A repository of models, textual inversions, and more
This report presents the forensic synthetic code analysis of civitai/civitai, a TypeScript project with 7,240 GitHub stars. SynthScan v2.0 examined 1,728,623 lines of code across 8448 source files, recording 4597 pattern matches distributed across 17 syntactic categories. The overall adjusted score of 4.1 places this repository in the Likely human-written band.
The scanner applied 160+ deterministic lexical heuristics, multi-line block detectors, abstract syntax tree depth profilers, and a cross-file Jaccard similarity matrix to construct a statistically normalised synthetic code estimate. All matches are individually weighted by severity coefficient and contextual multiplier before summation, and the resulting headline score is temporally discounted to account for the repository's development history relative to the commercial emergence of large language model coding tooling (November 2022 onward).
This chart maps the temporal evolution of the adjusted synthetic code score across successive scan runs. An upward trajectory indicates ongoing incorporation of AI-generated code or expanding LLM-assisted scaffolding; a stable or declining trajectory may reflect active human refactoring, code removal, or the adoption of stricter authorship policies. The dashed secondary line (right axis) independently tracks total raw pattern hit count, which can diverge from the normalised score when codebase size changes significantly between scans.
Classifies detected patterns by their diagnostic confidence and structural impact. CRITICAL patterns (coefficient 10) represent definitive synthetic signatures — hallucinated imports, explicit LLM attribution metadata — virtually never produced by human authors. HIGH (5) indicates strong structural tells such as cross-file repetition or cross-linguistic idioms. MEDIUM (2) covers recognisable conversational padding and AI-specific vocabulary. LOW (1) captures subtle indicators like tautological comments and generic boilerplate that require density to carry independent signal.
This horizontal bar chart decomposes the repository's raw synthetic code score by top-level directory, allowing you to pinpoint precisely which modules or components carry the highest AI authorship density. Directories with disproportionately high scores relative to their size warrant targeted manual review: concentrated AI signatures often trace back to mass-generated configuration layers, auto-ported test suites, LLM-scaffolded boilerplate classes, or entire subsystems authored under heavy copilot assistance. Use this view to prioritise your human code-review effort.
The scanner identified 4597 distinct pattern matches across 17 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a statistically significant AI authorship indicator. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the diagnostic confidence level (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — comment-context matches receive a ×1.5 weight because LLMs systematically over-annotate. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier as dense clusters constitute far stronger evidence of synthetic authorship than isolated hits.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | playwright.preview.config.ts | 21 | testDir: './tests', | COMMENT |
| LOW | eslint-local-rules.js | 921 | COMMENT | |
| LOW | tsconfig.tests.json | 1 | { | COMMENT |
| LOW | tsconfig.scripts.json | 1 | { | COMMENT |
| LOW | .eslintrc.js | 21 | // "plugin:import/typescript", | COMMENT |
| LOW | .eslintrc.js | 41 | // callback (blows the txn timeout budget). See eslint-local-rules.js. | COMMENT |
| LOW | .eslintrc.js | 61 | // The severity has to be read against .github/workflows/lint.yml, which | COMMENT |
| LOW | .eslintrc.js | 81 | // before it merges" is both cheap and correct. | COMMENT |
| LOW | .eslintrc.js | 101 | // factory that listed only `RoutedDialogLink`; the carousel suite died at | COMMENT |
| LOW | .eslintrc.js | 121 | // factory is a landmine rather than a complete stand-in; | COMMENT |
| LOW | .eslintrc.js | 141 | // ~/shared/data-graph/generation/config/workflows 27 32 1 | COMMENT |
| LOW | .eslintrc.js | 201 | // on `main` for every open PR (#3505 / #3506). | COMMENT |
| LOW | .eslintrc.js | 221 | // third cache-helpers factory with this hazard. It is REPORTED, not silenced | COMMENT |
| LOW | .eslintrc.js | 241 | // in scope today (nowpayments.service.ts). Counts and the reasoning are in | COMMENT |
| LOW | .eslintrc.js | 261 | // 'error', matching no-wholesale-module-mock / no-module-scope-cache and | COMMENT |
| LOW | .eslintrc.js | 281 | // broken images today, across 6 files. The rule reports 16 sites in 5 | COMMENT |
| LOW | tsconfig.json | 81 | "./node_modules/*", | COMMENT |
| LOW | tsconfig.json | 101 | // files there carry them, and ALL 15 were added within one month. Including | COMMENT |
| LOW | playwright.config.ts | 61 | // name: 'Mobile Chrome', | COMMENT |
| LOW | docker-compose.base.yml | 121 | COMMENT | |
| LOW | test/component-setup.tsx | 161 | // insecure context with no clipboard permission, so the REAL `writeText` | COMMENT |
| LOW | test/component-setup.tsx | 181 | // `await act(async () => root.unmount())` and only THEN | COMMENT |
| LOW | tests/preview-moderation.spec.ts | 181 | // If the CSRF/origin gate (createContext.ts) rejects this direct tRPC POST with | COMMENT |
| LOW | tests/preview-moderation.spec.ts | 201 | // | COMMENT |
| LOW | tests/preview-buzz.spec.ts | 81 | // "Memberships | Civitai"> regardless of branch (green plans vs. yellow | COMMENT |
| LOW | tests/preview-remix.spec.ts | 41 | COMMENT | |
| LOW | tests/preview-og.spec.ts | 61 | // be one of `images.qualities` (default `[75]`), and a query string on a LOCAL | COMMENT |
| LOW | tests/preview-membership.spec.ts | 41 | // land on the membership page itself (getServerSideProps only redirects | COMMENT |
| LOW | tests/preview-generation.spec.ts | 121 | // retries fire within seconds — too fast to outlast a load spike. Retry the whole | COMMENT |
| LOW | tests/preview-generation.spec.ts | 161 | expect(resp?.status(), 'HTTP status for /generate').toBeLessThan(400); | COMMENT |
| LOW | tests/preview-auth.setup.ts | 101 | // capped at 60s) so one route compiles at a time (parallel heavy renders OOM the | COMMENT |
| LOW | tests/preview-auth.setup.ts | 141 | } | COMMENT |
| LOW | tests/preview-apps-marketplace.spec.ts | 101 | // The marketplace index renders for an appBlocks-enabled viewer (the mod) and | COMMENT |
| LOW | tests/preview-apps-marketplace.spec.ts | 161 | Array.isArray(detail!.manifest.targets ?? []), | COMMENT |
| LOW | tests/preview-apps-page.spec.ts | 121 | // the e2e proof the page-mint path works (two-flag gate cleared, synthetic | COMMENT |
| LOW | .claude/skills/deploy-status/deploy-chain.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | docs/adding-basemodel-ecosystem-guide.md | 741 | ``` | COMMENT |
| LOW | docs/features/prompt-snippets-schema.md | 101 | COMMENT | |
| LOW | docs/features/prompt-snippets.md | 201 | async function expandSnippetsToTargets(input: { | COMMENT |
| LOW | scripts/nix/dev-up.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | scripts/nix/test-pins.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | scripts/test-perf/trace-setup.ts | 81 | } catch (err) { | COMMENT |
| LOW | scripts/test-perf/__tests__/trace-flush.test.ts | 221 | // The interval backstop exists so a long run still leaves a snapshot; every out-of-range value | COMMENT |
| LOW | scripts/oneoffs/drain-cosmetic-phash-lane.ts | 101 | ); | COMMENT |
| LOW | scripts/mutation/listing-problems-kind.suite.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | scripts/__tests__/check-server-graph-singletons.test.ts | 121 | expect(entry.globalKey).toBeTruthy(); | COMMENT |
| LOW | scripts/__tests__/typecheck-tests-gate.test.ts | 1341 | [plain('src\\a\\__tests__\\x.test.ts'), plain('src/a/__tests__/x.test.ts')].join('\n') | COMMENT |
| LOW | scripts/__tests__/dev-server-port-reservation.test.ts | 41 | COMMENT | |
| LOW | scripts/__tests__/main-branch-ci-coverage.test.ts | 1 | import { readFileSync, readdirSync } from 'node:fs'; | COMMENT |
| LOW | packages/civitai-telemetry/src/client.ts | 21 | // globalThis (the real V8 global, shared across all webpack bundles in one Node process — the same | COMMENT |
| LOW | packages/civitai-telemetry/src/client.ts | 221 | // resolver, labeled by procedure path. Used to rank heavy-pool isolation | COMMENT |
| LOW | packages/civitai-telemetry/src/otel-logs.ts | 21 | type LogRecordProcessor, | COMMENT |
| LOW | packages/civitai-telemetry/src/otel-logs.ts | 41 | // lands in a registry nothing scrapes: it is registered, it increments, and it is absent | COMMENT |
| LOW | packages/civitai-telemetry/src/otel-logs.ts | 81 | registers: [instrumentationRegistry], | COMMENT |
| LOW | packages/civitai-telemetry/src/otel-logs.ts | 121 | } | COMMENT |
| LOW | packages/civitai-storage/src/schema.ts | 1 | import * as z from 'zod'; | COMMENT |
| LOW | packages/civitai-storage/src/errors.ts | 1 | // Pure classification of an S3/AWS-SDK error thrown while finalizing (complete) or aborting a | COMMENT |
| LOW | packages/civitai-storage/src/upload.ts | 1 | // Browser-safe upload execution. Consumes a presign response (from the server-only createStorageClient, | COMMENT |
| LOW | packages/civitai-auth/src/sign.ts | 1 | // HUB sign side (Path C). The hub is the ONLY minter. ES256-signed JWS, so spokes verify with | COMMENT |
