A repository of models, textual inversions, and more
This report summarizes scanner evidence for civitai/civitai, a TypeScript project with 7,273 GitHub stars. SynthScan examined 2,490,993 lines of code across 11493 source files, recording 7562 pattern matches distributed across 18 syntactic categories. The legacy adjusted pattern signal is 4.5 (Low pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Can maintainers explain intent, assumptions, and trade-offs? 6251 finding(s).
Are imports declared and package/API names verified? 256 finding(s).
Are wrappers, guards, and repeated structures necessary? 2860 finding(s).
Which changes need focused human review? 7562 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 7562 distinct pattern matches across 18 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | playwright.preview.config.ts | 21 | testDir: './tests', | COMMENT |
| LOW | eslint-local-rules.js | 941 | // act on. The split is "did you even try to spread?": | COMMENT |
| LOW | eslint-local-rules.js | 1221 | // the conditional/logical arms recurse into both sides, so k chained aliases | COMMENT |
| LOW | eslint-local-rules.js | 1281 | case 'SequenceExpression': | COMMENT |
| LOW | tsconfig.tests.json | 1 | { | COMMENT |
| LOW | tsconfig.scripts.json | 1 | { | COMMENT |
| LOW | .eslintrc.js | 21 | // "plugin:import/typescript", | COMMENT |
| LOW | .eslintrc.js | 81 | // wholesale factory breaks the whole test FILE the day the module gains an | COMMENT |
| LOW | .eslintrc.js | 101 | // | COMMENT |
| LOW | .eslintrc.js | 121 | // | COMMENT |
| LOW | .eslintrc.js | 141 | // violating this rule for `~/utils/trpc` alone. Those persist because the | COMMENT |
| LOW | .eslintrc.js | 161 | // Those 3 are listed. The rest fail ONLY on (c) and are deliberately left | COMMENT |
| LOW | .eslintrc.js | 201 | // #4147 was exactly that, which is why #4178 says the existing rule "has no | COMMENT |
| LOW | .eslintrc.js | 221 | // GitHub Actions (the eslint job is the only ESLint lane and is | COMMENT |
| LOW | .eslintrc.js | 261 | // not in the ~150 suites that wholesale-mock `~/server/redis/client` and the | COMMENT |
| LOW | .eslintrc.js | 281 | // a safe shape — all 22 are keyed off REDIS_KEYS at module scope, | COMMENT |
| LOW | .eslintrc.js | 301 | // cheapest, and the one that grows the backlog. | COMMENT |
| LOW | .eslintrc.js | 321 | // | COMMENT |
| LOW | .eslintrc.js | 341 | // notice's own gate withholds it until the iframe posts `BLOCK_READY`. So the | COMMENT |
| LOW | .eslintrc.js | 361 | }, | COMMENT |
| LOW | .eslintrc.js | 381 | // | COMMENT |
| LOW | .eslintrc.js | 401 | // They are latent, not harmless — each becomes a flake the moment someone | COMMENT |
| LOW | tsconfig.json | 81 | "./node_modules/*", | COMMENT |
| LOW | tsconfig.json | 101 | // files there carry them, and ALL 15 were added within one month. Including | COMMENT |
| LOW | docker-compose.base.yml | 121 | COMMENT | |
| LOW | test/component-setup.tsx | 161 | // insecure context with no clipboard permission, so the REAL `writeText` | COMMENT |
| LOW | test/component-setup.tsx | 181 | // `await act(async () => root.unmount())` and only THEN | COMMENT |
| LOW | test/geometry-setup.tsx | 161 | // ───────────────────────────────────────────────────────────────────────────── | COMMENT |
| LOW | tests/preview-moderation.spec.ts | 181 | // If the CSRF/origin gate (createContext.ts) rejects this direct tRPC POST with | COMMENT |
| LOW | tests/preview-moderation.spec.ts | 201 | // | COMMENT |
| LOW | tests/preview-buzz.spec.ts | 81 | // "Memberships | Civitai"> regardless of branch (green plans vs. yellow | COMMENT |
| LOW | tests/preview-remix.spec.ts | 41 | COMMENT | |
| LOW | tests/preview-og.spec.ts | 61 | // be one of `images.qualities` (default `[75]`), and a query string on a LOCAL | COMMENT |
| LOW | tests/preview-membership.spec.ts | 41 | // land on the membership page itself (getServerSideProps only redirects | COMMENT |
| LOW | tests/preview-generation.spec.ts | 121 | // retries fire within seconds — too fast to outlast a load spike. Retry the whole | COMMENT |
| LOW | tests/preview-generation.spec.ts | 161 | expect(resp?.status(), 'HTTP status for /generate').toBeLessThan(400); | COMMENT |
| LOW | tests/preview-auth.setup.ts | 101 | // capped at 60s) so one route compiles at a time (parallel heavy renders OOM the | COMMENT |
| LOW | tests/preview-auth.setup.ts | 141 | } | COMMENT |
| LOW | tests/preview-apps-marketplace.spec.ts | 141 | // | COMMENT |
| LOW | tests/preview-apps-marketplace.spec.ts | 221 | // The scopes + slots arrays are shape-correct (anon-display allowlist). | COMMENT |
| LOW | tests/preview-apps-marketplace.spec.ts | 261 | // replacements pin a property the `toMatch` genuinely leaves open. | COMMENT |
| LOW | tests/preview-apps-page.spec.ts | 121 | // the e2e proof the page-mint path works (two-flag gate cleared, synthetic | COMMENT |
| LOW | …aude/skills/app-capture/tests/run-tests-app-capture.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | …aude/skills/app-capture/tests/run-tests-app-capture.sh | 21 | # makes its zero meaningful. | COMMENT |
| LOW | …aude/skills/app-capture/tests/run-tests-app-capture.sh | 161 | COMMENT | |
| LOW | …aude/skills/app-capture/tests/run-tests-app-capture.sh | 461 | # BOTH were wrong: `custom-generators` and `gen-matrix` refused while | COMMENT |
| LOW | …aude/skills/app-capture/tests/run-tests-app-capture.sh | 801 | COMMENT | |
| LOW | …aude/skills/app-capture/tests/run-tests-app-capture.sh | 921 | # | COMMENT |
| LOW | …aude/skills/app-capture/tests/run-tests-app-capture.sh | 981 | if r != (201, -187, 14, 1709, 1314, None): | COMMENT |
| LOW | …aude/skills/app-capture/tests/run-tests-app-capture.sh | 1061 | json.dump(r,open(sys.argv[2],"w"))' "$RECIPES/model-benchmarking.json" "${WORK}/rec-nohost.json" | COMMENT |
| LOW | …aude/skills/app-capture/tests/run-tests-app-capture.sh | 1181 | # any one app — so the fixture is just a PNG with a known column (COLUMN above, | COMMENT |
| LOW | …aude/skills/app-capture/tests/run-tests-app-capture.sh | 1501 | "to the frame edge, not tighten it: %s" % p.stderr[:160]) | COMMENT |
| LOW | …aude/skills/app-capture/tests/run-tests-app-capture.sh | 1561 | F.declared_box(PLAIN, dict(ABSOLUTE, x=True), 182, 110, 70, None, (1709, 1314)) | COMMENT |
| LOW | …aude/skills/app-capture/tests/run-tests-app-capture.sh | 1641 | g13d="$(grep -cF -- '${USE_APPFRAME:+--app-frame-rect "$OUT/$st.rect.json"}' "$SCRIPTS/capture.sh" || true)" | COMMENT |
| LOW | …aude/skills/app-capture/tests/run-tests-app-capture.sh | 1661 | # the SAME declared rect, with the SAME record, must photograph the SAME PIXELS | COMMENT |
| LOW | …aude/skills/app-capture/tests/run-tests-app-capture.sh | 2201 | # C5 🔴 THE VIEWPORT OF RECORD — REPRODUCED FROM THE 2026-09-02 INCIDENT, WITH | COMMENT |
| LOW | …aude/skills/app-capture/tests/run-tests-app-capture.sh | 2381 | else | COMMENT |
| LOW | …aude/skills/app-capture/tests/run-tests-app-capture.sh | 2401 | # refs to 2 (tripping the tests/ control below) while the demoted path became checked by | COMMENT |
| LOW | …aude/skills/app-capture/tests/run-tests-app-capture.sh | 2421 | # in the mutation battery"; that was FALSE -- the battery has no D2 mutant at all. | COMMENT |
| LOW | …aude/skills/app-capture/tests/run-tests-app-capture.sh | 2501 | # reference out of coverage, and it is the documented reason D2b ever existed. The | COMMENT |
| 4014 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | test/geometry-setup.tsx | 122 | // ── THE CASCADE, IN PRODUCTION ORDER ───────────────────────────────────────── | COMMENT |
| MEDIUM | test/geometry-setup.tsx | 161 | // ───────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/geometry-setup.tsx | 173 | // ───────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/geometry-setup.tsx | 241 | // ───────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/geometry-setup.tsx | 247 | // ───────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/geometry-setup.tsx | 376 | // ───────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/geometry-setup.tsx | 378 | // ───────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …aude/skills/app-capture/tests/run-tests-app-capture.sh | 2 | # ============================================================================ | COMMENT |
| MEDIUM | …aude/skills/app-capture/tests/run-tests-app-capture.sh | 27 | # ============================================================================ | COMMENT |
| MEDIUM | …aude/skills/app-capture/tests/run-tests-app-capture.sh | 70 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | …aude/skills/app-capture/tests/run-tests-app-capture.sh | 72 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | …aude/skills/app-capture/tests/run-tests-app-capture.sh | 162 | # ── THE host -> observed-fixture MAP: ONE PLACE. ──────────────────────────── | COMMENT |
