at the scaffold level by | COMMENT |
| MEDIUM | src/components/AppBlocks/IframeHost.browser.test.tsx | 69 | // useBrowsingLevelDebounced reads a context the network-free scaffold doesn't | COMMENT |
| MEDIUM | src/components/AppBlocks/PageBlockHost.browser.test.tsx | 11 | // HoC) the network-free component scaffold doesn't provide. Mock the tRPC client | COMMENT |
| MEDIUM | src/components/Account/ApiKeysCard.tsx | 73 | // When the modal was opened via a deeplink (e.g. the App Blocks CLI scaffold's | COMMENT |
| MEDIUM | src/components/Account/ApiKeyModal.tsx | 57 | // Optional deeplink prefill (e.g. the App Blocks CLI scaffold link). These are | COMMENT |
| MEDIUM | src/pages/api/internal/blocks/workflow-completed.ts | 18 | // M-6 (audit): idempotency dedup. Phase 3 billing will inherit this scaffold; | COMMENT |
| MEDIUM | src/pages/api/internal/blocks/workflow-completed.ts | 39 | // acceptable while this is a no-op scaffold (no billing yet); revisit when | COMMENT |
| MEDIUM | src/pages/api/internal/blocks/workflow-completed.ts | 95 | // scaffold with no billing + the orchestrator does not emit the callback yet), | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | scripts/oneoffs/reindex-missing-images.ts | 208 | // Step 1: Get all eligible images from database | COMMENT |
| LOW⚡ | scripts/oneoffs/reindex-missing-images.ts | 216 | // Step 2: Process in batches to avoid overwhelming DB and Meilisearch | COMMENT |
| LOW | scripts/oneoffs/reindex-missing-images.ts | 285 | // Step 3: Print summary | COMMENT |
| LOW | scripts/oneoffs/reindex-missing-images.ts | 301 | // Step 4: Queue for re-indexing | COMMENT |
| LOW⚡ | scripts/metric-migration/backfill-metrics.ts | 392 | // Step 1: Delete existing backfill data | COMMENT |
| LOW⚡ | scripts/metric-migration/backfill-metrics.ts | 395 | // Step 2: Get ID range (from args or query) | COMMENT |
| LOW | scripts/metric-migration/backfill-metrics.ts | 426 | // Step 3: Process in ID ranges | COMMENT |
| LOW | src/server/jobs/new-order-jobs.ts | 62 | // Step 1: Grant buzz for judgments from 3 days ago | COMMENT |
| LOW | src/server/jobs/new-order-jobs.ts | 134 | // Step 2: Reconcile stale blessedBuzz counters for inactive users | COMMENT |
| LOW⚡ | src/server/jobs/new-order-jobs.ts | 228 | // Step 1: Batch fetch all counters efficiently (checks cache first, then batched DB queries) | COMMENT |
| LOW⚡ | src/server/jobs/new-order-jobs.ts | 236 | // Step 2: Build player stats from the batch-fetched data | COMMENT |
| LOW | src/server/jobs/new-order-jobs.ts | 255 | // Step 3: Update Redis fervor counter for players whose fervor changed | COMMENT |
| LOW | src/server/jobs/new-order-jobs.ts | 276 | // Step 4: Bulk update PostgreSQL with exp and recalculated fervor | COMMENT |
| LOW | src/server/jobs/new-order-jobs.ts | 293 | // Step 5: Clear rated images cache for all players in this batch | COMMENT |
| LOW | src/server/jobs/remove-old-drafts.ts | 10 | // Step 1: Query replica (dbRead) for model IDs to delete | COMMENT |
| LOW | src/server/jobs/remove-old-drafts.ts | 29 | // Step 2: Delete in batches using dbWrite to minimize lock duration | COMMENT |
| LOW | src/server/jobs/push-discord-metadata.ts | 10 | // Step 1: Get userIds with recent images and their last image date from ClickHouse (fast) | COMMENT |
| LOW | src/server/jobs/push-discord-metadata.ts | 24 | // Step 2: Get userIds with recent model activity and their last upload date from Postgres (fast) | COMMENT |
| LOW⚡ | src/server/jobs/push-discord-metadata.ts | 36 | // Step 3: Combine unique userIds | COMMENT |
| LOW⚡ | src/server/jobs/push-discord-metadata.ts | 44 | // Step 4: Get Discord metadata for active users (uses partial index on Account) | COMMENT |
| LOW | src/server/jobs/push-discord-metadata.ts | 64 | // Step 5: Enrich with activity dates and push to Discord | COMMENT |
| LOW | src/server/services/bountyEntry.service.ts | 583 | // TODO: Once we support Tipping entries - we need to check if a tipConnection is created | COMMENT |
| LOW⚡ | …erver/services/orchestrator/__tests__/step-ref.test.ts | 238 | // Step 0: txt2img — outputs images | COMMENT |
| LOW⚡ | …erver/services/orchestrator/__tests__/step-ref.test.ts | 239 | // Step 1: hires-fix — takes image input from step 0, outputs images | COMMENT |