| LOW | packages/civitai-auth/src/constants.ts | 1 | // Shared auth-contract constants — single source of truth so the hub, the main app, and every | COMMENT |
| 2171 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | docs/features/prompt-snippets-nested-resolution.md | 166 | ┌─ expandValue(#hero, sourceSetId=MyFantasyPack, depth=1) ──────────────┐ | CODE |
| MEDIUM | docs/features/prompt-snippets-nested-resolution.md | 176 | ┌─ expandValue(#weapon, sourceSetId=MyFantasyPack, depth=2) ────────────┐ | CODE |
| MEDIUM | docs/features/prompt-snippets-nested-resolution.md | 191 | ┌─ expandValue(#location, sourceSetId=MyFantasyPack, depth=1) ──────────┐ | CODE |
| MEDIUM | scripts/seed-comics.ts | 82 | // ── Comic 1: SFW (PG) ──────────────────────────────────────────────── | COMMENT |
| MEDIUM | scripts/seed-comics.ts | 186 | // ── Comic 2: PG-13 (mild content) ──────────────────────────────────── | COMMENT |
| MEDIUM | scripts/seed-comics.ts | 264 | // ── Comic 3: R-rated (violence, noir themes) ───────────────────────── | COMMENT |
| MEDIUM | packages/civitai-redis/src/cluster-selfheal.ts | 204 | // ── TRIGGER 1: DEADLINE-HIT RATE (sawtooth-immune — the real-wave signal) ────────── | COMMENT |
| MEDIUM | packages/civitai-redis/src/cluster-selfheal.ts | 216 | // ── TRIGGER 2: SUSTAINED INFLIGHT (legacy continuous-breach path) ────────────────── | COMMENT |
| MEDIUM | packages/civitai-redis/src/cluster-selfheal.ts | 235 | // ── TRIGGER ────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/civitai-redis/src/env.ts | 42 | // ── CLUSTER SELF-HEAL WATCHDOG (FIX #1/#2/#3) ────────────────────────────────────── | COMMENT |
| MEDIUM | packages/civitai-redis/src/env.ts | 42 | // ── CLUSTER SELF-HEAL WATCHDOG (FIX #1/#2/#3) ────────────────────────────────────── | COMMENT |
| MEDIUM | packages/civitai-redis/src/env.ts | 82 | // ── SYS (SENTINEL) SELF-HEAL WATCHDOG ────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/civitai-redis/src/env.ts | 113 | // ── CLUSTER ROUTING RETRY-AFTER-REDISCOVER (the topology-churn 500 wave) ──────────── | COMMENT |
| MEDIUM | …s/civitai-redis/src/__tests__/cluster-selfheal.test.ts | 236 | // ── DEADLINE-HIT TRIGGER (the fix for the real-wave non-firing bug) ──────────────── | COMMENT |
| MEDIUM | …s/civitai-redis/src/__tests__/cluster-selfheal.test.ts | 360 | // ── PER-POD RECONNECT JITTER (fleet-stampede brake) ──────────────────────────────── | COMMENT |
| MEDIUM | .github/workflows/lint.yml | 51 | # ── ALSO RUNS ON PUSH TO `main`, and that is not decoration ────────────────── | COMMENT |
| MEDIUM | .github/workflows/lint.yml | 387 | # ── REPORT-ONLY ON PULL REQUESTS, REAL VERDICT ON `main` ──────────────────── | COMMENT |
| MEDIUM | .github/workflows/lint.yml | 406 | # ── SHARDED ACROSS 4 RUNNERS ──────────────────────────────────────────── | COMMENT |
| MEDIUM | .github/workflows/lint.yml | 415 | # ------------------------- | COMMENT |
| MEDIUM | .github/workflows/lint.yml | 474 | # ── VITE PRE-BUNDLE CACHE ─────────────────────────────────────────── | COMMENT |
| MEDIUM | .github/workflows/lint.yml | 744 | # ── App typechecks ────────────────────────────────────────────────── | COMMENT |
| MEDIUM | .github/workflows/windows-dev-env.yml | 41 | # ── ALSO RUNS ON PUSH TO `main`, AND THAT IS A CACHE FIX ───────────────────── | COMMENT |
| MEDIUM | apps/auth/src/lib/server/oauth/http.ts | 62 | // ─── CORS ───────────────────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | apps/auth/src/lib/server/oauth/model.ts | 46 | // ─── Client ───────────────────────────────────────────────── | COMMENT |
| MEDIUM | apps/auth/src/lib/server/oauth/model.ts | 163 | // ─── Authorization Code ───────────────────────────────────── | COMMENT |
| MEDIUM | apps/auth/src/lib/server/oauth/model.ts | 254 | // ─── Tokens ───────────────────────────────────────────────── | COMMENT |
| MEDIUM | apps/auth/src/lib/server/oauth/model.ts | 338 | // ─── Client Credentials ───────────────────────────────────── | COMMENT |
| MEDIUM | apps/auth/src/lib/server/oauth/model.ts | 355 | // ─── Scope Validation ────────────────────────────────────── | COMMENT |
| MEDIUM | apps/auth/src/lib/server/oauth/first-party.ts | 48 | // ── Trusted-spoke-domain registry ───────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | apps/auth/src/lib/server/oauth/__tests__/model.test.ts | 10 | // ── Kysely db mock ──────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | apps/moderator/src/lib/server/api-guard.ts | 38 | // ─── Script-facing helpers ──────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | src/tests/api/tier1-public-route-disclosure.test.ts | 151 | // ── The payloads. Both are REAL driver errors, not stand-ins. ──────────────── | COMMENT |
| MEDIUM | src/tests/api/tier1-public-route-disclosure.test.ts | 551 | // ── Route-specific behaviour the fix must not have broken ────────────────── | COMMENT |
| MEDIUM | src/tests/api/rest-envelope-consolidation.test.ts | 151 | // ── The payloads. Both are REAL driver errors, not stand-ins. ──────────────── | COMMENT |
| MEDIUM | src/tests/api/rest-envelope-consolidation.test.ts | 463 | // ── Route-specific behaviour the delegation must NOT have broken ──────────── | COMMENT |
| MEDIUM | src/tests/api/v1/blocks/tip-endpoint.test.ts | 365 | // ── Idempotency (item 2, tip half) ────────────────────────────────────────── | COMMENT |
| MEDIUM | src/tests/api/v1/blocks/tip-allowance-endpoint.test.ts | 156 | // ── audit 🟡-4: rate limited like every sibling blocks REST read ────────────── | COMMENT |
| MEDIUM | src/tests/api/v1/blocks/images-endpoint.test.ts | 278 | // ── Transient Meili → retryable 503 (audit 🟡 #2) ────────────────────────── | COMMENT |
| MEDIUM | src/tests/api/v1/blocks/images-endpoint.test.ts | 278 | // ── Transient Meili → retryable 503 (audit 🟡 #2) ────────────────────────── | COMMENT |
| MEDIUM | src/tests/api/v1/images/index.test.ts | 468 | // ─── Transient upstream → retryable 503 (500→503 reclassification) ─────────── | COMMENT |
| MEDIUM | src/tests/api/v1/block-tokens/page-mint.test.ts | 426 | // ───────────────────────── W10 generation spend ────────────────────────── | COMMENT |
| MEDIUM | src/tests/api/v1/block-tokens/page-mint.test.ts | 507 | // ── Audit should-fix: integer enforcement in resolveBuzzBudget ────────── | COMMENT |
| MEDIUM | src/tests/api/v1/block-tokens/page-mint.test.ts | 611 | // verbatim (clamped only by the cap). ──────────────────────────────────── | COMMENT |
| MEDIUM | src/tests/api/v1/block-tokens/page-mint.test.ts | 721 | // showed can silently fail. ──────────────────────────────────────────────── | COMMENT |
| MEDIUM | src/tests/api/v1/block-tokens/page-mint.test.ts | 774 | // ─────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | src/tests/api/v1/block-tokens/page-mint.test.ts | 784 | // ─────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | src/tests/api/v1/apps/apps-error-envelope.test.ts | 217 | // ── Guard: the #3845 disclosure, through the REAL handler ────────────────── | COMMENT |
| MEDIUM | src/tests/api/v1/apps/apps-error-envelope.test.ts | 217 | // ── Guard: the #3845 disclosure, through the REAL handler ────────────────── | COMMENT |
| MEDIUM | src/tests/api/v1/apps/apps-error-envelope.test.ts | 236 | // ── Guard: one envelope across every non-2xx status this route emits ─────── | COMMENT |
| MEDIUM | src/tests/api/v1/apps/apps-error-envelope.test.ts | 269 | // ── Guard: the OTHER 500 branch, through the SAME real route ─────────────── | COMMENT |
| MEDIUM | src/tests/api/v1/apps/apps-error-envelope.test.ts | 300 | // ── Guard: the 4xx pass-through is UNCHANGED on the same route ───────────── | COMMENT |
| MEDIUM | src/tests/api/v1/apps/apps-error-envelope.test.ts | 315 | // ── Positive control: the discriminator actually DISCRIMINATES ───────────── | COMMENT |
| MEDIUM | src/tests/api/v1/apps/apps-error-envelope.test.ts | 340 | // ── Guard: nothing on the request path throws OUTSIDE the try ───────────── | COMMENT |
| MEDIUM | src/tests/api/v1/apps/apps-error-envelope.test.ts | 383 | // ── Invariant: the 200 payload is untouched by this change ──────────────── | COMMENT |
| MEDIUM | src/tests/api/internal/blocks/mod-gate.test.ts | 86 | // ── ENTRY path (requires a valid mr token) ──────────────────────────────── | COMMENT |
| MEDIUM | src/tests/api/internal/blocks/mod-gate.test.ts | 167 | // ── ABSENT Sec-Fetch-Dest → treated as ENTRY (fail-safe) ────────────────── | COMMENT |
| MEDIUM | src/tests/api/internal/blocks/mod-gate.test.ts | 184 | // ── SUBRESOURCE path (allowed without any token/cookie) ─────────────────── | COMMENT |
| MEDIUM | src/tests/api/internal/blocks/mod-gate.test.ts | 211 | // ── fail-closed on missing host ─────────────────────────────────────────── | COMMENT |
| MEDIUM | src/server/pyroscope.ts | 16 | // ───────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | src/server/pyroscope.ts | 25 | // ───────────────────────────────────────────────────────────────────────────── | COMMENT |
| 568 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/preview-bootstrap.spec.ts | 76 | async function readBrowsingSettingsAddons(page: import('@playwright/test').Page) { | CODE |
| LOW | tests/preview-ssr-inject.spec.ts | 142 | function assertAnnouncementsSeedEqualsLive(seed: unknown, live: unknown, label: string) { | CODE |
| LOW | docs/article-ingestion-status-proposal.md | 121 | export async function recomputeArticleIngestion(articleId: number): Promise<void> { | CODE |
| LOW | docs/subscription-remaining-tasks.md | 266 | export async function hasActiveMembershipForBuzzType(userId: number, buzzType: string) { | CODE |