| MEDIUM | …aude/skills/app-capture/tests/run-tests-app-capture.sh | 208 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | …aude/skills/app-capture/tests/run-tests-app-capture.sh | 210 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | …aude/skills/app-capture/tests/run-tests-app-capture.sh | 269 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | …aude/skills/app-capture/tests/run-tests-app-capture.sh | 272 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | …aude/skills/app-capture/tests/run-tests-app-capture.sh | 758 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | …aude/skills/app-capture/tests/run-tests-app-capture.sh | 761 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | …aude/skills/app-capture/tests/run-tests-app-capture.sh | 919 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | …aude/skills/app-capture/tests/run-tests-app-capture.sh | 932 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | …aude/skills/app-capture/tests/run-tests-app-capture.sh | 1074 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | …aude/skills/app-capture/tests/run-tests-app-capture.sh | 1089 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | …aude/skills/app-capture/tests/run-tests-app-capture.sh | 1221 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | …aude/skills/app-capture/tests/run-tests-app-capture.sh | 1226 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | …aude/skills/app-capture/tests/run-tests-app-capture.sh | 1312 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | …aude/skills/app-capture/tests/run-tests-app-capture.sh | 1328 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | …aude/skills/app-capture/tests/run-tests-app-capture.sh | 1649 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | …aude/skills/app-capture/tests/run-tests-app-capture.sh | 1672 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | …aude/skills/app-capture/tests/run-tests-app-capture.sh | 1985 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | …aude/skills/app-capture/tests/run-tests-app-capture.sh | 1988 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | …aude/skills/app-capture/tests/run-tests-app-capture.sh | 2068 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | …aude/skills/app-capture/tests/run-tests-app-capture.sh | 2071 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | …aude/skills/app-capture/tests/run-tests-app-capture.sh | 2113 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | …aude/skills/app-capture/tests/run-tests-app-capture.sh | 2116 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | …aude/skills/app-capture/tests/run-tests-app-capture.sh | 2200 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | …aude/skills/app-capture/tests/run-tests-app-capture.sh | 2220 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | …aude/skills/app-capture/tests/run-tests-app-capture.sh | 2374 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | …aude/skills/app-capture/tests/run-tests-app-capture.sh | 2377 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | …aude/skills/app-capture/tests/run-tests-app-capture.sh | 2747 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | …aude/skills/app-capture/tests/run-tests-app-capture.sh | 2750 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | …aude/skills/app-capture/tests/run-tests-app-capture.sh | 3813 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | …aude/skills/app-capture/tests/run-tests-app-capture.sh | 3816 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | …aude/skills/app-capture/tests/run-tests-app-capture.sh | 5385 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | …aude/skills/app-capture/tests/run-tests-app-capture.sh | 5394 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | …aude/skills/app-capture/tests/run-tests-app-capture.sh | 5482 | # ------------------------------------------------------------------------- | COMMENT |
| MEDIUM | …aude/skills/app-capture/tests/run-tests-app-capture.sh | 5494 | # ------------------------------------------------------------------------- | COMMENT |
| MEDIUM | …aude/skills/app-capture/tests/run-tests-app-capture.sh | 5532 | # ------------------------------------------------------------------------- | COMMENT |
| MEDIUM | …aude/skills/app-capture/tests/run-tests-app-capture.sh | 5551 | # ------------------------------------------------------------------------- | COMMENT |
| MEDIUM | …aude/skills/app-capture/tests/run-tests-app-capture.sh | 5604 | # ------------------------------------------------------------------------- | COMMENT |
| MEDIUM | …aude/skills/app-capture/tests/run-tests-app-capture.sh | 5613 | # ------------------------------------------------------------------------- | COMMENT |
| MEDIUM | …aude/skills/app-capture/tests/run-tests-app-capture.sh | 5651 | # ------------------------------------------------------------------------- | COMMENT |
| MEDIUM | …aude/skills/app-capture/tests/run-tests-app-capture.sh | 5666 | # ------------------------------------------------------------------------- | COMMENT |
| MEDIUM | …aude/skills/app-capture/tests/run-tests-app-capture.sh | 5732 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | …aude/skills/app-capture/tests/run-tests-app-capture.sh | 5736 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | …aude/skills/app-capture/tests/run-tests-app-capture.sh | 6236 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | …aude/skills/app-capture/tests/run-tests-app-capture.sh | 6238 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | …aude/skills/app-capture/tests/run-tests-app-capture.sh | 6306 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | .claude/skills/app-capture/tests/mutants-app-capture.sh | 307 | # ── SELF-TEST: this battery's own NEGATIVE CONTROL ────────────────────────── | COMMENT |
| MEDIUM⚡ | .claude/skills/app-capture/tests/mutants-app-capture.sh | 748 | # ── evidence.py: the testid inventory ─────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | .claude/skills/app-capture/tests/mutants-app-capture.sh | 757 | # ── evidence.py: the two refusals that stop a reassuring zero ─────────────── | COMMENT |
| 992 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | eslint-local-rules.js | 1196 | function createLiteralTrpcAnalyzer(factory) { | CODE |
| LOW | test/unreadable-files.ts | 67 | export function makeFilesExpireAfterFirstRead() { | CODE |
| LOW | tests/preview-bootstrap.spec.ts | 76 | async function readBrowsingSettingsAddons(page: import('@playwright/test').Page) { | CODE |
| LOW | tests/preview-ssr-inject.spec.ts | 142 | function assertAnnouncementsSeedEqualsLive(seed: unknown, live: unknown, label: string) { | CODE |
| LOW | .claude/skills/app-capture/scripts/attach-offsite.py | 273 | def existing_screenshot_count(slug): | CODE |
| LOW | docs/article-ingestion-status-proposal.md | 121 | export async function recomputeArticleIngestion(articleId: number): Promise<void> { | CODE |
| LOW | docs/subscription-remaining-tasks.md | 266 | export async function hasActiveMembershipForBuzzType(userId: number, buzzType: string) { | CODE |
| LOW | docs/base-model-constants-management.md | 500 | async function getBaseModelConfigForClient() { | CODE |
| LOW⚡ | docs/subscription-multi-buzz-migration.md | 129 | async function getUserSubscriptionForBuzzType(userId: number, buzzType: BuzzSpendType) | CODE |
| LOW⚡ | docs/subscription-multi-buzz-migration.md | 135 | async function hasActiveMembershipForBuzzType(userId: number, buzzType: BuzzSpendType) | CODE |
| LOW⚡ | docs/subscription-multi-buzz-migration.md | 138 | async function getUserActiveSubscriptions(userId: number) | CODE |
| LOW | docs/feed-card-dom-audit.md | 97 | export function ImagesAsPostsInfiniteProvider({ | CODE |
| LOW | docs/moderator-app/retool-exports/bulk-image-manager.md | 135 | function handleFilteredImageDelete(imageIds){ | CODE |
| LOW | docs/moderator-app/retool-exports/bulk-image-manager.md | 384 | function handleFilteredImageRestore(imageIds){ | CODE |
| LOW | docs/moderator-app/retool-exports/user-reports.md | 146 | function handleFilteredImageDelete(imageIds){ | CODE |
| LOW | docs/moderator-app/retool-exports/user-reports.md | 255 | function handleFilteredImageRestore(imageIds){ | CODE |
| LOW⚡ | …derator-app/retool-exports/raw/bulk-image-manager.json | 1 | {"uuid":"57fd8fb4-51ac-11ee-a0dd-9f0a271c8c9b","page":{"id":510420824,"data":{"appState":"[\"~#iR\",[\"^ \",\"n\",\"appT | CODE |
| LOW⚡ | docs/moderator-app/retool-exports/raw/user-reports.json | 1 | {"uuid":"a7fbd3e4-46ee-11ef-addd-8b299ca80778","page":{"id":510420693,"data":{"appState":"[\"~#iR\",[\"^ \",\"n\",\"appT | CODE |
| LOW | docs/plans/generator-filtering-options.md | 100 | export function getProcessTagFromWorkflow(workflow: string, hasSourceImage: boolean): string | undefined { | CODE |
| LOW | docs/plans/generator-filtering-options.md | 300 | export function useGetTextToImageRequests(/* ... */) { | CODE |
| LOW | docs/plans/live-metric-signals.md | 534 | export function useMetricSubscriptionContext() { | CODE |
| LOW | docs/plans/live-metric-signals.md | 545 | export function MetricSubscriptionProvider({ | CODE |
| LOW | docs/auth/session-refresh-debug-instrumentation.md | 120 | function checkAndSetSessionHeaders(session: Session | null, res: AuthResponse): Session | null { | CODE |
| LOW | docs/features/prompt-snippets-provisioning-job.md | 87 | async function importWildcardModelVersion(modelVersionId: number): Promise<{ | CODE |
| LOW | scripts/eval-resource-intent-registration.ts | 373 | export function renderRetrievalPreregistration(): string { | CODE |
| LOW | scripts/metric-migration/backfill-metrics.ts | 182 | async function deleteExistingBackfillData(entityType: string, dryRun: boolean): Promise<void> { | CODE |
| LOW | …i-telemetry/src/__tests__/packed-codec-buckets.test.ts | 107 | function floorIsBelowDispatchFloor(buckets: readonly number[]) { | CODE |
| LOW | …ages/civitai-telemetry/src/__tests__/otel-logs.test.ts | 52 | function registerRecordingProvider(): InMemoryLogRecordExporter { | CODE |
| LOW | packages/civitai-auth/src/first-party-bridge.ts | 144 | export async function completeFirstPartyCallback(opts: { | CODE |
| LOW | packages/civitai-auth/src/impersonation-client.ts | 32 | export function createImpersonationClient(): ImpersonationClient { | CODE |
| LOW | packages/civitai-auth/src/legacy-cookie.ts | 19 | export async function decodeLegacySessionCookie( | CODE |
| LOW | packages/civitai-auth/src/token-scope.ts | 331 | export function connectScopesSubsetOfCeiling(requested: number, allowedScopes: number): boolean { | CODE |
| LOW | packages/civitai-auth/src/token-scope.ts | 346 | export function validateConnectScopeJustifications( | CODE |
| LOW | packages/civitai-auth/src/trusted-domains.ts | 55 | export function createTrustedDomainRegistry( | CODE |
| LOW | packages/civitai-auth/src/device-client.ts | 29 | export function createDeviceAccountClient(): DeviceAccountClient { | CODE |
| LOW | …/civitai-db-schema/src/schema-drift/remediation/sql.ts | 309 | export function createIndexConcurrentlySql(ctx: RelationSqlContext, indexName: string): string { | CODE |
| LOW | packages/civitai-axiom/src/client.ts | 110 | function getSharedIngestFailureCounts(): Map<string, number> { | CODE |
| LOW | packages/civitai-axiom/src/client.ts | 125 | function getSharedUnprovisionedReported(): Set<string> { | CODE |
| LOW | packages/civitai-axiom/src/client.ts | 255 | function reportUnprovisionedDatastream(datastream: string) { | CODE |