| LOW⚡ | …erver/services/orchestrator/__tests__/step-ref.test.ts | 240 | // Step 2: face-fix — takes image input from step 1, outputs images | COMMENT |
| LOW⚡ | …erver/services/orchestrator/__tests__/step-ref.test.ts | 280 | // Step 0: txt2img — outputs images | COMMENT |
| LOW⚡ | …erver/services/orchestrator/__tests__/step-ref.test.ts | 281 | // Step 1: img2vid — takes image input from step 0, outputs video | COMMENT |
| LOW⚡ | …erver/services/orchestrator/__tests__/step-ref.test.ts | 313 | // Step 0: text-to-image generation | COMMENT |
| LOW⚡ | …erver/services/orchestrator/__tests__/step-ref.test.ts | 320 | // Step 1: face-fix referencing step 0's output | COMMENT |
| LOW | …/services/orchestrator/ecosystems/ace-audio.handler.ts | 118 | // Step 3: aceStepAudio — the actual generation. Mode-specific fields are | COMMENT |
| LOW | src/components/generation_v2/GenerationFormProvider.tsx | 693 | // Step 1: Switch workflow and ecosystem so the graph restores stored | COMMENT |
| LOW | src/components/generation_v2/GenerationFormProvider.tsx | 704 | // Step 2: Read the restored resources and merge incoming on top. | COMMENT |
| LOW | …c/components/Subscriptions/PrepaidBuzzTransactions.tsx | 147 | // Step 1: Direct match via externalTransactionId suffix (redemption transactions) | COMMENT |
| LOW | …c/components/Subscriptions/PrepaidBuzzTransactions.tsx | 168 | // Step 2: FIFO + tier-aware assignment for job deliveries (:v3) | COMMENT |
| LOW | …/pages/api/admin/temp/remove-deprecated-base-models.ts | 44 | // Step 1: Find all affected ModelVersions | COMMENT |
| LOW⚡ | …/pages/api/admin/temp/remove-deprecated-base-models.ts | 99 | // Step 2: Track affected Models and users | COMMENT |
| LOW⚡ | …/pages/api/admin/temp/remove-deprecated-base-models.ts | 103 | // Step 3: Soft delete all affected ModelVersions | COMMENT |
| LOW | …/pages/api/admin/temp/remove-deprecated-base-models.ts | 117 | // Step 4: Update lastVersionAt for affected models | COMMENT |
| LOW | …/pages/api/admin/temp/remove-deprecated-base-models.ts | 128 | // Step 5: Find Models with no active versions (optimized single query) | COMMENT |
| LOW | …/pages/api/admin/temp/remove-deprecated-base-models.ts | 153 | // Step 6: Soft delete Models with no active versions | COMMENT |
| LOW | …/pages/api/admin/temp/remove-deprecated-base-models.ts | 218 | // Step 7: Clean up cache for deleted versions | COMMENT |
| LOW | …/pages/api/admin/temp/remove-deprecated-base-models.ts | 232 | // Step 8: Clean up bids for deleted versions | COMMENT |
| LOW | …/pages/api/admin/temp/remove-deprecated-base-models.ts | 253 | // Step 9: Clean up bids for deleted models | COMMENT |
| LOW | …/pages/api/admin/temp/remove-deprecated-base-models.ts | 272 | // Step 10: Send notifications to affected users (batched) | COMMENT |
| LOW | src/pages/api/admin/temp/migrate-article-images.ts | 73 | // Step 1: Find all Article ImageConnections and their image IDs | COMMENT |
| LOW | src/pages/api/admin/temp/migrate-article-images.ts | 92 | // Step 2: Find which images have OTHER references and must be preserved. | COMMENT |
| LOW | src/pages/api/admin/temp/migrate-article-images.ts | 129 | // Step 3: Delete tags on orphaned images | COMMENT |
| LOW⚡ | src/pages/api/admin/temp/migrate-article-images.ts | 140 | // Step 4: Delete all Article ImageConnections | COMMENT |
| LOW⚡ | src/pages/api/admin/temp/migrate-article-images.ts | 147 | // Step 5: Delete orphaned images (no S3 deletion — these are references to content URLs) | COMMENT |
| LOW | src/pages/api/admin/temp/migrate-article-images.ts | 158 | // Step 6: Recompute article ingestion (will go back to Scanned since no images remain) | COMMENT |
| LOW | src/pages/api/admin/temp/fix-over-refunded-users.ts | 58 | // Step 1: Query ClickHouse to get the transaction IDs for these refunds | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | tests/preview-engagement.spec.ts | 72 | // `?? null` collapses null/undefined alike so the assertion is robust to the | COMMENT |
| MEDIUM | apps/auth/src/lib/server/auth/session-shape.ts | 8 | // of the rest of the blob. PARITY NOTE: this is intentionally more robust than getSessionUser — for the (rare) | COMMENT |