| LOW | docs/base-model-constants-management.md | 500 | async function getBaseModelConfigForClient() { | CODE |
| LOW⚡ | docs/subscription-multi-buzz-migration.md | 129 | async function getUserSubscriptionForBuzzType(userId: number, buzzType: BuzzSpendType) | CODE |
| LOW⚡ | docs/subscription-multi-buzz-migration.md | 135 | async function hasActiveMembershipForBuzzType(userId: number, buzzType: BuzzSpendType) | CODE |
| LOW⚡ | docs/subscription-multi-buzz-migration.md | 138 | async function getUserActiveSubscriptions(userId: number) | CODE |
| LOW | docs/feed-card-dom-audit.md | 97 | export function ImagesAsPostsInfiniteProvider({ | CODE |
| LOW | docs/moderator-app/retool-exports/bulk-image-manager.md | 135 | function handleFilteredImageDelete(imageIds){ | CODE |
| LOW | docs/moderator-app/retool-exports/bulk-image-manager.md | 384 | function handleFilteredImageRestore(imageIds){ | CODE |
| LOW | docs/moderator-app/retool-exports/user-reports.md | 146 | function handleFilteredImageDelete(imageIds){ | CODE |
| LOW | docs/moderator-app/retool-exports/user-reports.md | 255 | function handleFilteredImageRestore(imageIds){ | CODE |
| LOW⚡ | …derator-app/retool-exports/raw/bulk-image-manager.json | 1 | {"uuid":"57fd8fb4-51ac-11ee-a0dd-9f0a271c8c9b","page":{"id":510420824,"data":{"appState":"[\"~#iR\",[\"^ \",\"n\",\"appT | CODE |
| LOW⚡ | docs/moderator-app/retool-exports/raw/user-reports.json | 1 | {"uuid":"a7fbd3e4-46ee-11ef-addd-8b299ca80778","page":{"id":510420693,"data":{"appState":"[\"~#iR\",[\"^ \",\"n\",\"appT | CODE |
| LOW | docs/plans/generator-filtering-options.md | 100 | export function getProcessTagFromWorkflow(workflow: string, hasSourceImage: boolean): string | undefined { | CODE |
| LOW | docs/plans/generator-filtering-options.md | 300 | export function useGetTextToImageRequests(/* ... */) { | CODE |
| LOW | docs/plans/live-metric-signals.md | 534 | export function useMetricSubscriptionContext() { | CODE |
| LOW | docs/plans/live-metric-signals.md | 545 | export function MetricSubscriptionProvider({ | CODE |
| LOW | docs/auth/session-refresh-debug-instrumentation.md | 120 | function checkAndSetSessionHeaders(session: Session | null, res: AuthResponse): Session | null { | CODE |
| LOW | docs/features/prompt-snippets-provisioning-job.md | 87 | async function importWildcardModelVersion(modelVersionId: number): Promise<{ | CODE |
| LOW | scripts/metric-migration/backfill-metrics.ts | 182 | async function deleteExistingBackfillData(entityType: string, dryRun: boolean): Promise<void> { | CODE |
| LOW | …ages/civitai-telemetry/src/__tests__/otel-logs.test.ts | 52 | function registerRecordingProvider(): InMemoryLogRecordExporter { | CODE |
| LOW | packages/civitai-auth/src/first-party-bridge.ts | 147 | export async function completeFirstPartyCallback(opts: { | CODE |
| LOW | packages/civitai-auth/src/impersonation-client.ts | 32 | export function createImpersonationClient(): ImpersonationClient { | CODE |
| LOW | packages/civitai-auth/src/legacy-cookie.ts | 19 | export async function decodeLegacySessionCookie( | CODE |
| LOW | packages/civitai-auth/src/token-scope.ts | 302 | export function connectScopesSubsetOfCeiling(requested: number, allowedScopes: number): boolean { | CODE |
| LOW | packages/civitai-auth/src/token-scope.ts | 317 | export function validateConnectScopeJustifications( | CODE |
| LOW | packages/civitai-auth/src/trusted-domains.ts | 55 | export function createTrustedDomainRegistry( | CODE |
| LOW | packages/civitai-auth/src/device-client.ts | 29 | export function createDeviceAccountClient(): DeviceAccountClient { | CODE |
| LOW | …/civitai-db-schema/src/schema-drift/remediation/sql.ts | 309 | export function createIndexConcurrentlySql(ctx: RelationSqlContext, indexName: string): string { | CODE |
| LOW | packages/civitai-axiom/src/client.ts | 110 | function getSharedIngestFailureCounts(): Map<string, number> { | CODE |
| LOW | packages/civitai-axiom/src/client.ts | 125 | function getSharedUnprovisionedReported(): Set<string> { | CODE |
| LOW | packages/civitai-axiom/src/client.ts | 255 | function reportUnprovisionedDatastream(datastream: string) { | CODE |
| LOW | packages/civitai-axiom/src/env.ts | 102 | export function buildProvisionedDatastreams(extra: readonly string[] = []): ReadonlySet<string> { | CODE |
| LOW | packages/civitai-mod-utils/src/prompt-audit/index.ts | 395 | function includesHarmfulCombinations(prompt: string): 'minor' | 'poi' | false { | CODE |
| LOW | packages/civitai-mod-utils/src/prompt-audit/index.ts | 516 | export function getPromptHighlightSegments( | CODE |
| LOW | packages/civitai-db/src/kysely.ts | 26 | function registerNumericTypeParsers() { | CODE |
| LOW | packages/civitai-db/src/kysely.ts | 56 | export async function registerEnumArrayTypeParsers(pool: Pool): Promise<void> { | CODE |
| LOW | packages/civitai-notifications/src/client.ts | 172 | export function createNotificationsClient(config: NotificationsClientConfig = {}) { | CODE |
| LOW | packages/civitai-redis/src/cache.ts | 136 | export function createSysRedisCacheBuilder(base: { | CODE |
| LOW | packages/civitai-redis/src/cluster-deadline-hits.ts | 82 | export function recordClusterCommandSettle( | CODE |
| LOW | packages/civitai-redis/src/client.ts | 267 | function triggerTopologyRediscovery(clusterClient: any, reason: string) { | CODE |
| LOW | packages/civitai-redis/src/client.ts | 429 | function clearClusterRefreshInterval(type: 'cache' | 'system'): void { | CODE |
| LOW | packages/civitai-redis/src/client.ts | 706 | export function attachSysSentinelListeners( | CODE |
| LOW | packages/civitai-redis/src/cluster-routing-retry.ts | 116 | export function isTransientClusterRoutingError(err: unknown): boolean { | CODE |
| LOW | …itai-redis/src/__tests__/cluster-routing-retry.test.ts | 44 | function nodeClientConnectPromiseThrow(): TypeError { | CODE |
| LOW | packages/civitai-buzz/src/paid-access.ts | 240 | export function migrateTermsForUsageControl( | CODE |
| LOW | packages/civitai-buzz/src/rights-affirmation.ts | 54 | export function hasCurrentRightsAffirmation(meta: unknown, ownerId?: number): boolean { | CODE |
| LOW | packages/civitai-shared/src/basemodel.constants.ts | 3608 | export function baseModelSupportsClipSkip(baseModel?: string | null): boolean { | CODE |
| LOW | packages/civitai-shared/src/basemodel.constants.ts | 3721 | export function isBaseModelGenerationSupported( | CODE |
| LOW | packages/civitai-shared/src/basemodel.constants.ts | 3766 | export function getResourceGenerationSupport( | CODE |
| LOW | packages/civitai-shared/src/basemodel.constants.ts | 3843 | export function getResourceEcosystemCompatibility( | CODE |
| LOW | packages/civitai-shared/src/basemodel.constants.ts | 3895 | export function getBaseModelEcosystemById(baseModelId: number): EcosystemRecord | undefined { | CODE |
| LOW | packages/civitai-shared/src/basemodel.constants.ts | 3905 | export function getBaseModelsByEcosystemId( | CODE |
| LOW | packages/civitai-shared/src/basemodel.constants.ts | 3980 | export function getGenerationBaseModelRecords(): BaseModelRecord[] { | CODE |
| LOW | packages/civitai-shared/src/basemodel.constants.ts | 4019 | export function getGenerationEcosystemsForMediaType(mediaType: MediaType): string[] { | CODE |
| LOW | packages/civitai-shared/src/basemodel.constants.ts | 4043 | export function getDefaultEcosystemForMediaType(mediaType: MediaType): string | undefined { | CODE |
| LOW | packages/civitai-shared/src/basemodel.constants.ts | 4436 | export function checkGenerationCompatibility( | CODE |
| LOW | packages/civitai-shared/src/basemodel.constants.ts | 4785 | export function getGenerationBaseModelGroup( | CODE |
| 1211 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| CRITICAL | src/tests/api/v1/developer/block-manifests.test.ts | 100 | const upsertArgs = mockDbWrite.appBlock.upsert.mock.calls.at(-1)?.[0] as { | CODE |
| CRITICAL | src/tests/api/v1/developer/block-manifests.test.ts | 119 | const upsertArgs = mockDbWrite.appBlock.upsert.mock.calls.at(-1)?.[0] as { | CODE |
| CRITICAL | src/tests/api/v1/developer/block-manifests.test.ts | 149 | const upsertArgs = mockDbWrite.appBlock.upsert.mock.calls.at(-1)?.[0] as { | CODE |
| CRITICAL | src/tests/api/v1/developer/block-manifests.test.ts | 179 | const upsertArgs = mockDbWrite.appBlock.upsert.mock.calls.at(-1)?.[0] as { | CODE |
| CRITICAL | src/tests/api/v1/developer/block-manifests.test.ts | 198 | const upsertArgs = mockDbWrite.appBlock.upsert.mock.calls.at(-1)?.[0] as { | CODE |
| CRITICAL | …/routers/__tests__/blocks.router.getNavSummary.test.ts | 345 | const statuses = mockDbRead.appCollaborator.findFirst.mock.calls.map( | CODE |
| CRITICAL | src/server/rewards/__tests__/remixAccept.reward.test.ts | 54 | const [, options] = redisMock.redis.eval.mock.calls.at(-1) as [unknown, { arguments: string[] }]; | CODE |
| CRITICAL | …ils/__tests__/app-moderator-message-rate-limit.test.ts | 56 | const keys = redisMock.redis.incrBy.mock.calls.map((c) => c[0] as string); | CODE |
| CRITICAL | …ils/__tests__/app-moderator-message-rate-limit.test.ts | 72 | const keys = redisMock.redis.incrBy.mock.calls.map((c) => c[0] as string); | CODE |
| CRITICAL | src/server/__tests__/middleware.trpc.cacheit.test.ts | 146 | return redisFake.packed.get.mock.calls.at(-1)![0] as string; | CODE |
| CRITICAL | src/server/__tests__/pending-review-mute.test.ts | 272 | const dataArgs = dbWrite.user.update.mock.calls.map(([arg]) => arg.data); | CODE |