| LOW | packages/civitai-axiom/src/env.ts | 102 | export function buildProvisionedDatastreams(extra: readonly string[] = []): ReadonlySet<string> { | CODE |
| LOW | packages/civitai-mod-utils/src/prompt-audit/index.ts | 292 | function includesHarmfulCombinations(prompt: string): 'minor' | 'poi' | false { | CODE |
| LOW | packages/civitai-mod-utils/src/prompt-audit/index.ts | 413 | export function getPromptHighlightSegments( | CODE |
| LOW | packages/civitai-db/src/kysely.ts | 26 | function registerNumericTypeParsers() { | CODE |
| LOW | packages/civitai-db/src/kysely.ts | 56 | export async function registerEnumArrayTypeParsers(pool: Pool): Promise<void> { | CODE |
| LOW | packages/civitai-db/src/db-helpers.ts | 28 | export function createPgPoolAcquireHistogram( | CODE |
| LOW | packages/civitai-db/src/db-helpers.ts | 44 | function getDefaultPgPoolAcquireHistogram(): PgPoolAcquireHistogram { | CODE |
| LOW | packages/civitai-notifications/src/client.ts | 172 | export function createNotificationsClient(config: NotificationsClientConfig = {}) { | CODE |
| LOW | packages/civitai-redis/src/cache.ts | 136 | export function createSysRedisCacheBuilder(base: { | CODE |
| LOW | packages/civitai-redis/src/cluster-deadline-hits.ts | 82 | export function recordClusterCommandSettle( | CODE |
| LOW | packages/civitai-redis/src/client.ts | 291 | function triggerTopologyRediscovery(clusterClient: any, reason: string) { | CODE |
| LOW | packages/civitai-redis/src/client.ts | 453 | function clearClusterRefreshInterval(type: 'cache' | 'system'): void { | CODE |
| LOW | packages/civitai-redis/src/client.ts | 853 | export function attachSysSentinelListeners( | CODE |
| LOW | packages/civitai-redis/src/cluster-routing-retry.ts | 116 | export function isTransientClusterRoutingError(err: unknown): boolean { | CODE |
| LOW | …vitai-redis/src/__tests__/packed-codec-metrics.test.ts | 369 | function installThrowingBridgeHere() { | CODE |
| LOW | …itai-redis/src/__tests__/cluster-routing-retry.test.ts | 44 | function nodeClientConnectPromiseThrow(): TypeError { | CODE |
| LOW | packages/civitai-buzz/src/paid-access.ts | 252 | export function migrateTermsForUsageControl( | CODE |
| LOW | packages/civitai-buzz/src/pricing-allowance.ts | 113 | export function gateConversionExceedsAllowance({ | CODE |
| LOW | packages/civitai-buzz/src/model-version-pricing.ts | 38 | export function resolveModelVersionPricing({ | CODE |
| LOW | packages/civitai-buzz/src/rights-affirmation.ts | 54 | export function hasCurrentRightsAffirmation(meta: unknown, ownerId?: number): boolean { | CODE |
| LOW | packages/civitai-shared/src/rating-review.ts | 62 | export function ratingReviewModeratorLevels( | CODE |
| 1745 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| CRITICAL | src/tests/api/v1/developer/block-manifests.test.ts | 106 | const upsertArgs = mockDbWrite.appBlock.upsert.mock.calls.at(-1)?.[0] as { | CODE |
| CRITICAL | src/tests/api/v1/developer/block-manifests.test.ts | 125 | const upsertArgs = mockDbWrite.appBlock.upsert.mock.calls.at(-1)?.[0] as { | CODE |
| CRITICAL | src/tests/api/v1/developer/block-manifests.test.ts | 155 | const upsertArgs = mockDbWrite.appBlock.upsert.mock.calls.at(-1)?.[0] as { | CODE |
| CRITICAL | src/tests/api/v1/developer/block-manifests.test.ts | 185 | const upsertArgs = mockDbWrite.appBlock.upsert.mock.calls.at(-1)?.[0] as { | CODE |
| CRITICAL | src/tests/api/v1/developer/block-manifests.test.ts | 204 | const upsertArgs = mockDbWrite.appBlock.upsert.mock.calls.at(-1)?.[0] as { | CODE |
| CRITICAL | …/routers/__tests__/blocks.router.getNavSummary.test.ts | 471 | const statuses = mockDbRead.appCollaborator.findFirst.mock.calls.map( | CODE |
| CRITICAL | …rver/routers/__tests__/apps-mod-storage.router.test.ts | 1133 | const batches = mockDbWrite.appListingModerationEvent.create.mock.calls.map( | CODE |
| CRITICAL | …r/routers/__tests__/blocks.router.trainingKind.test.ts | 1469 | const runsExpire = redisMock.sysRedis.expire.mock.calls.find((c) => | CODE |
| CRITICAL | src/server/redis/__tests__/event-hat-caches.test.ts | 21 | redisMock.redis.packed.set.mock.calls.map(([key, value, options]) => [key, value, options]); | CODE |
| CRITICAL | …/rewards/__tests__/base.reward.duplicate-award.test.ts | 157 | redisMock.redis.eval.mock.calls.filter(([called]: any[]) => called === script); | CODE |
| CRITICAL | src/server/rewards/__tests__/remixAccept.reward.test.ts | 55 | const [, options] = redisMock.redis.eval.mock.calls.at(-1) as [unknown, { arguments: string[] }]; | CODE |
| CRITICAL | …ils/__tests__/app-moderator-message-rate-limit.test.ts | 56 | const keys = redisMock.redis.incrBy.mock.calls.map((c) => c[0] as string); | CODE |
| CRITICAL | …ils/__tests__/app-moderator-message-rate-limit.test.ts | 72 | const keys = redisMock.redis.incrBy.mock.calls.map((c) => c[0] as string); | CODE |
| CRITICAL | src/server/__tests__/event-decoration-equip.test.ts | 274 | expect(db.userCosmetic.updateMany.mock.calls.at(-1)![0].data).toEqual({ | CODE |
| CRITICAL | src/server/__tests__/event-decoration-equip.test.ts | 299 | expect(db.userCosmetic.updateMany.mock.calls.at(-1)![0].data).toMatchObject({ | CODE |
| CRITICAL | src/server/__tests__/event-decoration-equip.test.ts | 611 | db.userCosmetic.updateMany.mock.invocationCallOrder.at(-1)! | CODE |
| CRITICAL | src/server/__tests__/middleware.trpc.cacheit.test.ts | 146 | return redisFake.packed.get.mock.calls.at(-1)![0] as string; | CODE |
| CRITICAL | …/server/__tests__/fee-allowance-boost-endpoint.test.ts | 118 | const granted = redisMock.sysRedis.hSetNX.mock.calls.map((c) => [c[1], c[2]]).sort(); | CODE |
| CRITICAL | src/server/__tests__/game-frame-report.test.ts | 602 | const [fold, append] = db.report.update.mock.calls.map((c) => c[0].data); | CODE |
| CRITICAL | src/server/__tests__/pending-review-mute.test.ts | 358 | const dataArgs = dbWrite.user.update.mock.calls.map(([arg]) => arg.data); | CODE |
| CRITICAL | src/server/__tests__/pending-review-mute.test.ts | 620 | const dataArgs = dbWrite.user.update.mock.calls.map(([arg]) => arg.data); | CODE |
| CRITICAL | src/server/jobs/__tests__/text-scan-sweeps.test.ts | 50 | const lastCursor = () => dbMock.dbWrite.keyValue.upsert.mock.calls.at(-1)?.[0].update.value; | CODE |
| CRITICAL | src/server/jobs/__tests__/process-vault-items.test.ts | 229 | const lastUpdate = mockDbWrite.vaultItem.update.mock.calls.at(-1)?.[0]; | CODE |
| CRITICAL | src/server/jobs/__tests__/process-vault-items.test.ts | 302 | const storedWrite = mockDbWrite.vaultItem.update.mock.calls.at(-1)?.[0]; | CODE |
| CRITICAL | src/server/jobs/__tests__/process-vault-items.test.ts | 310 | const failWrite = mockDbWrite.vaultItem.update.mock.calls.at(-1)?.[0]; | CODE |
| CRITICAL | …ver/events/__tests__/event-engine.scored-event.test.ts | 290 | expect(redisMock.redis.set.mock.calls.map(([key]) => key)).toEqual([ | CODE |
| CRITICAL | …ver/events/__tests__/event-engine.scored-event.test.ts | 318 | const setKeys = () => redisMock.redis.set.mock.calls.map(([key]) => key); | CODE |
| CRITICAL | …c/server/events/points/__tests__/sync.behavior.test.ts | 552 | const acquired = redisMock.sysRedis.set.mock.calls.filter(([key]) => key === lock.lock); | CODE |
| CRITICAL | …rollers/__tests__/multi-image-post-owner-check.test.ts | 92 | dbMock.dbWrite.post.findUnique.mock.calls.filter( | CODE |
| CRITICAL | …/blocks/__tests__/offsite-listing.edit.service.test.ts | 274 | const updateCalls = mockWrite.appListing.update.mock.calls.map((c) => c[0]); | CODE |
| CRITICAL | …/blocks/__tests__/offsite-listing.edit.service.test.ts | 330 | const updateCalls = mockWrite.appListing.update.mock.calls.map((c) => c[0]); | CODE |
| CRITICAL | …/blocks/__tests__/offsite-listing.edit.service.test.ts | 1542 | const calls = mockWrite.appListing.update.mock.calls.map((c) => c[0]) as Array<{ | CODE |
| CRITICAL | …/blocks/__tests__/offsite-listing.edit.service.test.ts | 1566 | const calls = mockWrite.appListing.update.mock.calls.map((c) => c[0]) as Array<{ | CODE |
| CRITICAL | …/blocks/__tests__/offsite-listing.edit.service.test.ts | 1898 | const calls = mockWrite.appListing.update.mock.calls.map((c) => c[0]) as Array<{ | CODE |
| CRITICAL | …/blocks/__tests__/offsite-listing.edit.service.test.ts | 1964 | const calls = mockWrite.appListing.update.mock.calls.map((c) => c[0]) as Array<{ | CODE |
| CRITICAL | …/blocks/__tests__/offsite-listing.edit.service.test.ts | 2123 | const calls = mockWrite.appListing.update.mock.calls.map((c) => c[0]) as Array<{ | CODE |
| CRITICAL | …tests__/offsite-moderation.service.mod-actions.test.ts | 2039 | const call = mockWrite.appListing.updateMany.mock.calls.find( | CODE |
| CRITICAL | …tests__/offsite-moderation.service.mod-actions.test.ts | 2316 | const relistCall = mockWrite.appListing.updateMany.mock.calls.find( | CODE |
| CRITICAL | …ests__/offsite-listing.onsite-revision.service.test.ts | 267 | const derivedRead = mockWrite.image.findMany.mock.calls.find( | CODE |
| CRITICAL | …ests__/offsite-listing.onsite-revision.service.test.ts | 545 | const selects = mockRead.appListingPublishRequest.findMany.mock.calls.map( | CODE |
| CRITICAL | …ests__/offsite-listing.onsite-revision.service.test.ts | 596 | const selects = mockRead.appListingPublishRequest.findMany.mock.calls.map( | CODE |
| CRITICAL | …/__tests__/offsite-listing.source-repo.service.test.ts | 342 | const parentWrites = mockWrite.appListing.update.mock.calls.filter( | CODE |
| CRITICAL | …/__tests__/offsite-listing.source-repo.service.test.ts | 406 | const parentWrites = mockWrite.appListing.update.mock.calls.filter( | CODE |
| CRITICAL | …/__tests__/offsite-listing.source-repo.service.test.ts | 497 | const parentUpdate = mockWrite.appListing.update.mock.calls.find( | CODE |
| CRITICAL | …/__tests__/offsite-listing.source-repo.service.test.ts | 878 | const repoQueries = mockWrite.appListing.findUnique.mock.calls.filter((c) => | CODE |
| CRITICAL | …/__tests__/offsite-listing.source-repo.service.test.ts | 886 | const parentUpdate = mockWrite.appListing.update.mock.calls.find( | CODE |
| CRITICAL | …blocks/__tests__/publish-request.orchestration.test.ts | 557 | const call = mockDbWrite.appBlockPublishRequest.create.mock.calls.at(-1); | CODE |
| CRITICAL | …blocks/__tests__/publish-request.orchestration.test.ts | 1269 | mockDbRead.appBlockBuildAttempt.findMany.mock.calls.at(-1)?.[0].where.publishRequestId | CODE |