| MEDIUM | apps/auth/src/lib/server/auth/verifier.ts | 6 | // no self-HTTP-fetch to its own JWKS endpoint — robust even if ORIGIN/the route is misconfigured. | COMMENT |
| MEDIUM | apps/auth/src/lib/server/auth/device.ts | 26 | // "seamless switch-back" / re-auth window (a security/UX knob), not a capacity lever. | COMMENT |
| MEDIUM | apps/auth/src/lib/server/auth/__tests__/device.test.ts | 283 | // Backdate account 100 to just past the idle window (TTL + 1 day) — robust to the TTL value. | COMMENT |
| MEDIUM | apps/auth/src/routes/logout/+server.ts | 62 | // Clear the hub's `.civitai.com` session AND device cookies (the seamless-switch account set must not survive | COMMENT |
| MEDIUM | src/server/metrics/__tests__/appListing.metrics.test.ts | 86 | // Normalize whitespace so the assertions are robust to formatting. | COMMENT |
| MEDIUM | src/server/auth/__tests__/logout-cookies.test.ts | 3 | // Regression for finding M2: main-app logout must clear the device cookie (`civ-device`) that gates seamless | COMMENT |
| MEDIUM | …/orchestrator/__tests__/submitWorkflow.timeout.test.ts | 160 | // Keep this case so the fix is robust to BOTH client behaviors (resolve AND throw). | COMMENT |
| MEDIUM | src/components/CivitaiWrapped/AccountProvider.tsx | 27 | needsLogin?: boolean; // aged out of the seamless-switch window → clicking re-authenticates at the hub | CODE |
| MEDIUM | src/components/CivitaiWrapped/AccountProvider.tsx | 58 | // Switch by userId: seamless device switch if fresh in the set, legacy-token redeem if mid-migration, else | COMMENT |
| MEDIUM | src/components/CivitaiWrapped/AccountProvider.tsx | 104 | // Legacy token store — read for seamless migration only. | COMMENT |
| MEDIUM⚡ | src/components/CivitaiWrapped/AccountProvider.tsx | 219 | // 1. Fresh in the device set → seamless switch (the hub mints a fresh civ-token; the proxy sets it). | COMMENT |
| MEDIUM⚡ | src/components/CivitaiWrapped/AccountProvider.tsx | 225 | // 2. Not seamlessly switchable (aged out of the device set, or a legacy account whose seamless next-auth | COMMENT |
| MEDIUM⚡ | src/components/CivitaiWrapped/AccountProvider.tsx | 231 | // device set. Best-effort; we refetch the seamless set afterward. | COMMENT |
| MEDIUM | src/components/AppBlocks/iframeInitController.ts | 25 | // robust to BOTH the missed-load race AND posting before the block's message | COMMENT |
| MEDIUM | src/components/AppLayout/AppHeader/UserMenu.tsx | 303 | // Aged out of the seamless-switch window — clicking re-authenticates at the hub. | COMMENT |
| MEDIUM | src/hooks/hidden-preferences/useHiddenPreferences.ts | 16 | // `.map(...)`. This makes THIS bundle (and any later one) robust to either | COMMENT |
| MEDIUM | src/pages/api/v1/blocks/submit-version.ts | 184 | // identity. Switching here to `user:${user.id}` would be the more robust limit; | COMMENT |
| MEDIUM | src/pages/api/auth/logout.ts | 19 | // gates seamless multi-account switching (HttpOnly, so the client can't clear it; on a shared machine the | COMMENT |
| MEDIUM | src/pages/api/auth/logout.ts | 55 | // (in particular the device cookie that gates seamless switching) are unit-testable without an HTTP round-trip. | COMMENT |
| MEDIUM | src/pages/api/auth/logout.ts | 70 | // it would let the seamless-switch account set survive logout on a shared machine. Clear BOTH prefixes. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | .claude/agents/design-mockup.md | 114 | <img src="https://picsum.photos/seed/aiart[number]/400/500" alt="AI generated art"> | CODE |
| HIGH | docs/features/challenge-platform.md | 439 | System // Auto-generated by AI job | CODE |
| HIGH | docs/features/challenge-platform.md | 466 | aiSummary String? // AI-generated description | CODE |
| HIGH | docs/features/referral-program-review.md | 93 | - Single auto-generated code per user | CODE |
| HIGH | docs/features/referral-program-review.md | 240 | - [ ] Hit `/user/referrals` — dashboard renders with your auto-generated code | CODE |
| HIGH | docs/features/referral-program.md | 395 | 7. **@ai:** Should we allow users to generate multiple codes (current cap: 3) or collapse to a single code per user for | CODE |