| CRITICAL | src/server/jobs/__tests__/process-vault-items.test.ts | 229 | const lastUpdate = mockDbWrite.vaultItem.update.mock.calls.at(-1)?.[0]; | CODE |
| CRITICAL | src/server/jobs/__tests__/process-vault-items.test.ts | 302 | const storedWrite = mockDbWrite.vaultItem.update.mock.calls.at(-1)?.[0]; | CODE |
| CRITICAL | src/server/jobs/__tests__/process-vault-items.test.ts | 310 | const failWrite = mockDbWrite.vaultItem.update.mock.calls.at(-1)?.[0]; | CODE |
| CRITICAL | …/blocks/__tests__/offsite-listing.edit.service.test.ts | 257 | const updateCalls = mockWrite.appListing.update.mock.calls.map((c) => c[0]); | CODE |
| CRITICAL | …/blocks/__tests__/offsite-listing.edit.service.test.ts | 313 | const updateCalls = mockWrite.appListing.update.mock.calls.map((c) => c[0]); | CODE |
| CRITICAL | …tests__/offsite-moderation.service.mod-actions.test.ts | 1964 | const call = mockWrite.appListing.updateMany.mock.calls.find( | CODE |
| CRITICAL | …tests__/offsite-moderation.service.mod-actions.test.ts | 2224 | const relistCall = mockWrite.appListing.updateMany.mock.calls.find( | CODE |
| CRITICAL | …ests__/offsite-listing.onsite-revision.service.test.ts | 227 | const derivedRead = mockWrite.image.findMany.mock.calls.find( | CODE |
| CRITICAL | …ests__/offsite-listing.onsite-revision.service.test.ts | 433 | const selects = mockRead.appListingPublishRequest.findMany.mock.calls.map( | CODE |
| CRITICAL | …/__tests__/offsite-listing.source-repo.service.test.ts | 342 | const parentWrites = mockWrite.appListing.update.mock.calls.filter( | CODE |
| CRITICAL | …/__tests__/offsite-listing.source-repo.service.test.ts | 406 | const parentWrites = mockWrite.appListing.update.mock.calls.filter( | CODE |
| CRITICAL | …/__tests__/offsite-listing.source-repo.service.test.ts | 497 | const parentUpdate = mockWrite.appListing.update.mock.calls.find( | CODE |
| CRITICAL | …/__tests__/offsite-listing.source-repo.service.test.ts | 878 | const repoQueries = mockWrite.appListing.findUnique.mock.calls.filter((c) => | CODE |
| CRITICAL | …/__tests__/offsite-listing.source-repo.service.test.ts | 886 | const parentUpdate = mockWrite.appListing.update.mock.calls.find( | CODE |
| CRITICAL | …blocks/__tests__/publish-request.orchestration.test.ts | 550 | const call = mockDbWrite.appBlockPublishRequest.create.mock.calls.at(-1); | CODE |
| CRITICAL | …blocks/__tests__/publish-request.orchestration.test.ts | 1649 | const restoreFlip = mockDbWrite.appListing.updateMany.mock.calls.find( | CODE |
| CRITICAL | …blocks/__tests__/publish-request.orchestration.test.ts | 1657 | const unsuspend = mockDbWrite.appBlock.updateMany.mock.calls.find( | CODE |
| CRITICAL | …blocks/__tests__/publish-request.orchestration.test.ts | 1786 | mockDbWrite.appBlock.updateMany.mock.calls.find( | CODE |
| CRITICAL | …blocks/__tests__/publish-request.orchestration.test.ts | 1940 | const unsuspend = mockDbWrite.appBlock.updateMany.mock.calls.find( | CODE |
| CRITICAL | …blocks/__tests__/publish-request.orchestration.test.ts | 2023 | const reqUpdate = mockDbWrite.appBlockPublishRequest.update.mock.calls.find( | CODE |
| CRITICAL | …blocks/__tests__/publish-request.orchestration.test.ts | 2123 | const shaStamp = mockDbWrite.appBlock.update.mock.calls.find( | CODE |
| CRITICAL | …blocks/__tests__/publish-request.orchestration.test.ts | 2231 | const tierUpdate = mockDbWrite.appBlock.update.mock.calls.find( | CODE |
| CRITICAL | …blocks/__tests__/publish-request.orchestration.test.ts | 2256 | const tierUpdate = mockDbWrite.appBlock.update.mock.calls.find( | CODE |
| CRITICAL | …blocks/__tests__/publish-request.orchestration.test.ts | 2478 | const shaStamp = mockDbWrite.appBlock.update.mock.calls.find( | CODE |
| CRITICAL | …blocks/__tests__/publish-request.orchestration.test.ts | 2675 | const syncCalls = mockDbWrite.appListing.updateMany.mock.calls.filter( | CODE |
| CRITICAL | …ver/services/blocks/__tests__/showcase.service.test.ts | 40 | const last = mockDbRead.imageResourceNew.findMany.mock.results.at(-1); | CODE |
| CRITICAL | …vices/blocks/__tests__/offsite-listing.service.test.ts | 1194 | const flip = mockWrite.appListing.updateMany.mock.calls.find( | CODE |
| CRITICAL | …offsite-listing.onsite-listing-approve.service.test.ts | 115 | const call = mockWrite.appListing.updateMany.mock.calls.find( | CODE |
| CRITICAL | …locks/__tests__/app-access.accessible-listings.test.ts | 558 | const call = mockDb.appListingModerationEvent.findFirst.mock.calls.at(-1)?.[0] as { | CODE |
| CRITICAL | …blocks/__tests__/publish-request.reviewSandbox.test.ts | 201 | const buildingCall = mockDbWrite.appBlockPublishRequest.updateMany.mock.calls.find( | CODE |
| CRITICAL | …blocks/__tests__/publish-request.reviewSandbox.test.ts | 231 | const failedCall = mockDbWrite.appBlockPublishRequest.updateMany.mock.calls.find( | CODE |
| CRITICAL | …site-moderation.service.republish-asset-review.test.ts | 174 | const call = mockWrite.appListing.updateMany.mock.calls.find( | CODE |
| CRITICAL | …cks/__tests__/app-access.my-app-listings-media.test.ts | 209 | const hydrateCall = mockDb.appListing.findMany.mock.calls.at(-1)?.[0] as { | CODE |
| CRITICAL | …cks/__tests__/app-access.my-app-listings-media.test.ts | 436 | mockDb.appListing.findMany.mock.calls.at(-1)?.[0] as { select: Record<string, unknown> } | CODE |
| CRITICAL | …cks/__tests__/app-access.my-app-listings-media.test.ts | 454 | mockDb.appListing.findMany.mock.calls.at(-1)?.[0] as { | CODE |
| CRITICAL | …rver/services/blocks/__tests__/backpay.service.test.ts | 421 | const calls = mockDbWrite.blockSpendAttribution.updateMany.mock.calls.map((c) => c[0]); | CODE |
| CRITICAL | …offsite-listing.get-my-listing-for-app.service.test.ts | 656 | mockRead.appListing.findUnique.mock.calls.some( | CODE |
| CRITICAL | …offsite-listing.get-my-listing-for-app.service.test.ts | 893 | mockRead.appListing.findUnique.mock.calls.some( | CODE |
| CRITICAL | …s/blocks/__tests__/publish-request.listingSync.test.ts | 213 | return db.write.appListing.updateMany.mock.calls.filter((c) => { | CODE |
| CRITICAL | …s/blocks/__tests__/publish-request.listingSync.test.ts | 539 | const transitionCall = db.write.appListing.updateMany.mock.calls.find((c) => { | CODE |
| CRITICAL | …s/blocks/__tests__/publish-request.listingSync.test.ts | 614 | const transitionCall = db.write.appListing.updateMany.mock.calls.find( | CODE |
| CRITICAL | …ces/blocks/__tests__/spend-attribution.service.test.ts | 280 | const { data } = mockDbWrite.blockSpendAttribution.create.mock.calls.at(-1)![0]; | CODE |
| CRITICAL | …blocks/__tests__/publish-request.draftAtSubmit.test.ts | 81 | return db.write.appListing.deleteMany.mock.calls.filter((c) => { | CODE |
| CRITICAL | …es/blocks/__tests__/app-listing-assets.service.test.ts | 657 | const orders = mockDb.appListingScreenshot.updateMany.mock.calls.map( | CODE |
| CRITICAL | …es/blocks/__tests__/app-listing-assets.service.test.ts | 713 | const orders = mockDb.appListingScreenshot.updateMany.mock.calls.map( | CODE |
| CRITICAL | …locks/__tests__/app-listing.moderation.service.test.ts | 59 | return mockDbRead.appListing.findMany.mock.calls.at(-1)?.[0] as { | CODE |
| CRITICAL | …ices/blocks/__tests__/app-collaborator.service.test.ts | 488 | const call = mockDb.user.findUnique.mock.calls.find( | CODE |
| CRITICAL⚡ | …/services/blocks/__tests__/app-listing.service.test.ts | 861 | const where = (mockDbRead.appListing.findFirst.mock.calls.at(-1)?.[0] as { where?: unknown }) | CODE |
| CRITICAL⚡ | …/services/blocks/__tests__/app-listing.service.test.ts | 870 | const where = (mockDbRead.appListing.findFirst.mock.calls.at(-1)?.[0] as { where?: unknown }) | CODE |
| 35 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | .claude/skills/xguard-manager/SKILL.md | 50 | # See what the defaults look like (useful for scaffolding a new label) | COMMENT |
| MEDIUM | docs/auto-label-orchestrator-revamp.md | 24 | ## Existing scaffolding to reuse | COMMENT |
| MEDIUM | docs/event-bus-discovery.md | 378 | **Recommended middle path:** don't block it on a full platform (failure mode #1), but make it the **Phase-0 driving feat | CODE |
| MEDIUM | docs/monorepo-directory-snapshot.md | 209 | │ └── moderator/ # Next.js content-moderation app (scaffold): a spoke that verifies | CODE |
| MEDIUM | docs/prompt-analysis-audit-2026-08-05.md | 936 | ### `civitai-orchestration` | COMMENT |
| MEDIUM | docs/moderator-app-package-extraction-plan.md | 106 | ### Commit 2 — post-move changes (scaffolding + shims + import rewrites + member extractions) | COMMENT |
| MEDIUM | docs/moderator-app-package-extraction-plan.md | 211 | ### D. New package scaffolding (mirror `@civitai/db-schema`) | COMMENT |
| MEDIUM | docs/features/multi-image-upscale.md | 124 | ### 3. Backend: Multi-Step Fan-Out in `orchestration-new.service.ts` | COMMENT |
| MEDIUM | docs/features/prompt-snippets.md | 297 | ### Phase 1 — schema + tRPC scaffolding (backend only) | COMMENT |
| MEDIUM | apps/event-engine/docs/plans/initial.md | 211 | ### 2. Develop event listening microservice | COMMENT |
| MEDIUM | apps/event-engine/docs/plans/table-to-metrics.md | 168 | ### orchestration.jobs | COMMENT |
| MEDIUM | …or/src/routes/retool/user-lookup/TrainingsPanel.svelte | 292 | {#await orchestration} | CODE |
| MEDIUM | src/tests/api/v1/blocks/dev-token.test.ts | 745 | // The exact root-cause scenario: the page-money scaffold manifest declares | COMMENT |
| MEDIUM | src/tests/pages/payment/success.browser.test.tsx | 26 | // The scaffold mocks `next/router` with a shared router object (spy `replace`, | COMMENT |