| CRITICAL | …blocks/__tests__/publish-request.orchestration.test.ts | 1567 | const buildingWrite = mockDbWrite.appBlockPublishRequest.updateMany.mock.calls.findIndex( | CODE |
| CRITICAL | …blocks/__tests__/publish-request.orchestration.test.ts | 1703 | const restoreFlip = mockDbWrite.appListing.updateMany.mock.calls.find( | CODE |
| CRITICAL | …blocks/__tests__/publish-request.orchestration.test.ts | 1711 | const unsuspend = mockDbWrite.appBlock.updateMany.mock.calls.find( | CODE |
| CRITICAL | …blocks/__tests__/publish-request.orchestration.test.ts | 1844 | mockDbWrite.appBlock.updateMany.mock.calls.find( | CODE |
| CRITICAL | …blocks/__tests__/publish-request.orchestration.test.ts | 2014 | const unsuspend = mockDbWrite.appBlock.updateMany.mock.calls.find( | CODE |
| CRITICAL | …blocks/__tests__/publish-request.orchestration.test.ts | 2097 | const reqUpdate = mockDbWrite.appBlockPublishRequest.update.mock.calls.find( | CODE |
| CRITICAL | …blocks/__tests__/publish-request.orchestration.test.ts | 2197 | const shaStamp = mockDbWrite.appBlock.update.mock.calls.find( | CODE |
| CRITICAL | …blocks/__tests__/publish-request.orchestration.test.ts | 2305 | const tierUpdate = mockDbWrite.appBlock.update.mock.calls.find( | CODE |
| CRITICAL | …blocks/__tests__/publish-request.orchestration.test.ts | 2330 | const tierUpdate = mockDbWrite.appBlock.update.mock.calls.find( | CODE |
| CRITICAL | …blocks/__tests__/publish-request.orchestration.test.ts | 2552 | const shaStamp = mockDbWrite.appBlock.update.mock.calls.find( | CODE |
| CRITICAL | …blocks/__tests__/publish-request.orchestration.test.ts | 2749 | const syncCalls = mockDbWrite.appListing.updateMany.mock.calls.filter( | CODE |
| CRITICAL | …ver/services/blocks/__tests__/showcase.service.test.ts | 40 | const last = mockDbRead.imageResourceNew.findMany.mock.results.at(-1); | CODE |
| 93 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | claudedocs/handoff-users-over-time-panel.md | 136 | is #1 — whether `orchestration.jobs` is `ORDER BY createdAt` first. The per-run | CODE |
| MEDIUM | …aude/skills/app-capture/tests/run-tests-app-capture.sh | 5994 | # guard plus its scaffolding. | COMMENT |
| MEDIUM | .claude/skills/app-capture/tests/mutants-app-capture.sh | 1687 | # mutation is the guard and not the guard plus its scaffolding. | COMMENT |
| MEDIUM | .claude/skills/app-capture/tests/mutants-app-capture.sh | 1807 | # mutation is the guard and not the guard plus its scaffolding. | COMMENT |
| MEDIUM | .claude/skills/add-generation-support/SKILL.md | 28 | ### 1. Check @civitai/orchestration-client for ecosystem-specific types | COMMENT |
| MEDIUM | .claude/skills/xguard-manager/SKILL.md | 50 | # See what the defaults look like (useful for scaffolding a new label) | COMMENT |
| MEDIUM | docs/auto-label-orchestrator-revamp.md | 24 | ## Existing scaffolding to reuse | COMMENT |
| MEDIUM | docs/event-bus-discovery.md | 378 | **Recommended middle path:** don't block it on a full platform (failure mode #1), but make it the **Phase-0 driving feat | CODE |
| MEDIUM | docs/monorepo-directory-snapshot.md | 209 | │ └── moderator/ # Next.js content-moderation app (scaffold): a spoke that verifies | CODE |
| MEDIUM | docs/prompt-analysis-audit-2026-08-05.md | 936 | ### `civitai-orchestration` | COMMENT |
| MEDIUM | docs/moderator-app-package-extraction-plan.md | 106 | ### Commit 2 — post-move changes (scaffolding + shims + import rewrites + member extractions) | COMMENT |
| MEDIUM | docs/moderator-app-package-extraction-plan.md | 211 | ### D. New package scaffolding (mirror `@civitai/db-schema`) | COMMENT |
| MEDIUM | docs/features/multi-image-upscale.md | 124 | ### 3. Backend: Multi-Step Fan-Out in `orchestration-new.service.ts` | COMMENT |
| MEDIUM | docs/features/prompt-snippets.md | 297 | ### Phase 1 — schema + tRPC scaffolding (backend only) | COMMENT |
| MEDIUM | apps/event-engine/docs/plans/initial.md | 211 | ### 2. Develop event listening microservice | COMMENT |
| MEDIUM | apps/event-engine/docs/plans/table-to-metrics.md | 168 | ### orchestration.jobs | COMMENT |
| MEDIUM | …or/src/routes/retool/user-lookup/TrainingsPanel.svelte | 292 | {#await orchestration} | CODE |
| MEDIUM | src/tests/api/v1/blocks/dev-token.test.ts | 745 | // The exact root-cause scenario: the page-money scaffold manifest declares | COMMENT |
| MEDIUM | src/tests/pages/payment/success.browser.test.tsx | 26 | // The scaffold mocks `next/router` with a shared router object (spy `replace`, | COMMENT |
| MEDIUM⚡ | …erver/routers/__tests__/blocks.router.workflow.test.ts | 7804 | // surface, and the requirement is that it is covered by the SAME guardrails as | COMMENT |
| MEDIUM⚡ | src/server/utils/app-block-ids.ts | 158 | // App Blocks — agentic mod code-review report (P0). Dark/additive. | COMMENT |
| MEDIUM | src/server/services/feature-flags.service.ts | 662 | // until the Flipt `app-blocks-agentic-review` flag is created. This mirrors the | COMMENT |
| MEDIUM⚡ | src/server/services/blocks/author-fee-charge.service.ts | 57 | // This file is that caller: it prices the fee before the spend guardrails run, | COMMENT |
| MEDIUM | src/server/services/blocks/app-review-report.service.ts | 5 | // App Blocks — agentic mod code-review report (P0 read/lookup layer). | COMMENT |
| MEDIUM | src/server/services/blocks/agent-review.service.ts | 673 | // mod-only `app-blocks-agentic-review` Flipt flag (absent → fail-closed → inert). | COMMENT |
| MEDIUM⚡ | …ervices/blocks/recipes/starter-comfy-txt2img.recipe.ts | 16 | // The DEMOABLE STARTER: the recipe the CLI scaffold's default `customComfy` sample | COMMENT |
| MEDIUM | src/server/services/blocks/recipes/index.ts | 189 | // Recipe #2 — the CLI scaffold's demoable starter: a minimal single-step Z-Image | COMMENT |
| MEDIUM | src/server/services/blocks/recipes/index.ts | 189 | // Recipe #2 — the CLI scaffold's demoable starter: a minimal single-step Z-Image | COMMENT |
| MEDIUM | …ervices/__tests__/delete-image-from-s3-logging.test.ts | 11 | // image.service is the graph root; the mock scaffold mirrors the established recipe | COMMENT |
| MEDIUM | …rvices/__tests__/image-cacher-invalidate-scope.test.ts | 16 | // image.service is the graph root; the mock scaffold mirrors the established recipe | COMMENT |
| MEDIUM | …ices/__tests__/update-post-image-hidemeta-bust.test.ts | 31 | // --- infra scaffold (mirrors contest-entry-resource-gate.test.ts) --------------------- | COMMENT |
| MEDIUM | …/services/__tests__/moderation-blob-retraction.test.ts | 26 | // image.service is the graph root; the mock scaffold mirrors the established recipe | COMMENT |
| MEDIUM | …rvices/__tests__/unblock-image-nsfwlevel-reset.test.ts | 18 | // image.service is the graph root; the mock scaffold mirrors the established | COMMENT |
| MEDIUM | …ices/__tests__/model-locked-properties.service.test.ts | 7 | // Mirrors the mock scaffold used in set-model-minor.service.test.ts. | COMMENT |
| MEDIUM | …ces/__tests__/bounty-locked-properties.service.test.ts | 8 | // service/db/queue dependencies are stubbed out below. Mirrors the mock scaffold used in | COMMENT |
| MEDIUM | …sts__/bust-public-model-response-cache.service.test.ts | 7 | // ingest) to unit-test in isolation without a brittle scaffold, so its bust | COMMENT |
| MEDIUM | …/services/__tests__/set-model-sfw-only.service.test.ts | 6 | // unit test rather than an integration test. Mirrors the mock scaffold used | COMMENT |
| MEDIUM | …__tests__/prisma-inconsistent-orphan-relations.test.ts | 23 | // Mirrors the scaffold in set-model-minor.service.test.ts. | COMMENT |
| MEDIUM | …es/__tests__/model-early-access-refund.service.test.ts | 7 | // an integration test. Mirrors the mock scaffold used in set-model-minor.service.test.ts. | COMMENT |
| MEDIUM | …ver/services/__tests__/set-model-minor.service.test.ts | 7 | // unit test rather than an integration test. Mirrors the mock scaffold used | COMMENT |
| MEDIUM | …services/__tests__/bust-caches-for-posts-empty.test.ts | 9 | // post.service is the graph root; the mock scaffold mirrors the established recipe | COMMENT |
| MEDIUM | …_tests__/model-licensing-source-on-type-change.test.ts | 3 | // model.service.ts has a very large import graph; scaffold mirrors | COMMENT |
| MEDIUM | …ion_v2/inputs/MetadataExtractionPanel.browser.test.tsx | 110 | // We do NOT mock Mantine (resolve.dedupe handles dual-React at the scaffold). | COMMENT |
| MEDIUM | …ion_v2/inputs/MetadataExtractionPanel.browser.test.tsx | 153 | // interaction away from a live `fetch` in a scaffold whose own header promises to stay | COMMENT |
| MEDIUM | …ion_v2/inputs/MetadataExtractionPanel.browser.test.tsx | 180 | // `missing CivitaiSessionContext` under this network-free scaffold, and | COMMENT |
| MEDIUM | …eration_v2/inputs/ResourceItemContent.browser.test.tsx | 20 | // scaffold providers (MantineProvider + QueryClient + next/router). To stand | COMMENT |
| MEDIUM | …eration_v2/inputs/ResourceItemContent.browser.test.tsx | 56 | // Mantine is NOT mocked (resolve.dedupe handles dual-React at the scaffold). | COMMENT |
| MEDIUM | …eration_v2/inputs/ResourceItemContent.browser.test.tsx | 121 | // when there is no <CivitaiSessionProvider>, which this network-free scaffold | COMMENT |
| MEDIUM | …eration_v2/inputs/ResourceSelectInput.browser.test.tsx | 79 | // We do NOT mock Mantine (resolve.dedupe handles dual-React at the scaffold). | COMMENT |
| MEDIUM | …ts/generation_v2/inputs/WorkflowInput.browser.test.tsx | 62 | // client needed. (The scaffold is network-free; mocking the hook is cheaper than | COMMENT |
| MEDIUM | …ts/generation_v2/inputs/WorkflowInput.browser.test.tsx | 98 | // We do NOT mock Mantine core (resolve.dedupe handles dual-React at the scaffold). | COMMENT |
| MEDIUM | …onents/generation_v2/inputs/SeedInput.browser.test.tsx | 10 | // props (no tRPC/router) — it anchors the scaffold while exercising Mantine | COMMENT |
| MEDIUM | …s/generation_v2/inputs/BaseModelInput.browser.test.tsx | 87 | // We do NOT mock Mantine core (resolve.dedupe handles dual-React at the scaffold). | COMMENT |
| MEDIUM | …nents/generation_v2/inputs/VideoInput.browser.test.tsx | 13 | // The component-setup scaffold deliberately does NOT wire a tRPC provider; a | COMMENT |