| HIGH | docs/features/referral-program.md | 407 | 10. **@ai:** Custom codes admin UX: for v1, manual DB insert (or mod-actions script) is fine? Or do you want a simple ad | CODE |
| HIGH | src/static-content/art-and-ai.md | 24 | The above statement was written by ChatGPT, but is no less true because of it, just like how art generated by AI is no l | CODE |
| HIGH | src/static-content/au-region-block.md | 8 | This is due to Australia's [Age-Restricted Material Codes](https://www.esafety.gov.au/about-us/industry-regulation/socia | CODE |
| HIGH | src/server/jobs/scan-files.ts | 52 | // Mark batch as requested upfront so overlapping runs won't re-process | COMMENT |
| HIGH | src/server/services/article.service.ts | 897 | // Mark scan as requested after successfully linking images | COMMENT |
| HIGH | …c/components/Post/EditV2/PostImageCards/AddedImage.tsx | 742 | We couldn’t confirm that this image was generated by AI. To resolve this, | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | .claude/agents/design-mockup.md | 109 | <img src="https://picsum.photos/seed/[unique-seed]/400/500" alt="placeholder"> | CODE |
| LOW | .claude/skills/freshdesk/SKILL.md | 121 | node .claude/skills/freshdesk/query.mjs search "email:'user@example.com'" | CODE |
| LOW | .claude/skills/freshdesk/SKILL.md | 274 | | `"email:'user@example.com'"` | By requester email | | CODE |
| LOW | .claude/skills/freshdesk/SKILL.md | 435 | SELECT id, username, email, "bannedAt", "muted", "createdAt" FROM "User" WHERE email = 'user@example.com'; | CODE |
| LOW | .claude/skills/stripe/SKILL.md | 25 | node "$SKILL_DIR/query.mjs" search "email:'user@example.com'" | CODE |
| LOW | docs/features/account-switching.md | 157 | email: "user@example.com", | CODE |
| LOW | packages/civitai-db-schema/prisma/seed.ts | 33 | 'Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna a | CODE |
| LOW | packages/civitai-db-schema/prisma/seed.ts | 33 | 'Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna a | CODE |
| LOW | apps/moderator/src/routes/page-visits/+page.svelte | 20 | <div class="placeholder">No page visits recorded yet.</div> | CODE |
| LOW | …ps/moderator/src/routes/page-visits/route/+page.svelte | 23 | <div class="placeholder">No visits to this route in the window.</div> | CODE |
| LOW | apps/moderator/src/routes/images/+page.svelte | 6 | <div class="placeholder">Not built yet.</div> | CODE |
| LOW | apps/moderator/src/routes/users/+page.svelte | 6 | <div class="placeholder">Not built yet.</div> | CODE |
| LOW | apps/moderator/src/routes/reports/+page.svelte | 6 | <div class="placeholder">Not built yet.</div> | CODE |
| LOW | src/server/common/constants.ts | 21 | Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliq | CODE |
| LOW | src/server/common/constants.ts | 21 | Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliq | CODE |
| LOW | src/server/email/templates/trainingFail.email.ts | 99 | email: 'test@test.com', | CODE |
| LOW | src/server/email/templates/strikeIssued.email.ts | 188 | to: 'test@test.com', | CODE |
| LOW | …server/email/templates/stuckCryptoDepositUser.email.ts | 88 | userEmail: 'user@example.com', | CODE |
| LOW | src/server/email/templates/trainingComplete.email.ts | 97 | email: 'test@test.com', | CODE |
| LOW | …r/email/templates/moderation/moderationAction.email.ts | 175 | to: 'test@test.com', | CODE |
| LOW | …il/templates/moderation/moderationAction.email.test.ts | 62 | to: 'user@example.com', | CODE |
| LOW | …il/templates/moderation/moderationAction.email.test.ts | 152 | to: 'user@example.com', | CODE |
| LOW | src/utils/faro/__tests__/redact.test.ts | 59 | expect(out).not.toContain('user@example.com'); | CODE |
| LOW | src/utils/faro/__tests__/redact.test.ts | 150 | nested: ['plain', 'reach me at eve@example.org'], | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | .claude/skills/deploy-status/deploy-chain.sh | 17 | # Usage: | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | src/components/Search/parsers/base.ts | 36 | // TODO: implement Model3D search parser | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | src/store/post-image-transmitter.store.ts | 84 | async function getData(url: string, options?: { allowExternalUrl?: boolean }) { | CODE |