| MEDIUM⚡ | …erver/routers/__tests__/blocks.router.workflow.test.ts | 7310 | // surface, and the requirement is that it is covered by the SAME guardrails as | COMMENT |
| MEDIUM⚡ | src/server/utils/app-block-ids.ts | 132 | // App Blocks — agentic mod code-review report (P0). Dark/additive. | COMMENT |
| MEDIUM | src/server/services/feature-flags.service.ts | 565 | // until the Flipt `app-blocks-agentic-review` flag is created. This mirrors the | COMMENT |
| MEDIUM | src/server/services/blocks/app-review-report.service.ts | 5 | // App Blocks — agentic mod code-review report (P0 read/lookup layer). | COMMENT |
| MEDIUM | src/server/services/blocks/agent-review.service.ts | 602 | // mod-only `app-blocks-agentic-review` Flipt flag (absent → fail-closed → inert). | COMMENT |
| MEDIUM⚡ | …ervices/blocks/recipes/starter-comfy-txt2img.recipe.ts | 16 | // The DEMOABLE STARTER: the recipe the CLI scaffold's default `customComfy` sample | COMMENT |
| MEDIUM | src/server/services/blocks/recipes/index.ts | 189 | // Recipe #2 — the CLI scaffold's demoable starter: a minimal single-step Z-Image | COMMENT |
| MEDIUM | src/server/services/blocks/recipes/index.ts | 189 | // Recipe #2 — the CLI scaffold's demoable starter: a minimal single-step Z-Image | COMMENT |
| MEDIUM | …ervices/__tests__/delete-image-from-s3-logging.test.ts | 11 | // image.service is the graph root; the mock scaffold mirrors the established recipe | COMMENT |
| MEDIUM | …rvices/__tests__/image-cacher-invalidate-scope.test.ts | 16 | // image.service is the graph root; the mock scaffold mirrors the established recipe | COMMENT |
| MEDIUM | …ices/__tests__/update-post-image-hidemeta-bust.test.ts | 33 | // --- infra scaffold (mirrors contest-entry-resource-gate.test.ts) --------------------- | COMMENT |
| MEDIUM | …rvices/__tests__/unblock-image-nsfwlevel-reset.test.ts | 18 | // image.service is the graph root; the mock scaffold mirrors the established | COMMENT |
| MEDIUM | …ices/__tests__/model-locked-properties.service.test.ts | 6 | // Mirrors the mock scaffold used in set-model-minor.service.test.ts. | COMMENT |
| MEDIUM | …ces/__tests__/bounty-locked-properties.service.test.ts | 6 | // service/db/queue dependencies are stubbed out below. Mirrors the mock scaffold used in | COMMENT |
| MEDIUM | …sts__/bust-public-model-response-cache.service.test.ts | 7 | // ingest) to unit-test in isolation without a brittle scaffold, so its bust | COMMENT |
| MEDIUM | …__tests__/prisma-inconsistent-orphan-relations.test.ts | 23 | // Mirrors the scaffold in set-model-minor.service.test.ts. | COMMENT |
| MEDIUM | …es/__tests__/model-early-access-refund.service.test.ts | 7 | // an integration test. Mirrors the mock scaffold used in set-model-minor.service.test.ts. | COMMENT |
| MEDIUM | …ver/services/__tests__/set-model-minor.service.test.ts | 6 | // unit test rather than an integration test. Mirrors the mock scaffold used | COMMENT |
| MEDIUM | …services/__tests__/bust-caches-for-posts-empty.test.ts | 9 | // post.service is the graph root; the mock scaffold mirrors the established recipe | COMMENT |
| MEDIUM | …ion_v2/inputs/MetadataExtractionPanel.browser.test.tsx | 101 | // We do NOT mock Mantine (resolve.dedupe handles dual-React at the scaffold). | COMMENT |
| MEDIUM | …eration_v2/inputs/ResourceItemContent.browser.test.tsx | 20 | // scaffold providers (MantineProvider + QueryClient + next/router). To stand | COMMENT |
| MEDIUM | …eration_v2/inputs/ResourceItemContent.browser.test.tsx | 47 | // Mantine is NOT mocked (resolve.dedupe handles dual-React at the scaffold). | COMMENT |
| MEDIUM | …eration_v2/inputs/ResourceSelectInput.browser.test.tsx | 79 | // We do NOT mock Mantine (resolve.dedupe handles dual-React at the scaffold). | COMMENT |
| MEDIUM | …ts/generation_v2/inputs/WorkflowInput.browser.test.tsx | 62 | // client needed. (The scaffold is network-free; mocking the hook is cheaper than | COMMENT |
| MEDIUM | …ts/generation_v2/inputs/WorkflowInput.browser.test.tsx | 98 | // We do NOT mock Mantine core (resolve.dedupe handles dual-React at the scaffold). | COMMENT |
| MEDIUM | …onents/generation_v2/inputs/SeedInput.browser.test.tsx | 10 | // props (no tRPC/router) — it anchors the scaffold while exercising Mantine | COMMENT |
| MEDIUM | …s/generation_v2/inputs/BaseModelInput.browser.test.tsx | 87 | // We do NOT mock Mantine core (resolve.dedupe handles dual-React at the scaffold). | COMMENT |
| MEDIUM | …nents/generation_v2/inputs/VideoInput.browser.test.tsx | 10 | // The component-setup scaffold deliberately does NOT wire a tRPC provider; a | COMMENT |
| MEDIUM | …nents/generation_v2/inputs/VideoInput.browser.test.tsx | 54 | // copy on a cold optimizeDeps cache. That's fixed at the scaffold level by | COMMENT |
| MEDIUM | …chTextEditor/__tests__/RenderRichText.browser.test.tsx | 11 | // which this scaffold provides. | COMMENT |
| MEDIUM | …Sticker/StickerPlacementTray.overflow.browser.test.tsx | 71 | // into a URL this scaffold cannot serve. | COMMENT |
| MEDIUM | …mponents/Sticker/StickerPlacementTray.browser.test.tsx | 89 | // it is stubbed rather than left to reach a client this scaffold does not | COMMENT |
| MEDIUM | …mponents/Sticker/StickerPlacementTray.browser.test.tsx | 100 | // The tray calls two cosmetic queries directly. The scaffold is network-free and | COMMENT |
| MEDIUM | …s/AppBlocks/IframeHostReadyTransition.browser.test.tsx | 85 | // scaffold does not mount). Dark flags = the production default, and this suite | COMMENT |
| MEDIUM | …ents/AppBlocks/PageBlockHostAutoRetry.browser.test.tsx | 81 | // render, which need the tRPC Context the network-free scaffold doesn't provide. | COMMENT |
| MEDIUM | src/components/AppBlocks/IframeHost.browser.test.tsx | 28 | // scaffold does not mount). Dark flags = the production default, and these | COMMENT |
| MEDIUM | src/components/AppBlocks/IframeHost.browser.test.tsx | 90 | // useBrowsingLevelDebounced reads a context the network-free scaffold doesn't | COMMENT |
| MEDIUM | …s/AppBlocks/PageBlockHostLaunchReveal.browser.test.tsx | 47 | // render, which need the tRPC Context the network-free scaffold doesn't provide. | COMMENT |
| MEDIUM | …nents/AppBlocks/IframeHostStatusGates.browser.test.tsx | 56 | // THROWS without a FeatureFlagsProvider (which this scaffold does not mount). Dark | COMMENT |
| MEDIUM | …nents/AppBlocks/IframeHostStatusGates.browser.test.tsx | 118 | // useBrowsingLevelDebounced reads a context the network-free scaffold doesn't | COMMENT |
| MEDIUM | …ponents/AppBlocks/BlockHostTokenRetry.browser.test.tsx | 38 | // this scaffold does not mount. Without this mock, every test that gets far enough | COMMENT |
| MEDIUM | src/components/AppBlocks/PageBlockHost.browser.test.tsx | 16 | // HoC) the network-free component scaffold doesn't provide. Mock the tRPC client | COMMENT |
| MEDIUM | src/components/Account/ApiKeysCard.tsx | 73 | // When the modal was opened via a deeplink (e.g. the App Blocks CLI scaffold's | COMMENT |
| MEDIUM | src/components/Account/ApiKeyModal.tsx | 57 | // Optional deeplink prefill (e.g. the App Blocks CLI scaffold link). These are | COMMENT |
| MEDIUM | src/components/Apps/AgentReviewChat.browser.test.tsx | 42 | // network-free scaffold has no session provider, so boundary-stub the hook (the | COMMENT |
| MEDIUM⚡ | src/components/Apps/AppEditPage.browser.test.tsx | 47 | // because the real hook throws `missing CivitaiSessionContext` under this scaffold — | COMMENT |
| 18 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | docs/workflow-metadata-refactor.md | 265 | // Step 1: named step | COMMENT |
| LOW | docs/workflow-metadata-refactor.md | 268 | // Step 2: references step 1's output | COMMENT |
| LOW | docs/adding-basemodel-ecosystem-guide.md | 144 | ### Step 1: Add Ecosystem ID Constant (if new ecosystem) | COMMENT |
| LOW | docs/adding-basemodel-ecosystem-guide.md | 161 | ### Step 2: Add Base Model ID Constant | COMMENT |
| LOW | docs/adding-basemodel-ecosystem-guide.md | 173 | ### Step 3: Add License (if new license) | COMMENT |
| LOW | docs/adding-basemodel-ecosystem-guide.md | 188 | ### Step 4: Add Ecosystem Family (if new family) | COMMENT |
| LOW | docs/adding-basemodel-ecosystem-guide.md | 200 | ### Step 5: Add Ecosystem Record | COMMENT |
| LOW | docs/adding-basemodel-ecosystem-guide.md | 217 | ### Step 6: Add Base Model Record | COMMENT |
| LOW | docs/adding-basemodel-ecosystem-guide.md | 235 | ### Step 7: Add Ecosystem Support | COMMENT |
| LOW | docs/adding-basemodel-ecosystem-guide.md | 299 | ### Step 8: Add Ecosystem Settings (if needed) | COMMENT |
| LOW | docs/adding-basemodel-ecosystem-guide.md | 328 | ### Step 9: Add Cross-Ecosystem Rules (if applicable) | COMMENT |
| LOW | docs/article-content-scanning.md | 694 | #### Step 1: Deploy Code (Feature Flag OFF) | COMMENT |
| LOW | docs/article-content-scanning.md | 705 | #### Step 2: Run Image Migration | COMMENT |
| LOW | docs/article-content-scanning.md | 732 | #### Step 3: Validate Migration | COMMENT |
| LOW | docs/article-content-scanning.md | 753 | #### Step 4: Enable Feature Flag | COMMENT |
| LOW | docs/article-content-scanning.md | 768 | #### Step 5: Monitor (First 24 Hours) | COMMENT |
| LOW | docs/auth/oauth-developer-docs.md | 32 | ### Step 1: Generate PKCE Values | COMMENT |
| LOW | docs/auth/oauth-developer-docs.md | 42 | ### Step 2: Redirect User to Authorization | COMMENT |
| LOW | docs/auth/oauth-developer-docs.md | 71 | ### Step 3: Exchange Code for Token | COMMENT |
| LOW | docs/auth/oauth-developer-docs.md | 97 | ### Step 4: Use the Access Token | COMMENT |