| MEDIUM | …nents/generation_v2/inputs/VideoInput.browser.test.tsx | 57 | // copy on a cold optimizeDeps cache. That's fixed at the scaffold level by | COMMENT |
| MEDIUM | …chTextEditor/__tests__/RenderRichText.browser.test.tsx | 11 | // which this scaffold provides. | COMMENT |
| MEDIUM | …ents/Announcements/AnnouncementsPanel.browser.test.tsx | 63 | // The byline's avatar reads three more providers this scaffold does not mount. | COMMENT |
| MEDIUM | …ents/Announcements/AnnouncementsPanel.browser.test.tsx | 86 | // query is disabled, the hook still runs), and this scaffold mounts no tRPC provider. | COMMENT |
| MEDIUM | …nts/Announcements/CreatorAnnouncement.browser.test.tsx | 53 | // query is disabled, the hook still runs), and this scaffold mounts no tRPC provider. | COMMENT |
| MEDIUM | …onents/Announcements/AnnouncementCard.browser.test.tsx | 17 | // `CustomMarkdown` reads both of these, and the scaffold mounts neither provider. | COMMENT |
| 47 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH⚡ | .claude/skills/app-capture/scripts/evidence.py | 164 | if (W.__APP_CAPTURE__ && W.__APP_CAPTURE__.installed) { | CODE |
| HIGH⚡ | .claude/skills/app-capture/scripts/evidence.py | 167 | P.installs = (P.installs || 1) + 1; | CODE |
| HIGH⚡ | .claude/skills/app-capture/scripts/evidence.py | 169 | installs:P.installs, drains:(P.drains || 0), | CODE |
| HIGH⚡ | .claude/skills/app-capture/scripts/evidence.py | 179 | S.console.push({level:level, text:String(text).slice(0, %(maxt)d)}); } | CODE |
| HIGH⚡ | .claude/skills/app-capture/scripts/evidence.py | 184 | S.network.push(rec); } | CODE |
| HIGH⚡ | .claude/skills/app-capture/scripts/evidence.py | 190 | if (typeof a === "string") { out.push(a); } | CODE |
| HIGH⚡ | .claude/skills/app-capture/scripts/evidence.py | 191 | else if (a && a.stack) { out.push(String(a.stack)); } | CODE |
| HIGH⚡ | .claude/skills/app-capture/scripts/evidence.py | 191 | else if (a && a.stack) { out.push(String(a.stack)); } | CODE |
| HIGH⚡ | .claude/skills/app-capture/scripts/evidence.py | 192 | else if (a && a.message) { out.push(String(a.message)); } | CODE |
| HIGH⚡ | .claude/skills/app-capture/scripts/evidence.py | 192 | else if (a && a.message) { out.push(String(a.message)); } | CODE |
| HIGH⚡ | .claude/skills/app-capture/scripts/evidence.py | 193 | else { out.push(JSON.stringify(a)); } } | CODE |
| HIGH⚡ | .claude/skills/app-capture/scripts/evidence.py | 194 | catch (e) { out.push(String(a)); } } | CODE |
| HIGH⚡ | .claude/skills/app-capture/scripts/evidence.py | 209 | if (ev && ev.target && ev.target !== W && ev.target.tagName) { | CODE |
| HIGH⚡ | .claude/skills/app-capture/scripts/evidence.py | 210 | pushN({url:String(ev.target.src || ev.target.href || ""), status:0, | CODE |
| HIGH⚡ | .claude/skills/app-capture/scripts/evidence.py | 213 | pushC("error", "uncaught: " + ((ev && ev.message) || "") + " @" + | CODE |
| HIGH⚡ | .claude/skills/app-capture/scripts/evidence.py | 214 | ((ev && ev.filename) || "") + ":" + ((ev && ev.lineno) || 0)); } } | CODE |
| HIGH⚡ | .claude/skills/app-capture/scripts/evidence.py | 217 | try { var r = ev && ev.reason; | CODE |
| HIGH⚡ | .claude/skills/app-capture/scripts/evidence.py | 218 | pushC("error", "unhandledrejection: " + ((r && r.message) || String(r))); } | CODE |
| HIGH | .claude/skills/app-capture/scripts/evidence.py | 231 | error:String((e && e.message) || e)}); throw e; }); }; | CODE |
| HIGH | .claude/skills/app-capture/scripts/evidence.py | 275 | S.drains = (S.drains || 0) + 1; | CODE |
| HIGH | .claude/skills/app-capture/scripts/attach-offsite.py | 214 | whose BODY is shaped exactly like a valid response ({"iconUrl": null, ...}), | STRING |
| HIGH⚡ | scripts/mutation/listing-problems-kind.mutation.py | 85 | "problems.push({ code: 'empty-tagline', label: text['empty-tagline'], severity: 'advisory' });", | CODE |
| HIGH⚡ | scripts/mutation/listing-problems-kind.mutation.py | 86 | "problems.push({ code: 'empty-tagline', label: text['empty-description'], severity: 'advisory' });", | CODE |
| HIGH⚡ | scripts/mutation/listing-problems-kind.mutation.py | 90 | " if (isEmpty(listing.category))\n problems.push({ code: 'empty-category', label: text['empty-category'], sever | CODE |
| HIGH⚡ | scripts/mutation/listing-problems-kind.mutation.py | 91 | " if (isEmpty(listing.category))\n problems.push({ code: 'empty-category', label: TEXT_PROBLEM.offsite['empty-c | CODE |
| HIGH⚡ | scripts/mutation/listing-problems-kind.mutation.py | 95 | " kind,\n iconId: r.iconId ?? null,", | CODE |
| HIGH⚡ | scripts/mutation/listing-problems-kind.mutation.py | 96 | " kind: 'offsite' as typeof kind,\n iconId: r.iconId ?? null,", | CODE |
| HIGH⚡ | scripts/mutation/listing-problems-kind.mutation.py | 100 | " kind,\n iconId: r.iconId ?? null,", | CODE |
| HIGH⚡ | scripts/mutation/listing-problems-kind.mutation.py | 101 | " kind: 'onsite' as typeof kind,\n iconId: r.iconId ?? null,", | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | …aude/skills/app-capture/tests/run-tests-app-capture.sh | 3 | # run-tests-app-capture.sh — gate harness for .claude/skills/app-capture. | COMMENT |
| MEDIUM⚡ | .claude/skills/app-capture/tests/mutants-app-capture.sh | 308 | # 🔴 A harness that COUNTS kills must be shown to classify a known-bad case as | COMMENT |
| MEDIUM⚡ | .claude/skills/app-capture/tests/mutants-app-capture.sh | 309 | # BROKEN, or its count is a fact about the harness rather than about the code. | COMMENT |
| MEDIUM⚡ | .claude/skills/app-capture/tests/mutants-app-capture.sh | 1737 | # the pristine suite (green) and by the BROKEN accounting the harness prints for | COMMENT |
| MEDIUM | .claude/skills/app-capture/tests/mutants-app-capture.sh | 365 | # the test harness pressing a key is the worst possible place for that bug. So the | COMMENT |
| MEDIUM | .claude/skills/app-capture/tests/mutants-app-capture.sh | 1349 | # unique target and the harness would score it BROKEN — and a mutant that mutates | COMMENT |
| MEDIUM | .claude/skills/app-capture/scripts/plan.py | 44 | # no `activate` at all — and the HOST-SIDE raise is withheld in this harness | COMMENT |
| MEDIUM | .github/workflows/lint.yml | 793 | # much larger change than this harness and belongs in its own PR, on measured | COMMENT |
| MEDIUM | .github/workflows/schema-drift.yml | 84 | # harness can observe an annotation under `-e`. | COMMENT |
| MEDIUM | apps/auth/src/lib/server/auth/session-shape.ts | 8 | // of the rest of the blob. PARITY NOTE: this is intentionally more robust than getSessionUser — for the (rare) | COMMENT |
| MEDIUM | apps/auth/src/lib/server/auth/verifier.ts | 6 | // no self-HTTP-fetch to its own JWKS endpoint — robust even if ORIGIN/the route is misconfigured. | COMMENT |
| MEDIUM | apps/auth/src/lib/server/auth/pending-authz.ts | 15 | // account. Switching back on .red then used the seamless device switch, which never touches the hub cookie, so | COMMENT |
| MEDIUM | apps/auth/src/lib/server/auth/device.ts | 26 | // "seamless switch-back" / re-auth window (a security/UX knob), not a capacity lever. | COMMENT |
| MEDIUM | apps/auth/src/lib/server/auth/__tests__/device.test.ts | 283 | // Backdate account 100 to just past the idle window (TTL + 1 day) — robust to the TTL value. | COMMENT |
| MEDIUM | …/lib/server/auth/__tests__/foreign-scope-login.test.ts | 5 | // .red went through the seamless device switch and never touched the hub cookie. That asymmetry is the bug | COMMENT |
| MEDIUM | apps/auth/src/routes/logout/+server.ts | 62 | // Clear the hub's `.civitai.com` session AND device cookies (the seamless-switch account set must not survive | COMMENT |
| MEDIUM | …/routers/__tests__/blocks.router.workflowScope.test.ts | 779 | // `.catch` to `.then(onOk, onErr)` made it robust. It did not: on the resolve path `err` is | COMMENT |
| MEDIUM | src/server/metrics/app-block-runtime.metrics.ts | 911 | // registry (never client input). Today that spans e.g. seamless-pano-360's engines | COMMENT |
| MEDIUM | src/server/metrics/__tests__/appListing.metrics.test.ts | 411 | // Normalize whitespace so the assertions are robust to formatting. | COMMENT |
| MEDIUM | src/server/clickhouse/tracker.ts | 104 | // The leverage differs sharply by column, which is why `duration` is the one to worry | COMMENT |
| MEDIUM | src/server/auth/__tests__/logout-cookies.test.ts | 3 | // Regression for finding M2: main-app logout must clear the device cookie (`civ-device`) that gates seamless | COMMENT |
| MEDIUM | src/server/jobs/purge-review-snapshots.ts | 139 | // idempotent re-delete. What this is NOT robust against is a future BULK write | COMMENT |
| MEDIUM | src/server/jobs/__tests__/process-vault-items.test.ts | 81 | // lease guard. Small helpers keep the assertions robust to ordering. | COMMENT |
| MEDIUM | src/server/games/daily-challenge/challenge-ladder.ts | 197 | // opening bout — the highest-leverage comparison of a binary search, and the only one every | COMMENT |
| MEDIUM | …mes/daily-challenge/__tests__/challenge-ladder.test.ts | 337 | // its OPENING bout — the one comparison every search makes, and the highest-leverage one. | COMMENT |
| MEDIUM | …services/blocks/__tests__/inline-comfy.service.test.ts | 370 | // These are copied verbatim from `recipes/seamless-pano.recipe.ts` — note | COMMENT |
| MEDIUM⚡ | …ervices/blocks/recipes/starter-comfy-txt2img.recipe.ts | 21 | // (seamless-pano-360, future ones) do things `kind:textToImage` cannot; this one | COMMENT |
| MEDIUM⚡ | …ervices/blocks/recipes/starter-comfy-txt2img.recipe.ts | 25 | // Z-Image diffusion/clip/vae AIRs seamless-pano reuses) — no `loras`, no | COMMENT |
| MEDIUM | …ervices/blocks/recipes/starter-comfy-txt2img.recipe.ts | 80 | // 90 matches the lowest per-engine ceiling already shipped by seamless-pano | COMMENT |
| MEDIUM⚡ | …ervices/blocks/recipes/starter-comfy-txt2img.recipe.ts | 96 | // (pinned policy). Mirrors seamless-pano's schema MINUS the engine axis. The | COMMENT |
| MEDIUM⚡ | …server/services/blocks/recipes/seamless-pano.recipe.ts | 7 | // seamless-pano-360 — recipe #1 for the App Blocks `customComfy` bridge. | COMMENT |
| MEDIUM⚡ | …server/services/blocks/recipes/seamless-pano.recipe.ts | 12 | // The iframe never sends a graph; it sends `{ recipe:'seamless-pano-360', params }` | COMMENT |
| MEDIUM | src/server/services/blocks/recipes/index.ts | 90 | // v1 (`seamless-pano-360`): the pinned 360Redmond LoRA versions (model 118025) are | COMMENT |
| MEDIUM | src/server/services/blocks/recipes/index.ts | 102 | // import time, before any request context). A robust router-side early-access / | COMMENT |
| MEDIUM | …/orchestrator/__tests__/submitWorkflow.timeout.test.ts | 160 | // Keep this case so the fix is robust to BOTH client behaviors (resolve AND throw). | COMMENT |
| MEDIUM⚡ | src/components/CivitaiWrapped/AccountProvider.tsx | 25 | needsLogin?: boolean; // aged out of the seamless-switch window → clicking re-authenticates at the hub | CODE |
| MEDIUM⚡ | src/components/CivitaiWrapped/AccountProvider.tsx | 34 | // RETIRED pre-cutover token-per-account store. Nothing redeems it any more — its seamless redeem went with | COMMENT |
| MEDIUM⚡ | src/components/CivitaiWrapped/AccountProvider.tsx | 36 | // three 30-day session lifetimes ago). Leaving it in the `seamless` test only made an entry LOOK switchable | COMMENT |
| MEDIUM | src/components/CivitaiWrapped/AccountProvider.tsx | 63 | // Switch by userId: seamless device switch if fresh in the hub set, else re-authenticate at the hub. | COMMENT |
| MEDIUM⚡ | src/components/CivitaiWrapped/AccountProvider.tsx | 254 | // 1. Fresh in the device set → seamless switch (the hub mints a fresh civ-token; the proxy sets it). | COMMENT |
| MEDIUM⚡ | src/components/CivitaiWrapped/AccountProvider.tsx | 260 | // 2. Not seamlessly switchable (aged out of the device set, or a legacy account whose seamless next-auth | COMMENT |
| MEDIUM⚡ | src/components/CivitaiWrapped/AccountProvider.tsx | 266 | // device set. Best-effort; we refetch the seamless set afterward. | COMMENT |
| MEDIUM | src/components/Sticker/StickerPlacementOverlay.tsx | 640 | // `w-max` is load-bearing, not tidying. Absolutely positioned | COMMENT |
| MEDIUM | …nts/Consent/ThirdPartyConsentProvider.browser.test.tsx | 38 | * ## Why the harness still passes a `region` PROP to the consent provider | COMMENT |
| MEDIUM | src/components/AppBlocks/iframeInitController.ts | 26 | // robust to BOTH the missed-load race AND posting before the block's message | COMMENT |
| MEDIUM | src/components/Apps/AppListingCard.browser.test.tsx | 1353 | // Absolutely filling the box — NOT a percentage height, which would have to | COMMENT |
| MEDIUM | src/components/Apps/AppListingCard.tsx | 219 | // Absolutely filling the ratio box, NOT `h="100%"`: a percentage | COMMENT |
| MEDIUM | src/components/AppLayout/AppHeader/UserMenu.tsx | 291 | // DURABLE: an entry stays listed after its seamless-switch window lapses, so removing is the only way | COMMENT |
| MEDIUM | src/components/AppLayout/AppHeader/UserMenu.tsx | 333 | // Aged out of the seamless-switch window — clicking re-authenticates at the hub. | COMMENT |
| MEDIUM | src/hooks/hidden-preferences/useHiddenPreferences.ts | 16 | // `.map(...)`. This makes THIS bundle (and any later one) robust to either | COMMENT |
| MEDIUM | src/pages/api/v1/blocks/submit-version.ts | 187 | // identity. Switching here to `user:${user.id}` would be the more robust limit; | COMMENT |
| MEDIUM | src/pages/api/auth/logout.ts | 20 | // gates seamless multi-account switching (HttpOnly, so the client can't clear it; on a shared machine the | COMMENT |
| MEDIUM | src/pages/api/auth/logout.ts | 51 | // (in particular the device cookie that gates seamless switching) are unit-testable without an HTTP round-trip. | COMMENT |
| MEDIUM | src/pages/api/auth/logout.ts | 66 | // it would let the seamless-switch account set survive logout on a shared machine. Clear BOTH prefixes. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | docs/workflow-metadata-refactor.md | 265 | // Step 1: named step | COMMENT |
| LOW | docs/workflow-metadata-refactor.md | 268 | // Step 2: references step 1's output | COMMENT |
| LOW | docs/adding-basemodel-ecosystem-guide.md | 144 | ### Step 1: Add Ecosystem ID Constant (if new ecosystem) | COMMENT |
| LOW | docs/adding-basemodel-ecosystem-guide.md | 161 | ### Step 2: Add Base Model ID Constant | COMMENT |
| LOW | docs/adding-basemodel-ecosystem-guide.md | 173 | ### Step 3: Add License (if new license) | COMMENT |
| LOW | docs/adding-basemodel-ecosystem-guide.md | 188 | ### Step 4: Add Ecosystem Family (if new family) | COMMENT |
| LOW | docs/adding-basemodel-ecosystem-guide.md | 200 | ### Step 5: Add Ecosystem Record | COMMENT |
| LOW | docs/adding-basemodel-ecosystem-guide.md | 217 | ### Step 6: Add Base Model Record | COMMENT |
| LOW | docs/adding-basemodel-ecosystem-guide.md | 235 | ### Step 7: Add Ecosystem Support | COMMENT |
| LOW | docs/adding-basemodel-ecosystem-guide.md | 299 | ### Step 8: Add Ecosystem Settings (if needed) | COMMENT |
| LOW | docs/adding-basemodel-ecosystem-guide.md | 330 | ### Step 9: Add Cross-Ecosystem Rules (if applicable) | COMMENT |
| LOW | docs/article-content-scanning.md | 684 | #### Step 1: Deploy Code (Feature Flag OFF) | COMMENT |
| LOW | docs/article-content-scanning.md | 695 | #### Step 2: Run Image Migration | COMMENT |
| LOW | docs/article-content-scanning.md | 722 | #### Step 3: Validate Migration | COMMENT |
| LOW | docs/article-content-scanning.md | 743 | #### Step 4: Enable Feature Flag | COMMENT |
| LOW | docs/article-content-scanning.md | 758 | #### Step 5: Monitor (First 24 Hours) | COMMENT |
| LOW | docs/auth/oauth-developer-docs.md | 32 | ### Step 1: Generate PKCE Values | COMMENT |
| LOW | docs/auth/oauth-developer-docs.md | 42 | ### Step 2: Redirect User to Authorization | COMMENT |
| LOW | docs/auth/oauth-developer-docs.md | 71 | ### Step 3: Exchange Code for Token | COMMENT |
| LOW | docs/auth/oauth-developer-docs.md | 97 | ### Step 4: Use the Access Token | COMMENT |
| LOW | docs/auth/oauth-developer-docs.md | 148 | ### Step 1: Request Device Code | COMMENT |
| LOW | docs/auth/oauth-developer-docs.md | 171 | ### Step 2: Display Code to User | COMMENT |
| LOW | docs/auth/oauth-developer-docs.md | 175 | ### Step 3: Poll for Token | COMMENT |
| LOW⚡ | scripts/oneoffs/reindex-missing-images.ts | 208 | // Step 1: Get all eligible images from database | COMMENT |
| LOW⚡ | scripts/oneoffs/reindex-missing-images.ts | 216 | // Step 2: Process in batches to avoid overwhelming DB and Meilisearch | COMMENT |
| LOW | scripts/oneoffs/reindex-missing-images.ts | 285 | // Step 3: Print summary | COMMENT |
| LOW | scripts/oneoffs/reindex-missing-images.ts | 301 | // Step 4: Queue for re-indexing | COMMENT |
| LOW⚡ | scripts/metric-migration/backfill-metrics.ts | 392 | // Step 1: Delete existing backfill data | COMMENT |
| LOW⚡ | scripts/metric-migration/backfill-metrics.ts | 395 | // Step 2: Get ID range (from args or query) | COMMENT |
| LOW | scripts/metric-migration/backfill-metrics.ts | 426 | // Step 3: Process in ID ranges | COMMENT |
| LOW | .vscode/rules/migrate-createStyles.md | 3 | ## Step 1: Convert Styles to SCSS | COMMENT |
| LOW | .vscode/rules/migrate-createStyles.md | 9 | ## Step 2: Integrate the SCSS File | COMMENT |
| LOW | …s/event-engine/scripts/setup-clickhouse-rollup-view.ts | 22 | // Step 1: Create backing table | COMMENT |
| LOW | …s/event-engine/scripts/setup-clickhouse-rollup-view.ts | 43 | // Step 2: Create Materialized View | COMMENT |
| LOW⚡ | …s/event-engine/scripts/setup-clickhouse-rollup-view.ts | 64 | // Step 3: Get time of mat view creation | COMMENT |
| LOW⚡ | …s/event-engine/scripts/setup-clickhouse-rollup-view.ts | 74 | // Step 4: Backfill week by week | COMMENT |
| LOW | …s/event-engine/scripts/setup-clickhouse-rollup-view.ts | 151 | // Step 5: Verify the data | COMMENT |
| LOW⚡ | apps/event-engine/src/common/feeds/images.feed.ts | 223 | // Step 2: Fetch metrics from ClickHouse via metric service | COMMENT |
| LOW⚡ | apps/event-engine/src/common/feeds/images.feed.ts | 226 | // Step 3: Fetch tags from cache | COMMENT |
| LOW⚡ | apps/event-engine/src/common/feeds/images.feed.ts | 229 | // Step 4: Fetch tools and techniques from PostgreSQL | COMMENT |
| LOW⚡ | apps/event-engine/src/common/feeds/images.feed.ts | 1043 | // Step 3: Extract IDs for data fetching | COMMENT |
| LOW⚡ | apps/event-engine/src/common/feeds/images.feed.ts | 1050 | // Step 4: Fetch user reactions (if authenticated) | COMMENT |
| LOW⚡ | apps/event-engine/src/common/feeds/images.feed.ts | 1057 | // Step 5: Fetch all required data in parallel | COMMENT |
| LOW⚡ | apps/event-engine/src/common/feeds/images.feed.ts | 1104 | // Step 5: Fetch tag data (only if tags or tagIds requested) | COMMENT |
| LOW⚡ | apps/event-engine/src/common/feeds/images.feed.ts | 1114 | // Step 6: Fetch cosmetic details for user cosmetics | COMMENT |
| LOW | apps/event-engine/src/common/feeds/images.feed.ts | 164 | // Step 1: Fetch base image data from PostgreSQL | COMMENT |
| LOW | apps/event-engine/src/common/feeds/images.feed.ts | 242 | // Step 5: Fetch model versions from PostgreSQL | COMMENT |
| LOW | apps/event-engine/src/common/feeds/images.feed.ts | 257 | // Step 6: Transform and combine all data | COMMENT |
| LOW | apps/event-engine/src/common/feeds/images.feed.ts | 924 | // Step 1: Apply post-filtering (matches getImagesFromSearchPostFilter logic) | COMMENT |
| LOW | apps/event-engine/src/common/feeds/images.feed.ts | 958 | // Step 2: Existence checking (feature-flagged) | COMMENT |
| LOW | apps/event-engine/src/common/feeds/images.feed.ts | 1126 | // Step 6: Transform to output format (matches getAllImagesIndex) | COMMENT |
| LOW | apps/event-engine/src/common/feeds/images.feed.ts | 1252 | // Step 7: Track seen images | COMMENT |
| LOW | apps/event-engine/src/common/services/metrics.ts | 61 | // Step 1: Lookup all IDs in Redis using Promise.all | COMMENT |
| LOW | apps/event-engine/src/common/services/metrics.ts | 89 | // Step 2: Process cache results | COMMENT |
| LOW | apps/event-engine/src/common/services/metrics.ts | 119 | // Step 3: Slide TTLs for hot cache entries | COMMENT |
| LOW | apps/event-engine/src/common/services/metrics.ts | 131 | // Step 4: Handle cache misses with lock mechanism to prevent stampedes | COMMENT |
| LOW | apps/event-engine/src/common/caches/base.ts | 63 | // Step 1: Lookup all IDs in Redis | COMMENT |