| LOW | docs/auth/oauth-developer-docs.md | 148 | ### Step 1: Request Device Code | COMMENT |
| LOW | docs/auth/oauth-developer-docs.md | 171 | ### Step 2: Display Code to User | COMMENT |
| LOW | docs/auth/oauth-developer-docs.md | 175 | ### Step 3: Poll for Token | COMMENT |
| LOW⚡ | scripts/oneoffs/reindex-missing-images.ts | 208 | // Step 1: Get all eligible images from database | COMMENT |
| LOW⚡ | scripts/oneoffs/reindex-missing-images.ts | 216 | // Step 2: Process in batches to avoid overwhelming DB and Meilisearch | COMMENT |
| LOW | scripts/oneoffs/reindex-missing-images.ts | 285 | // Step 3: Print summary | COMMENT |
| LOW | scripts/oneoffs/reindex-missing-images.ts | 301 | // Step 4: Queue for re-indexing | COMMENT |
| LOW⚡ | scripts/metric-migration/backfill-metrics.ts | 392 | // Step 1: Delete existing backfill data | COMMENT |
| LOW⚡ | scripts/metric-migration/backfill-metrics.ts | 395 | // Step 2: Get ID range (from args or query) | COMMENT |
| LOW | scripts/metric-migration/backfill-metrics.ts | 426 | // Step 3: Process in ID ranges | COMMENT |
| LOW | .vscode/rules/migrate-createStyles.md | 3 | ## Step 1: Convert Styles to SCSS | COMMENT |
| LOW | .vscode/rules/migrate-createStyles.md | 9 | ## Step 2: Integrate the SCSS File | COMMENT |
| LOW | …s/event-engine/scripts/setup-clickhouse-rollup-view.ts | 22 | // Step 1: Create backing table | COMMENT |
| LOW | …s/event-engine/scripts/setup-clickhouse-rollup-view.ts | 43 | // Step 2: Create Materialized View | COMMENT |
| LOW⚡ | …s/event-engine/scripts/setup-clickhouse-rollup-view.ts | 64 | // Step 3: Get time of mat view creation | COMMENT |
| LOW⚡ | …s/event-engine/scripts/setup-clickhouse-rollup-view.ts | 74 | // Step 4: Backfill week by week | COMMENT |
| LOW | …s/event-engine/scripts/setup-clickhouse-rollup-view.ts | 151 | // Step 5: Verify the data | COMMENT |
| LOW⚡ | apps/event-engine/src/common/feeds/images.feed.ts | 223 | // Step 2: Fetch metrics from ClickHouse via metric service | COMMENT |
| LOW⚡ | apps/event-engine/src/common/feeds/images.feed.ts | 226 | // Step 3: Fetch tags from cache | COMMENT |
| LOW⚡ | apps/event-engine/src/common/feeds/images.feed.ts | 229 | // Step 4: Fetch tools and techniques from PostgreSQL | COMMENT |
| LOW⚡ | apps/event-engine/src/common/feeds/images.feed.ts | 1043 | // Step 3: Extract IDs for data fetching | COMMENT |
| LOW⚡ | apps/event-engine/src/common/feeds/images.feed.ts | 1050 | // Step 4: Fetch user reactions (if authenticated) | COMMENT |
| LOW⚡ | apps/event-engine/src/common/feeds/images.feed.ts | 1057 | // Step 5: Fetch all required data in parallel | COMMENT |
| LOW⚡ | apps/event-engine/src/common/feeds/images.feed.ts | 1104 | // Step 5: Fetch tag data (only if tags or tagIds requested) | COMMENT |
| LOW⚡ | apps/event-engine/src/common/feeds/images.feed.ts | 1114 | // Step 6: Fetch cosmetic details for user cosmetics | COMMENT |
| LOW | apps/event-engine/src/common/feeds/images.feed.ts | 164 | // Step 1: Fetch base image data from PostgreSQL | COMMENT |
| LOW | apps/event-engine/src/common/feeds/images.feed.ts | 242 | // Step 5: Fetch model versions from PostgreSQL | COMMENT |
| LOW | apps/event-engine/src/common/feeds/images.feed.ts | 257 | // Step 6: Transform and combine all data | COMMENT |
| LOW | apps/event-engine/src/common/feeds/images.feed.ts | 924 | // Step 1: Apply post-filtering (matches getImagesFromSearchPostFilter logic) | COMMENT |
| LOW | apps/event-engine/src/common/feeds/images.feed.ts | 958 | // Step 2: Existence checking (feature-flagged) | COMMENT |
| LOW | apps/event-engine/src/common/feeds/images.feed.ts | 1126 | // Step 6: Transform to output format (matches getAllImagesIndex) | COMMENT |
| LOW | apps/event-engine/src/common/feeds/images.feed.ts | 1252 | // Step 7: Track seen images | COMMENT |
| LOW | apps/event-engine/src/common/services/metrics.ts | 61 | // Step 1: Lookup all IDs in Redis using Promise.all | COMMENT |
| LOW | apps/event-engine/src/common/services/metrics.ts | 89 | // Step 2: Process cache results | COMMENT |
| LOW | apps/event-engine/src/common/services/metrics.ts | 119 | // Step 3: Slide TTLs for hot cache entries | COMMENT |
| LOW | apps/event-engine/src/common/services/metrics.ts | 131 | // Step 4: Handle cache misses with lock mechanism to prevent stampedes | COMMENT |
| LOW | apps/event-engine/src/common/caches/base.ts | 51 | // Step 1: Lookup all IDs in Redis | COMMENT |
| LOW | apps/event-engine/src/common/caches/base.ts | 62 | // Step 2: Process cache results | COMMENT |
| LOW⚡ | apps/event-engine/src/common/caches/base.ts | 127 | // Step 3: Slide TTLs for hot cache entries | COMMENT |
| LOW⚡ | apps/event-engine/src/common/caches/base.ts | 136 | // Step 4: Handle stale entries with revalidation locks | COMMENT |
| 44 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | scripts/oneoffs/reindex-missing-images.ts | 208 | // Step 1: Get all eligible images from database | COMMENT |
| LOW⚡ | scripts/oneoffs/reindex-missing-images.ts | 216 | // Step 2: Process in batches to avoid overwhelming DB and Meilisearch | COMMENT |
| LOW | scripts/oneoffs/reindex-missing-images.ts | 285 | // Step 3: Print summary | COMMENT |
| LOW | scripts/oneoffs/reindex-missing-images.ts | 301 | // Step 4: Queue for re-indexing | COMMENT |
| LOW⚡ | scripts/metric-migration/backfill-metrics.ts | 392 | // Step 1: Delete existing backfill data | COMMENT |
| LOW⚡ | scripts/metric-migration/backfill-metrics.ts | 395 | // Step 2: Get ID range (from args or query) | COMMENT |
| LOW | scripts/metric-migration/backfill-metrics.ts | 426 | // Step 3: Process in ID ranges | COMMENT |
| LOW | …s/event-engine/scripts/setup-clickhouse-rollup-view.ts | 22 | // Step 1: Create backing table | COMMENT |
| LOW | …s/event-engine/scripts/setup-clickhouse-rollup-view.ts | 43 | // Step 2: Create Materialized View | COMMENT |
| LOW⚡ | …s/event-engine/scripts/setup-clickhouse-rollup-view.ts | 64 | // Step 3: Get time of mat view creation | COMMENT |
| LOW⚡ | …s/event-engine/scripts/setup-clickhouse-rollup-view.ts | 74 | // Step 4: Backfill week by week | COMMENT |
| LOW | …s/event-engine/scripts/setup-clickhouse-rollup-view.ts | 151 | // Step 5: Verify the data | COMMENT |
| LOW⚡ | apps/event-engine/src/common/feeds/images.feed.ts | 223 | // Step 2: Fetch metrics from ClickHouse via metric service | COMMENT |
| LOW⚡ | apps/event-engine/src/common/feeds/images.feed.ts | 226 | // Step 3: Fetch tags from cache | COMMENT |
| LOW⚡ | apps/event-engine/src/common/feeds/images.feed.ts | 229 | // Step 4: Fetch tools and techniques from PostgreSQL | COMMENT |
| LOW⚡ | apps/event-engine/src/common/feeds/images.feed.ts | 1043 | // Step 3: Extract IDs for data fetching | COMMENT |
| LOW⚡ | apps/event-engine/src/common/feeds/images.feed.ts | 1050 | // Step 4: Fetch user reactions (if authenticated) | COMMENT |
| LOW⚡ | apps/event-engine/src/common/feeds/images.feed.ts | 1057 | // Step 5: Fetch all required data in parallel | COMMENT |
| LOW⚡ | apps/event-engine/src/common/feeds/images.feed.ts | 1104 | // Step 5: Fetch tag data (only if tags or tagIds requested) | COMMENT |
| LOW⚡ | apps/event-engine/src/common/feeds/images.feed.ts | 1114 | // Step 6: Fetch cosmetic details for user cosmetics | COMMENT |
| LOW | apps/event-engine/src/common/feeds/images.feed.ts | 164 | // Step 1: Fetch base image data from PostgreSQL | COMMENT |
| LOW | apps/event-engine/src/common/feeds/images.feed.ts | 242 | // Step 5: Fetch model versions from PostgreSQL | COMMENT |
| LOW | apps/event-engine/src/common/feeds/images.feed.ts | 257 | // Step 6: Transform and combine all data | COMMENT |
| LOW | apps/event-engine/src/common/feeds/images.feed.ts | 924 | // Step 1: Apply post-filtering (matches getImagesFromSearchPostFilter logic) | COMMENT |
| LOW | apps/event-engine/src/common/feeds/images.feed.ts | 958 | // Step 2: Existence checking (feature-flagged) | COMMENT |
| LOW | apps/event-engine/src/common/feeds/images.feed.ts | 1126 | // Step 6: Transform to output format (matches getAllImagesIndex) | COMMENT |
| LOW | apps/event-engine/src/common/feeds/images.feed.ts | 1252 | // Step 7: Track seen images | COMMENT |
| LOW | apps/event-engine/src/common/services/metrics.ts | 61 | // Step 1: Lookup all IDs in Redis using Promise.all | COMMENT |
| LOW | apps/event-engine/src/common/services/metrics.ts | 89 | // Step 2: Process cache results | COMMENT |
| LOW | apps/event-engine/src/common/services/metrics.ts | 119 | // Step 3: Slide TTLs for hot cache entries | COMMENT |
| LOW | apps/event-engine/src/common/services/metrics.ts | 131 | // Step 4: Handle cache misses with lock mechanism to prevent stampedes | COMMENT |
| LOW | apps/event-engine/src/common/caches/base.ts | 51 | // Step 1: Lookup all IDs in Redis | COMMENT |
| LOW | apps/event-engine/src/common/caches/base.ts | 62 | // Step 2: Process cache results | COMMENT |
| LOW⚡ | apps/event-engine/src/common/caches/base.ts | 127 | // Step 3: Slide TTLs for hot cache entries | COMMENT |
| LOW⚡ | apps/event-engine/src/common/caches/base.ts | 136 | // Step 4: Handle stale entries with revalidation locks | COMMENT |
| LOW | apps/event-engine/src/common/caches/base.ts | 160 | // Step 5: Handle cache misses with lock mechanism to prevent stampedes | COMMENT |
| LOW | src/server/jobs/new-order-jobs.ts | 62 | // Step 1: Grant buzz for judgments from 3 days ago | COMMENT |
| LOW | src/server/jobs/new-order-jobs.ts | 134 | // Step 2: Reconcile stale blessedBuzz counters for inactive users | COMMENT |
| LOW⚡ | src/server/jobs/new-order-jobs.ts | 228 | // Step 1: Batch fetch all counters efficiently (checks cache first, then batched DB queries) | COMMENT |