| LOW | apps/event-engine/src/common/caches/base.ts | 74 | // Step 2: Process cache results | COMMENT |
| LOW⚡ | apps/event-engine/src/common/caches/base.ts | 124 | // Step 3: Slide TTLs for hot cache entries | COMMENT |
| LOW⚡ | apps/event-engine/src/common/caches/base.ts | 133 | // Step 4: Handle stale entries with revalidation locks | COMMENT |
| 43 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | scripts/oneoffs/reindex-missing-images.ts | 208 | // Step 1: Get all eligible images from database | COMMENT |
| LOW⚡ | scripts/oneoffs/reindex-missing-images.ts | 216 | // Step 2: Process in batches to avoid overwhelming DB and Meilisearch | COMMENT |
| LOW | scripts/oneoffs/reindex-missing-images.ts | 285 | // Step 3: Print summary | COMMENT |
| LOW | scripts/oneoffs/reindex-missing-images.ts | 301 | // Step 4: Queue for re-indexing | COMMENT |
| LOW⚡ | scripts/metric-migration/backfill-metrics.ts | 392 | // Step 1: Delete existing backfill data | COMMENT |
| LOW⚡ | scripts/metric-migration/backfill-metrics.ts | 395 | // Step 2: Get ID range (from args or query) | COMMENT |
| LOW | scripts/metric-migration/backfill-metrics.ts | 426 | // Step 3: Process in ID ranges | COMMENT |
| LOW | …s/event-engine/scripts/setup-clickhouse-rollup-view.ts | 22 | // Step 1: Create backing table | COMMENT |
| LOW | …s/event-engine/scripts/setup-clickhouse-rollup-view.ts | 43 | // Step 2: Create Materialized View | COMMENT |
| LOW⚡ | …s/event-engine/scripts/setup-clickhouse-rollup-view.ts | 64 | // Step 3: Get time of mat view creation | COMMENT |
| LOW⚡ | …s/event-engine/scripts/setup-clickhouse-rollup-view.ts | 74 | // Step 4: Backfill week by week | COMMENT |
| LOW | …s/event-engine/scripts/setup-clickhouse-rollup-view.ts | 151 | // Step 5: Verify the data | COMMENT |
| LOW⚡ | apps/event-engine/src/common/feeds/images.feed.ts | 223 | // Step 2: Fetch metrics from ClickHouse via metric service | COMMENT |
| LOW⚡ | apps/event-engine/src/common/feeds/images.feed.ts | 226 | // Step 3: Fetch tags from cache | COMMENT |
| LOW⚡ | apps/event-engine/src/common/feeds/images.feed.ts | 229 | // Step 4: Fetch tools and techniques from PostgreSQL | COMMENT |
| LOW⚡ | apps/event-engine/src/common/feeds/images.feed.ts | 1043 | // Step 3: Extract IDs for data fetching | COMMENT |
| LOW⚡ | apps/event-engine/src/common/feeds/images.feed.ts | 1050 | // Step 4: Fetch user reactions (if authenticated) | COMMENT |
| LOW⚡ | apps/event-engine/src/common/feeds/images.feed.ts | 1057 | // Step 5: Fetch all required data in parallel | COMMENT |
| LOW⚡ | apps/event-engine/src/common/feeds/images.feed.ts | 1104 | // Step 5: Fetch tag data (only if tags or tagIds requested) | COMMENT |
| LOW⚡ | apps/event-engine/src/common/feeds/images.feed.ts | 1114 | // Step 6: Fetch cosmetic details for user cosmetics | COMMENT |
| LOW | apps/event-engine/src/common/feeds/images.feed.ts | 164 | // Step 1: Fetch base image data from PostgreSQL | COMMENT |
| LOW | apps/event-engine/src/common/feeds/images.feed.ts | 242 | // Step 5: Fetch model versions from PostgreSQL | COMMENT |
| LOW | apps/event-engine/src/common/feeds/images.feed.ts | 257 | // Step 6: Transform and combine all data | COMMENT |
| LOW | apps/event-engine/src/common/feeds/images.feed.ts | 924 | // Step 1: Apply post-filtering (matches getImagesFromSearchPostFilter logic) | COMMENT |
| LOW | apps/event-engine/src/common/feeds/images.feed.ts | 958 | // Step 2: Existence checking (feature-flagged) | COMMENT |
| LOW | apps/event-engine/src/common/feeds/images.feed.ts | 1126 | // Step 6: Transform to output format (matches getAllImagesIndex) | COMMENT |
| LOW | apps/event-engine/src/common/feeds/images.feed.ts | 1252 | // Step 7: Track seen images | COMMENT |
| LOW | apps/event-engine/src/common/services/metrics.ts | 61 | // Step 1: Lookup all IDs in Redis using Promise.all | COMMENT |
| LOW | apps/event-engine/src/common/services/metrics.ts | 89 | // Step 2: Process cache results | COMMENT |
| LOW | apps/event-engine/src/common/services/metrics.ts | 119 | // Step 3: Slide TTLs for hot cache entries | COMMENT |
| LOW | apps/event-engine/src/common/services/metrics.ts | 131 | // Step 4: Handle cache misses with lock mechanism to prevent stampedes | COMMENT |
| LOW | apps/event-engine/src/common/caches/base.ts | 63 | // Step 1: Lookup all IDs in Redis | COMMENT |
| LOW | apps/event-engine/src/common/caches/base.ts | 74 | // Step 2: Process cache results | COMMENT |
| LOW⚡ | apps/event-engine/src/common/caches/base.ts | 124 | // Step 3: Slide TTLs for hot cache entries | COMMENT |
| LOW⚡ | apps/event-engine/src/common/caches/base.ts | 133 | // Step 4: Handle stale entries with revalidation locks | COMMENT |
| LOW | apps/event-engine/src/common/caches/base.ts | 157 | // Step 5: Handle cache misses with lock mechanism to prevent stampedes | COMMENT |
| LOW | src/server/jobs/new-order-jobs.ts | 67 | // Step 1: Grant buzz for judgments from 3 days ago | COMMENT |
| LOW | src/server/jobs/new-order-jobs.ts | 139 | // Step 2: Reconcile stale blessedBuzz counters for inactive users | COMMENT |
| LOW⚡ | src/server/jobs/new-order-jobs.ts | 233 | // Step 1: Batch fetch all counters efficiently (checks cache first, then batched DB queries) | COMMENT |
| LOW⚡ | src/server/jobs/new-order-jobs.ts | 241 | // Step 2: Build player stats from the batch-fetched data | COMMENT |
| LOW | src/server/jobs/new-order-jobs.ts | 260 | // Step 3: Update Redis fervor counter for players whose fervor changed | COMMENT |
| LOW | src/server/jobs/new-order-jobs.ts | 281 | // Step 4: Bulk update PostgreSQL with exp and recalculated fervor | COMMENT |
| LOW | src/server/jobs/new-order-jobs.ts | 298 | // Step 5: Clear rated images cache for all players in this batch | COMMENT |
| LOW | src/server/jobs/remove-old-drafts.ts | 117 | // Step 1: Query replica (dbRead) for model IDs to delete | COMMENT |
| LOW | src/server/jobs/remove-old-drafts.ts | 186 | // Step 2: Delete in batches using dbWrite to minimize lock duration | COMMENT |
| LOW | src/server/jobs/push-discord-metadata.ts | 10 | // Step 1: Get userIds with recent images and their last image date from ClickHouse (fast) | COMMENT |
| LOW | src/server/jobs/push-discord-metadata.ts | 24 | // Step 2: Get userIds with recent model activity and their last upload date from Postgres (fast) | COMMENT |
| LOW⚡ | src/server/jobs/push-discord-metadata.ts | 36 | // Step 3: Combine unique userIds | COMMENT |
| LOW⚡ | src/server/jobs/push-discord-metadata.ts | 44 | // Step 4: Get Discord metadata for active users (uses partial index on Account) | COMMENT |
| LOW | src/server/jobs/push-discord-metadata.ts | 64 | // Step 5: Enrich with activity dates and push to Discord | COMMENT |
| LOW | src/server/services/bountyEntry.service.ts | 340 | // TODO: Once we support Tipping entries - we need to check if a tipConnection is created | COMMENT |
| LOW⚡ | …erver/services/orchestrator/__tests__/step-ref.test.ts | 238 | // Step 0: txt2img — outputs images | COMMENT |
| LOW⚡ | …erver/services/orchestrator/__tests__/step-ref.test.ts | 239 | // Step 1: hires-fix — takes image input from step 0, outputs images | COMMENT |
| LOW⚡ | …erver/services/orchestrator/__tests__/step-ref.test.ts | 240 | // Step 2: face-fix — takes image input from step 1, outputs images | COMMENT |
| LOW⚡ | …erver/services/orchestrator/__tests__/step-ref.test.ts | 280 | // Step 0: txt2img — outputs images | COMMENT |
| LOW⚡ | …erver/services/orchestrator/__tests__/step-ref.test.ts | 281 | // Step 1: img2vid — takes image input from step 0, outputs video | COMMENT |
| LOW⚡ | …erver/services/orchestrator/__tests__/step-ref.test.ts | 313 | // Step 0: text-to-image generation | COMMENT |
| LOW⚡ | …erver/services/orchestrator/__tests__/step-ref.test.ts | 320 | // Step 1: face-fix referencing step 0's output | COMMENT |
| LOW | …c/components/Subscriptions/PrepaidBuzzTransactions.tsx | 147 | // Step 1: Direct match via externalTransactionId suffix (redemption transactions) | COMMENT |
| LOW | …c/components/Subscriptions/PrepaidBuzzTransactions.tsx | 168 | // Step 2: FIFO + tier-aware assignment for job deliveries (:v3) | COMMENT |
| 19 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | .claude/agents/design-mockup.md | 114 | <img src="https://picsum.photos/seed/aiart[number]/400/500" alt="AI generated art"> | CODE |
| HIGH⚡ | …derator-app/retool-exports/raw/bulk-image-manager.json | 1 | {"uuid":"57fd8fb4-51ac-11ee-a0dd-9f0a271c8c9b","page":{"id":510420824,"data":{"appState":"[\"~#iR\",[\"^ \",\"n\",\"appT | CODE |
| HIGH⚡ | …derator-app/retool-exports/raw/bulk-image-manager.json | 1 | {"uuid":"57fd8fb4-51ac-11ee-a0dd-9f0a271c8c9b","page":{"id":510420824,"data":{"appState":"[\"~#iR\",[\"^ \",\"n\",\"appT | CODE |
| HIGH⚡ | docs/moderator-app/retool-exports/raw/user-reports.json | 1 | {"uuid":"a7fbd3e4-46ee-11ef-addd-8b299ca80778","page":{"id":510420693,"data":{"appState":"[\"~#iR\",[\"^ \",\"n\",\"appT | CODE |
| HIGH⚡ | docs/moderator-app/retool-exports/raw/user-reports.json | 1 | {"uuid":"a7fbd3e4-46ee-11ef-addd-8b299ca80778","page":{"id":510420693,"data":{"appState":"[\"~#iR\",[\"^ \",\"n\",\"appT | CODE |
| HIGH | docs/features/referral-program-review.md | 93 | - Single auto-generated code per user | CODE |
| HIGH | docs/features/referral-program-review.md | 240 | - [ ] Hit `/user/referrals` — dashboard renders with your auto-generated code | CODE |
| HIGH | docs/features/referral-program.md | 395 | 7. **@ai:** Should we allow users to generate multiple codes (current cap: 3) or collapse to a single code per user for | CODE |
| HIGH | docs/features/referral-program.md | 407 | 10. **@ai:** Custom codes admin UX: for v1, manual DB insert (or mod-actions script) is fine? Or do you want a simple ad | CODE |
| HIGH | src/static-content/art-and-ai.md | 24 | The above statement was written by ChatGPT, but is no less true because of it, just like how art generated by AI is no l | CODE |
| HIGH | src/static-content/au-region-block.md | 8 | This is due to Australia's [Age-Restricted Material Codes](https://www.esafety.gov.au/about-us/industry-regulation/socia | CODE |
| HIGH | src/server/jobs/scan-files.ts | 140 | // Mark batch as requested upfront so overlapping runs won't re-process | COMMENT |
| HIGH | src/server/services/article.service.ts | 1033 | // Mark scan as requested after successfully linking images | COMMENT |
| HIGH | …c/components/Post/EditV2/PostImageCards/AddedImage.tsx | 802 | We couldn’t confirm that this image was generated by AI. To resolve this, | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | .claude/agents/design-mockup.md | 109 | <img src="https://picsum.photos/seed/[unique-seed]/400/500" alt="placeholder"> | CODE |
| LOW | .claude/skills/freshdesk/SKILL.md | 121 | node .claude/skills/freshdesk/query.mjs search "email:'user@example.com'" | CODE |
| LOW | .claude/skills/freshdesk/SKILL.md | 274 | | `"email:'user@example.com'"` | By requester email | | CODE |
| LOW | .claude/skills/freshdesk/SKILL.md | 435 | SELECT id, username, email, "bannedAt", "muted", "createdAt" FROM "User" WHERE email = 'user@example.com'; | CODE |
| LOW | …aude/skills/app-capture/tests/run-tests-app-capture.sh | 4570 | ph = [i["placeholder"] for i in got["missing"]["inputs"] | CODE |
| LOW⚡ | .claude/skills/app-capture/tests/mutants-app-capture.sh | 741 | 's/ has = has or bool((n.get("title") or "").strip())/ has = has or bool((n.get("placeholder") o | CODE |
| LOW | .claude/skills/app-capture/scripts/evidence.py | 568 | if (n.get("placeholder") or "").strip(): | CODE |
| LOW | .claude/skills/app-capture/scripts/evidence.py | 727 | "placeholder": (n.get("placeholder") or "").strip()[:80]}) | CODE |
| LOW | .claude/skills/app-capture/scripts/evidence.py | 1401 | (" placeholder=%r" % i["placeholder"]) if i["placeholder"] else "") | CODE |
| LOW | .claude/skills/clickup/reference.md | 120 | - **Partial name**: `@[jane]` → fuzzy matches "Jane Doe" | CODE |
| LOW | .claude/skills/clickup/SKILL.md | 451 | **Bracket syntax**: Fuzzy matches partial names, emails, or numeric IDs. `@[jane]` matches "Jane Doe". Unknown users thr | CODE |
| LOW | .claude/skills/stripe/SKILL.md | 25 | node "$SKILL_DIR/query.mjs" search "email:'user@example.com'" | CODE |
| LOW | docs/features/account-switching.md | 157 | email: "user@example.com", | CODE |
| LOW | scripts/__tests__/decision-eval-support-topic.test.ts | 49 | requesterEmail: 'pat.doe@example.org', | CODE |
| LOW | scripts/__tests__/decision-eval-support-topic.test.ts | 95 | expect(all).not.toContain('555-0134'); | CODE |
| LOW | scripts/__tests__/decision-eval-support-topic.test.ts | 502 | requester_email: 'someone@example.org', | CODE |
| LOW | scripts/__tests__/decision-eval-support-topic.test.ts | 544 | requester_email: 'pat.doe@example.org', | CODE |
| LOW | scripts/__tests__/decision-eval-support-topic.test.ts | 1089 | requesterEmail: 'link@example.org', | CODE |
| LOW | packages/civitai-db-schema/prisma/seed.ts | 33 | 'Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna a | CODE |
| LOW | packages/civitai-db-schema/prisma/seed.ts | 33 | 'Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna a | CODE |
| LOW | …/server/__tests__/training-workflow-moderation.test.ts | 665 | return new Response('placeholder', { headers: { 'content-type': 'image/png' } }); | CODE |
| LOW | apps/moderator/src/lib/components/ImageQueueGrid.svelte | 107 | <div class="placeholder">{empty}</div> | CODE |
| LOW | apps/moderator/src/routes/page-visits/+page.svelte | 20 | <div class="placeholder">No page visits recorded yet.</div> | CODE |
| LOW | …ps/moderator/src/routes/page-visits/route/+page.svelte | 23 | <div class="placeholder">No visits to this route in the window.</div> | CODE |
| LOW | apps/moderator/src/routes/comics-review/+page.svelte | 91 | <div class="placeholder">No comic panels awaiting review.</div> | CODE |
| LOW | …moderator/src/routes/articles/unpublished/+page.svelte | 96 | <div class="placeholder">No unpublished articles match this view.</div> | CODE |
| LOW | apps/moderator/src/routes/ratings/+page.svelte | 129 | <div class="placeholder">No reviews in this bucket.</div> | CODE |
| LOW | apps/moderator/src/routes/cosmetics/grant/+page.svelte | 234 | <div class="placeholder">No cosmetics match this view.</div> | CODE |
| LOW | …tor/src/routes/audit/scanner-audit/[mode]/+page.svelte | 174 | <div class="placeholder">No {data.view} decisions match the current filters in the last 30 days.</div> | CODE |
| LOW | apps/moderator/src/routes/users/+page.svelte | 6 | <div class="placeholder">Not built yet.</div> | CODE |
| LOW | …ps/creator-studio/src/routes/(app)/models/+page.svelte | 795 | <div class="placeholder"> | CODE |
| LOW | …/creator-studio/src/routes/(app)/earnings/+page.svelte | 269 | <div class="placeholder">Earnings are temporarily unavailable — please try again shortly.</div> | CODE |
| LOW | …creator-studio/src/routes/(app)/analytics/+page.svelte | 208 | <div class="placeholder">Analytics are temporarily unavailable — please try again shortly.</div> | CODE |
| LOW | …creator-studio/src/routes/(app)/analytics/+page.svelte | 210 | <div class="placeholder"> | CODE |
| LOW | …studio/src/routes/(app)/analytics/content/+page.svelte | 204 | <div class="placeholder"> | CODE |
| LOW | …studio/src/routes/(app)/analytics/content/+page.svelte | 208 | <div class="placeholder"> | CODE |
| LOW | …io/src/routes/(app)/analytics/base-models/+page.svelte | 340 | <div class="placeholder"> | CODE |
| LOW | …-studio/src/routes/(app)/analytics/models/+page.svelte | 467 | <div class="placeholder"> | CODE |
| LOW | …c/routes/(app)/analytics/models/[modelId]/+page.svelte | 321 | <div class="placeholder">This model has no versions.</div> | CODE |
| LOW | …studio/src/routes/(app)/analytics/storage/+page.svelte | 176 | <div class="placeholder">Storage usage isn't available yet. Please check back soon.</div> | CODE |
| LOW | …studio/src/routes/(app)/analytics/storage/+page.svelte | 178 | <div class="placeholder">Storage is temporarily unavailable. Please try again shortly.</div> | CODE |
| LOW | …dio/src/routes/(app)/analytics/engagement/+page.svelte | 46 | <div class="placeholder">Engagement is temporarily unavailable — please try again shortly.</div> | CODE |
| LOW | …tudio/src/routes/(app)/analytics/audience/+page.svelte | 102 | <div class="placeholder"> | CODE |
| LOW | …s/creator-studio/src/routes/(admin)/admin/+page.svelte | 100 | <p class="placeholder">Channel totals are unavailable right now.</p> | CODE |
| LOW | …routes/(admin)/admin/monetization/AdoptionTable.svelte | 30 | <p class="placeholder">Settings counts are unavailable right now.</p> | CODE |
| LOW | …es/(admin)/admin/monetization/ChannelMoneyTable.svelte | 52 | <p class="placeholder">Channel totals are unavailable right now.</p> | CODE |
| LOW | …/routes/(admin)/admin/monetization/ChannelTrend.svelte | 123 | <p class="placeholder">The chart is unavailable right now.</p> | CODE |
| LOW | …/routes/(admin)/admin/monetization/ChannelTrend.svelte | 125 | <p class="placeholder">No creator payouts in this month.</p> | CODE |
| LOW | src/server/utils/__tests__/minor-flag-meta.test.ts | 254 | poi: { at: 'x', workflowId: 'wf-1', reason: 'Names a real actor.', names: ['Jane Doe'] }, | CODE |
| LOW | src/server/common/constants.ts | 21 | Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliq | CODE |
| LOW | src/server/common/constants.ts | 21 | Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliq | CODE |
| LOW | …server/controllers/__tests__/bounty-read-paths.test.ts | 298 | meta: { textScanFlags: { poi: { reason: 'r', names: ['Jane Doe'] } } }, | CODE |
| LOW | …server/controllers/__tests__/bounty-read-paths.test.ts | 325 | meta: { textScanFlags: { poi: { reason: 'r', names: ['Jane Doe'] } } }, | CODE |
| LOW | src/server/email/templates/trainingFail.email.ts | 99 | email: 'test@test.com', | CODE |
| LOW | src/server/email/templates/strikeIssued.email.ts | 188 | to: 'test@test.com', | CODE |
| LOW | …server/email/templates/stuckCryptoDepositUser.email.ts | 88 | userEmail: 'user@example.com', | CODE |
| LOW | src/server/email/templates/trainingComplete.email.ts | 97 | email: 'test@test.com', | CODE |
| LOW | …r/email/templates/moderation/moderationAction.email.ts | 175 | to: 'test@test.com', | CODE |
| LOW | …il/templates/moderation/moderationAction.email.test.ts | 62 | to: 'user@example.com', | CODE |
| LOW | …il/templates/moderation/moderationAction.email.test.ts | 152 | to: 'user@example.com', | CODE |
| 10 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | .claude/skills/app-capture/scripts/plan.py | 300 | CODE | |
| LOW | .claude/skills/app-capture/scripts/plan.py | 1022 | CODE | |
| LOW | .claude/skills/app-capture/scripts/frame.py | 253 | CODE | |
| LOW | .claude/skills/app-capture/scripts/frame.py | 319 | CODE | |
| LOW | .claude/skills/app-capture/scripts/frame.py | 1493 | CODE | |
| LOW | .claude/skills/app-capture/scripts/evidence.py | 522 | CODE | |
| LOW | .claude/skills/app-capture/scripts/evidence.py | 709 | CODE | |
| LOW | .claude/skills/app-capture/scripts/evidence.py | 1328 | CODE | |
| LOW | .claude/skills/listing-media/scripts/author-marks.py | 41 | CODE | |
| LOW | scripts/mutation/listing-problems-kind.mutation.py | 152 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | apps/event-engine/README.md | 295 | MEILISEARCH_API_KEY=your-api-key | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | .claude/skills/app-capture/scripts/plan.py | 119 | # Usage: | COMMENT |
| LOW | .claude/skills/app-capture/scripts/evidence.py | 89 | # Usage: | COMMENT |
| LOW | .claude/skills/deploy-status/deploy-chain.sh | 17 | # Usage: | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | .claude/skills/app-capture/scripts/capture.sh | 185 | except Exception: return {} | CODE |
| LOW | .claude/skills/app-capture/scripts/capture.sh | 470 | except Exception: d={} | CODE |
| LOW | .claude/skills/app-capture/scripts/capture.sh | 581 | except Exception: d={} | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | scripts/nix/check-prisma-pin.py | 30 | CODE | |
| LOW | scripts/nix/check-node-pin.py | 35 | CODE | |
| LOW | scripts/mutation/listing-problems-kind.mutation.py | 29 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | src/components/Search/parsers/base.ts | 36 | // TODO: implement Model3D search parser | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | src/store/post-image-transmitter.store.ts | 87 | async function getData(url: string, options?: { allowExternalUrl?: boolean }) { | CODE |