| LOW⚡ | src/server/jobs/new-order-jobs.ts | 236 | // Step 2: Build player stats from the batch-fetched data | COMMENT |
| LOW | src/server/jobs/new-order-jobs.ts | 255 | // Step 3: Update Redis fervor counter for players whose fervor changed | COMMENT |
| LOW | src/server/jobs/new-order-jobs.ts | 276 | // Step 4: Bulk update PostgreSQL with exp and recalculated fervor | COMMENT |
| LOW | src/server/jobs/new-order-jobs.ts | 293 | // Step 5: Clear rated images cache for all players in this batch | COMMENT |
| LOW | src/server/jobs/remove-old-drafts.ts | 11 | // Step 1: Query replica (dbRead) for model IDs to delete | COMMENT |
| LOW | src/server/jobs/remove-old-drafts.ts | 30 | // Step 2: Delete in batches using dbWrite to minimize lock duration | COMMENT |
| LOW | src/server/jobs/push-discord-metadata.ts | 10 | // Step 1: Get userIds with recent images and their last image date from ClickHouse (fast) | COMMENT |
| LOW | src/server/jobs/push-discord-metadata.ts | 24 | // Step 2: Get userIds with recent model activity and their last upload date from Postgres (fast) | COMMENT |
| LOW⚡ | src/server/jobs/push-discord-metadata.ts | 36 | // Step 3: Combine unique userIds | COMMENT |
| LOW⚡ | src/server/jobs/push-discord-metadata.ts | 44 | // Step 4: Get Discord metadata for active users (uses partial index on Account) | COMMENT |
| LOW | src/server/jobs/push-discord-metadata.ts | 64 | // Step 5: Enrich with activity dates and push to Discord | COMMENT |
| LOW | src/server/services/bountyEntry.service.ts | 583 | // TODO: Once we support Tipping entries - we need to check if a tipConnection is created | COMMENT |
| LOW⚡ | …erver/services/orchestrator/__tests__/step-ref.test.ts | 238 | // Step 0: txt2img — outputs images | COMMENT |
| LOW⚡ | …erver/services/orchestrator/__tests__/step-ref.test.ts | 239 | // Step 1: hires-fix — takes image input from step 0, outputs images | COMMENT |
| LOW⚡ | …erver/services/orchestrator/__tests__/step-ref.test.ts | 240 | // Step 2: face-fix — takes image input from step 1, outputs images | COMMENT |
| LOW⚡ | …erver/services/orchestrator/__tests__/step-ref.test.ts | 280 | // Step 0: txt2img — outputs images | COMMENT |
| LOW⚡ | …erver/services/orchestrator/__tests__/step-ref.test.ts | 281 | // Step 1: img2vid — takes image input from step 0, outputs video | COMMENT |
| LOW⚡ | …erver/services/orchestrator/__tests__/step-ref.test.ts | 313 | // Step 0: text-to-image generation | COMMENT |
| LOW⚡ | …erver/services/orchestrator/__tests__/step-ref.test.ts | 320 | // Step 1: face-fix referencing step 0's output | COMMENT |
| LOW | …/services/orchestrator/ecosystems/ace-audio.handler.ts | 118 | // Step 3: aceStepAudio — the actual generation. Mode-specific fields are | COMMENT |
| LOW | src/components/generation_v2/GenerationFormProvider.tsx | 735 | // Step 1: Switch workflow and ecosystem so the graph restores stored | COMMENT |
| 20 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | tests/preview-engagement.spec.ts | 72 | // `?? null` collapses null/undefined alike so the assertion is robust to the | COMMENT |
| MEDIUM | .github/workflows/schema-drift.yml | 84 | # harness can observe an annotation under `-e`. | COMMENT |
| MEDIUM | apps/auth/src/lib/server/auth/session-shape.ts | 8 | // of the rest of the blob. PARITY NOTE: this is intentionally more robust than getSessionUser — for the (rare) | COMMENT |
| MEDIUM | apps/auth/src/lib/server/auth/verifier.ts | 6 | // no self-HTTP-fetch to its own JWKS endpoint — robust even if ORIGIN/the route is misconfigured. | COMMENT |
| MEDIUM | apps/auth/src/lib/server/auth/device.ts | 26 | // "seamless switch-back" / re-auth window (a security/UX knob), not a capacity lever. | COMMENT |
| MEDIUM | apps/auth/src/lib/server/auth/__tests__/device.test.ts | 283 | // Backdate account 100 to just past the idle window (TTL + 1 day) — robust to the TTL value. | COMMENT |
| MEDIUM | apps/auth/src/routes/logout/+server.ts | 62 | // Clear the hub's `.civitai.com` session AND device cookies (the seamless-switch account set must not survive | COMMENT |
| MEDIUM | src/server/metrics/app-block-runtime.metrics.ts | 411 | // registry (never client input). Today that spans e.g. seamless-pano-360's engines | COMMENT |
| MEDIUM | src/server/metrics/__tests__/appListing.metrics.test.ts | 86 | // Normalize whitespace so the assertions are robust to formatting. | COMMENT |
| MEDIUM | src/server/auth/__tests__/logout-cookies.test.ts | 3 | // Regression for finding M2: main-app logout must clear the device cookie (`civ-device`) that gates seamless | COMMENT |
| MEDIUM | src/server/jobs/purge-review-snapshots.ts | 139 | // idempotent re-delete. What this is NOT robust against is a future BULK write | COMMENT |
| MEDIUM | src/server/jobs/__tests__/process-vault-items.test.ts | 81 | // lease guard. Small helpers keep the assertions robust to ordering. | COMMENT |
| MEDIUM | src/server/games/daily-challenge/challenge-ladder.ts | 197 | // opening bout — the highest-leverage comparison of a binary search, and the only one every | COMMENT |
| MEDIUM | …mes/daily-challenge/__tests__/challenge-ladder.test.ts | 337 | // its OPENING bout — the one comparison every search makes, and the highest-leverage one. | COMMENT |
| MEDIUM | …services/blocks/__tests__/inline-comfy.service.test.ts | 370 | // These are copied verbatim from `recipes/seamless-pano.recipe.ts` — note | COMMENT |
| MEDIUM⚡ | …ervices/blocks/recipes/starter-comfy-txt2img.recipe.ts | 21 | // (seamless-pano-360, future ones) do things `kind:textToImage` cannot; this one | COMMENT |
| MEDIUM⚡ | …ervices/blocks/recipes/starter-comfy-txt2img.recipe.ts | 25 | // Z-Image diffusion/clip/vae AIRs seamless-pano reuses) — no `loras`, no | COMMENT |
| MEDIUM | …ervices/blocks/recipes/starter-comfy-txt2img.recipe.ts | 80 | // 90 matches the lowest per-engine ceiling already shipped by seamless-pano | COMMENT |
| MEDIUM⚡ | …ervices/blocks/recipes/starter-comfy-txt2img.recipe.ts | 96 | // (pinned policy). Mirrors seamless-pano's schema MINUS the engine axis. The | COMMENT |
| MEDIUM⚡ | …server/services/blocks/recipes/seamless-pano.recipe.ts | 7 | // seamless-pano-360 — recipe #1 for the App Blocks `customComfy` bridge. | COMMENT |
| MEDIUM⚡ | …server/services/blocks/recipes/seamless-pano.recipe.ts | 12 | // The iframe never sends a graph; it sends `{ recipe:'seamless-pano-360', params }` | COMMENT |
| MEDIUM | src/server/services/blocks/recipes/index.ts | 90 | // v1 (`seamless-pano-360`): the pinned 360Redmond LoRA versions (model 118025) are | COMMENT |
| MEDIUM | src/server/services/blocks/recipes/index.ts | 102 | // import time, before any request context). A robust router-side early-access / | COMMENT |
| MEDIUM | …/orchestrator/__tests__/submitWorkflow.timeout.test.ts | 160 | // Keep this case so the fix is robust to BOTH client behaviors (resolve AND throw). | COMMENT |
| MEDIUM | src/components/CivitaiWrapped/AccountProvider.tsx | 27 | needsLogin?: boolean; // aged out of the seamless-switch window → clicking re-authenticates at the hub | CODE |
| MEDIUM | src/components/CivitaiWrapped/AccountProvider.tsx | 58 | // Switch by userId: seamless device switch if fresh in the set, legacy-token redeem if mid-migration, else | COMMENT |
| MEDIUM | src/components/CivitaiWrapped/AccountProvider.tsx | 115 | // Legacy token store — read for seamless migration only. | COMMENT |
| MEDIUM⚡ | src/components/CivitaiWrapped/AccountProvider.tsx | 277 | // 1. Fresh in the device set → seamless switch (the hub mints a fresh civ-token; the proxy sets it). | COMMENT |
| MEDIUM⚡ | src/components/CivitaiWrapped/AccountProvider.tsx | 283 | // 2. Not seamlessly switchable (aged out of the device set, or a legacy account whose seamless next-auth | COMMENT |
| MEDIUM⚡ | src/components/CivitaiWrapped/AccountProvider.tsx | 289 | // device set. Best-effort; we refetch the seamless set afterward. | COMMENT |
| MEDIUM | src/components/Sticker/StickerPlacementOverlay.tsx | 640 | // `w-max` is load-bearing, not tidying. Absolutely positioned | COMMENT |
| MEDIUM | src/components/AppBlocks/iframeInitController.ts | 25 | // robust to BOTH the missed-load race AND posting before the block's message | COMMENT |
| MEDIUM | src/components/Apps/AppListingCard.browser.test.tsx | 524 | // Absolutely filling the box — NOT a percentage height, which would have to | COMMENT |
| MEDIUM | src/components/Apps/AppListingCard.tsx | 148 | // Absolutely filling the ratio box, NOT `h="100%"`: a percentage | COMMENT |
| MEDIUM | src/components/AppLayout/AppHeader/UserMenu.tsx | 309 | // Aged out of the seamless-switch window — clicking re-authenticates at the hub. | COMMENT |
| MEDIUM | src/hooks/hidden-preferences/useHiddenPreferences.ts | 16 | // `.map(...)`. This makes THIS bundle (and any later one) robust to either | COMMENT |
| MEDIUM | src/pages/api/v1/blocks/submit-version.ts | 187 | // identity. Switching here to `user:${user.id}` would be the more robust limit; | COMMENT |
| MEDIUM | src/pages/api/auth/logout.ts | 19 | // gates seamless multi-account switching (HttpOnly, so the client can't clear it; on a shared machine the | COMMENT |
| MEDIUM | src/pages/api/auth/logout.ts | 55 | // (in particular the device cookie that gates seamless switching) are unit-testable without an HTTP round-trip. | COMMENT |
| MEDIUM | src/pages/api/auth/logout.ts | 70 | // it would let the seamless-switch account set survive logout on a shared machine. Clear BOTH prefixes. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | .claude/agents/design-mockup.md | 114 | <img src="https://picsum.photos/seed/aiart[number]/400/500" alt="AI generated art"> | CODE |
| HIGH⚡ | …derator-app/retool-exports/raw/bulk-image-manager.json | 1 | {"uuid":"57fd8fb4-51ac-11ee-a0dd-9f0a271c8c9b","page":{"id":510420824,"data":{"appState":"[\"~#iR\",[\"^ \",\"n\",\"appT | CODE |
| HIGH⚡ | …derator-app/retool-exports/raw/bulk-image-manager.json | 1 | {"uuid":"57fd8fb4-51ac-11ee-a0dd-9f0a271c8c9b","page":{"id":510420824,"data":{"appState":"[\"~#iR\",[\"^ \",\"n\",\"appT | CODE |
| HIGH⚡ | docs/moderator-app/retool-exports/raw/user-reports.json | 1 | {"uuid":"a7fbd3e4-46ee-11ef-addd-8b299ca80778","page":{"id":510420693,"data":{"appState":"[\"~#iR\",[\"^ \",\"n\",\"appT | CODE |
| HIGH⚡ | docs/moderator-app/retool-exports/raw/user-reports.json | 1 | {"uuid":"a7fbd3e4-46ee-11ef-addd-8b299ca80778","page":{"id":510420693,"data":{"appState":"[\"~#iR\",[\"^ \",\"n\",\"appT | CODE |
| HIGH | docs/features/referral-program-review.md | 93 | - Single auto-generated code per user | CODE |
| HIGH | docs/features/referral-program-review.md | 240 | - [ ] Hit `/user/referrals` — dashboard renders with your auto-generated code | CODE |
| HIGH | docs/features/referral-program.md | 395 | 7. **@ai:** Should we allow users to generate multiple codes (current cap: 3) or collapse to a single code per user for | CODE |
| HIGH | docs/features/referral-program.md | 407 | 10. **@ai:** Custom codes admin UX: for v1, manual DB insert (or mod-actions script) is fine? Or do you want a simple ad | CODE |
| HIGH | src/static-content/art-and-ai.md | 24 | The above statement was written by ChatGPT, but is no less true because of it, just like how art generated by AI is no l | CODE |
| HIGH | src/static-content/au-region-block.md | 8 | This is due to Australia's [Age-Restricted Material Codes](https://www.esafety.gov.au/about-us/industry-regulation/socia | CODE |
| HIGH | src/server/jobs/scan-files.ts | 140 | // Mark batch as requested upfront so overlapping runs won't re-process | COMMENT |
| HIGH | src/server/services/article.service.ts | 969 | // Mark scan as requested after successfully linking images | COMMENT |
| HIGH | …c/components/Post/EditV2/PostImageCards/AddedImage.tsx | 753 | We couldn’t confirm that this image was generated by AI. To resolve this, | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH⚡ | scripts/mutation/listing-problems-kind.mutation.py | 85 | "problems.push({ code: 'empty-tagline', label: text['empty-tagline'], severity: 'advisory' });", | CODE |
| HIGH⚡ | scripts/mutation/listing-problems-kind.mutation.py | 86 | "problems.push({ code: 'empty-tagline', label: text['empty-description'], severity: 'advisory' });", | CODE |
| HIGH⚡ | scripts/mutation/listing-problems-kind.mutation.py | 90 | " if (isEmpty(listing.category))\n problems.push({ code: 'empty-category', label: text['empty-category'], sever | CODE |
| HIGH⚡ | scripts/mutation/listing-problems-kind.mutation.py | 91 | " if (isEmpty(listing.category))\n problems.push({ code: 'empty-category', label: TEXT_PROBLEM.offsite['empty-c | CODE |
| HIGH⚡ | scripts/mutation/listing-problems-kind.mutation.py | 95 | " kind,\n iconId: r.iconId ?? null,", | CODE |
| HIGH⚡ | scripts/mutation/listing-problems-kind.mutation.py | 96 | " kind: 'offsite' as typeof kind,\n iconId: r.iconId ?? null,", | CODE |
| HIGH⚡ | scripts/mutation/listing-problems-kind.mutation.py | 100 | " kind,\n iconId: r.iconId ?? null,", | CODE |
| HIGH⚡ | scripts/mutation/listing-problems-kind.mutation.py | 101 | " kind: 'onsite' as typeof kind,\n iconId: r.iconId ?? null,", | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | .claude/agents/design-mockup.md | 109 | <img src="https://picsum.photos/seed/[unique-seed]/400/500" alt="placeholder"> | CODE |
| LOW | .claude/skills/freshdesk/SKILL.md | 121 | node .claude/skills/freshdesk/query.mjs search "email:'user@example.com'" | CODE |
| LOW | .claude/skills/freshdesk/SKILL.md | 274 | | `"email:'user@example.com'"` | By requester email | | CODE |
| LOW | .claude/skills/freshdesk/SKILL.md | 435 | SELECT id, username, email, "bannedAt", "muted", "createdAt" FROM "User" WHERE email = 'user@example.com'; | CODE |
| LOW | .claude/skills/stripe/SKILL.md | 25 | node "$SKILL_DIR/query.mjs" search "email:'user@example.com'" | CODE |
| LOW | docs/features/account-switching.md | 157 | email: "user@example.com", | CODE |
| LOW | packages/civitai-db-schema/prisma/seed.ts | 33 | 'Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna a | CODE |
| LOW | packages/civitai-db-schema/prisma/seed.ts | 33 | 'Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna a | CODE |
| LOW | apps/moderator/src/lib/components/ImageQueueGrid.svelte | 105 | <div class="placeholder">{empty}</div> | CODE |
| LOW | apps/moderator/src/routes/page-visits/+page.svelte | 20 | <div class="placeholder">No page visits recorded yet.</div> | CODE |
| LOW | …ps/moderator/src/routes/page-visits/route/+page.svelte | 23 | <div class="placeholder">No visits to this route in the window.</div> | CODE |
| LOW | apps/moderator/src/routes/comics-review/+page.svelte | 91 | <div class="placeholder">No comic panels awaiting review.</div> | CODE |
| LOW | …moderator/src/routes/articles/unpublished/+page.svelte | 96 | <div class="placeholder">No unpublished articles match this view.</div> | CODE |
| LOW | apps/moderator/src/routes/articles/ratings/+page.svelte | 102 | <div class="placeholder">No reviews in this bucket.</div> | CODE |
| LOW | apps/moderator/src/routes/cosmetics/grant/+page.svelte | 234 | <div class="placeholder">No cosmetics match this view.</div> | CODE |
| LOW | …tor/src/routes/audit/scanner-audit/[mode]/+page.svelte | 174 | <div class="placeholder">No {data.view} decisions match the current filters in the last 30 days.</div> | CODE |
| LOW | apps/moderator/src/routes/users/+page.svelte | 6 | <div class="placeholder">Not built yet.</div> | CODE |
| LOW | …ps/creator-studio/src/routes/(app)/models/+page.svelte | 737 | <div class="placeholder"> | CODE |
| LOW | …/creator-studio/src/routes/(app)/earnings/+page.svelte | 269 | <div class="placeholder">Earnings are temporarily unavailable — please try again shortly.</div> | CODE |
| LOW | …creator-studio/src/routes/(app)/analytics/+page.svelte | 208 | <div class="placeholder">Analytics are temporarily unavailable — please try again shortly.</div> | CODE |
| LOW | …creator-studio/src/routes/(app)/analytics/+page.svelte | 210 | <div class="placeholder"> | CODE |
| LOW | …studio/src/routes/(app)/analytics/content/+page.svelte | 204 | <div class="placeholder"> | CODE |
| LOW | …studio/src/routes/(app)/analytics/content/+page.svelte | 208 | <div class="placeholder"> | CODE |
| LOW | …io/src/routes/(app)/analytics/base-models/+page.svelte | 340 | <div class="placeholder"> | CODE |
| LOW | …-studio/src/routes/(app)/analytics/models/+page.svelte | 476 | <div class="placeholder"> | CODE |
| LOW | …c/routes/(app)/analytics/models/[modelId]/+page.svelte | 328 | <div class="placeholder">This model has no versions.</div> | CODE |
| LOW | …dio/src/routes/(app)/analytics/engagement/+page.svelte | 46 | <div class="placeholder">Engagement is temporarily unavailable — please try again shortly.</div> | CODE |
| LOW | …tudio/src/routes/(app)/analytics/audience/+page.svelte | 101 | <div class="placeholder"> | CODE |
| LOW | src/server/common/constants.ts | 21 | Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliq | CODE |
| LOW | src/server/common/constants.ts | 21 | Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliq | CODE |
| LOW | src/server/email/templates/trainingFail.email.ts | 99 | email: 'test@test.com', | CODE |
| LOW | src/server/email/templates/strikeIssued.email.ts | 188 | to: 'test@test.com', | CODE |
| LOW | …server/email/templates/stuckCryptoDepositUser.email.ts | 88 | userEmail: 'user@example.com', | CODE |
| LOW | src/server/email/templates/trainingComplete.email.ts | 97 | email: 'test@test.com', | CODE |
| LOW | …r/email/templates/moderation/moderationAction.email.ts | 175 | to: 'test@test.com', | CODE |
| LOW | …il/templates/moderation/moderationAction.email.test.ts | 62 | to: 'user@example.com', | CODE |
| LOW | …il/templates/moderation/moderationAction.email.test.ts | 152 | to: 'user@example.com', | CODE |
| LOW | src/utils/faro/__tests__/redact.test.ts | 59 | expect(out).not.toContain('user@example.com'); | CODE |
| LOW | src/utils/faro/__tests__/redact.test.ts | 150 | nested: ['plain', 'reach me at eve@example.org'], | CODE |
| LOW | …/AppListingsMarketplaceBody.hydration.browser.test.tsx | 162 | el.getAttribute('placeholder') ?? '', | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | apps/event-engine/README.md | 278 | MEILISEARCH_API_KEY=your-api-key | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | scripts/nix/check-prisma-pin.py | 30 | CODE | |
| LOW | scripts/nix/check-node-pin.py | 35 | CODE | |
| LOW | scripts/mutation/listing-problems-kind.mutation.py | 29 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | .claude/skills/deploy-status/deploy-chain.sh | 17 | # Usage: | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | src/components/Search/parsers/base.ts | 36 | // TODO: implement Model3D search parser | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | scripts/mutation/listing-problems-kind.mutation.py | 152 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | src/store/post-image-transmitter.store.ts | 87 | async function getData(url: string, options?: { allowExternalUrl?: boolean }) { | CODE |