1.8

Adjusted Signal

1.8

Raw Pattern Score

100%

Time Factor

2026-10-31

Last Push

46.5K

Stars

TypeScript

Language

2.2M

Lines of Code

7.0K

Files

3.3K

Pattern Hits

2026-10-31

Scan Date

0.00

HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 6.7/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 2918 finding(s).

Hallucinated Dependency & Supply Chain Risk 1.3/100 · LOW

Are imports declared and package/API names verified? 308 finding(s).

Agent Over-Engineering Ratio 6.3/100 · LOW

Are wrappers, guards, and repeated structures necessary? 2689 finding(s).

PR Review Velocity Impact 8.3/100 · LOW

Which changes need focused human review? 3294 finding(s).

What These Metrics Mean

Adjusted Signal: Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score: Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor: A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits: Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate: High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files: Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 33HIGH 0MEDIUM 90LOW 3171

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 3294 distinct pattern matches across 13 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Hyper-Verbose Identifiers2621 hits · 2618 pts

Severity	File	Line	Snippet	Context
LOW	config/migrate-orphaned-agent-files.js	28	async function migrateOrphanedAgentFiles({ dryRun = true, batchSize = 100 } = {}) {	CODE
LOW	config/create-error-convo.js	478	function assertCatalogueIsComplete() {	CODE
LOW	config/migrate-code-file-duplicates.js	72	async function migrateCodeFileDuplicates({ dryRun = true, batchSize = 100 } = {}) {	CODE
LOW	config/migrate-agent-permissions.js	23	async function migrateAgentPermissionsEnhanced({ dryRun = true, batchSize = 100 } = {}) {	CODE
LOW	config/migrate-prompt-permissions.js	16	async function getGlobalProjectPromptGroupIds(db) {	CODE
LOW	config/migrate-prompt-permissions.js	23	async function migrateToPromptGroupPermissions({ dryRun = true, batchSize = 100 } = {}) {	CODE
LOW	config/migrate-shared-link-permissions.js	21	async function migrateSharedLinkPermissions({	CODE
LOW	utils/update_env.py	42	def update_env_file_with_local_env(input_file_path, output_file_path):	CODE
LOW	packages/data-schemas/src/tenant/conformance.ts	77	export function describeTenantIsolationConformance(harness: TenantEngineHarness): void {	CODE
LOW	packages/data-schemas/src/tenant/policy.ts	58	export function warnOnInvalidStrictSetting(): void {	CODE
LOW	packages/data-schemas/src/tenant/harness.ts	26	export function createMongooseTenantHarness(engine: MongooseTenantEngine): TenantEngineHarness {	CODE
LOW	packages/data-schemas/src/types/compaction.ts	54	function isValidCompactionSemanticIndexEntry(	CODE
LOW	packages/data-schemas/src/types/compaction.ts	87	export function isCompactionSemanticIndexProjection(	CODE
LOW	packages/data-schemas/src/methods/queuedTurn.ts	182	function getRootLineagePredecessorId(parentMessageId: string): string {	CODE
LOW	packages/data-schemas/src/methods/queuedTurn.ts	188	function isRootLineagePredecessorId(lineagePredecessorId: string): boolean {	CODE
LOW	packages/data-schemas/src/methods/queuedTurn.ts	521	function normalizeReasoningOverride(	CODE
LOW	packages/data-schemas/src/methods/queuedTurn.ts	728	export function createAgentQueuedTurnMethods(	CODE
LOW	packages/data-schemas/src/methods/queuedTurn.ts	763	async function quarantineDuplicateAdmissionLanes(): Promise<number> {	CODE
LOW	packages/data-schemas/src/methods/queuedTurn.ts	850	async function ensureAgentQueuedTurnIndexes(): Promise<void> {	CODE
LOW	packages/data-schemas/src/methods/queuedTurn.ts	1073	async function finalizeVisibleReservation(	CODE
LOW	packages/data-schemas/src/methods/queuedTurn.ts	1209	async function listActiveAgentQueuedTurns(	CODE
LOW	packages/data-schemas/src/methods/queuedTurn.ts	1227	async function ensureEffectiveAdmissionBoundary(	CODE
LOW	packages/data-schemas/src/methods/queuedTurn.ts	1299	async function listAgentQueuedTurnReceipts(	CODE
LOW	packages/data-schemas/src/methods/queuedTurn.ts	1346	async function getAgentQueuedTurnByClientRequestId(	CODE
LOW	packages/data-schemas/src/methods/queuedTurn.ts	1424	async function findQueuedTurnsNeedingDelivery(	CODE
LOW	packages/data-schemas/src/methods/queuedTurn.ts	1505	async function claimQueuedTurnsForAdmissionReconciliation(	CODE
LOW	packages/data-schemas/src/methods/queuedTurn.ts	1589	async function deferAgentQueuedTurnAdmissionReconciliation(	CODE
LOW	packages/data-schemas/src/methods/queuedTurn.ts	1623	async function reserveAgentQueuedTurnDelivery(	CODE
LOW	packages/data-schemas/src/methods/queuedTurn.ts	1954	async function beginAgentQueuedTurnAdmission(	CODE
LOW	packages/data-schemas/src/methods/queuedTurn.ts	2194	async function markAgentQueuedTurnAdmitted(	CODE
LOW	packages/data-schemas/src/methods/queuedTurn.ts	2301	async function hasAgentQueuedTurnAdmissionReceipt(	CODE
LOW	packages/data-schemas/src/methods/queuedTurn.ts	2336	async function deadLetterAgentQueuedTurn(	CODE
LOW	packages/data-schemas/src/methods/queuedTurn.ts	2577	async function getEffectiveAgentQueuedTurnPredecessor(	CODE
LOW	packages/data-schemas/src/methods/queuedTurn.ts	2762	async function prepareAgentQueuedTurnConversationDeletion(input: {	CODE
LOW	packages/data-schemas/src/methods/queuedTurn.ts	2837	async function deletePreparedAgentQueuedTurnConversations(input: {	CODE
LOW	packages/data-schemas/src/methods/queuedTurn.ts	2861	async function markAgentQueuedTurnDeliveryRetired(input: {	CODE
LOW	packages/data-schemas/src/methods/queuedTurn.ts	2885	async function beginAgentQueuedTurnMissingDeliveryRetirement(input: {	CODE
LOW	packages/data-schemas/src/methods/queuedTurn.ts	2912	async function markAgentQueuedTurnMissingDeliveryRetired(input: {	CODE
LOW	packages/data-schemas/src/methods/queuedTurn.ts	2936	async function deleteAllAgentQueuedTurnsForUser(input: {	CODE
LOW	packages/data-schemas/src/methods/systemGrant.ts	230	async function hasCapabilityForPrincipals({	CODE
LOW	packages/data-schemas/src/methods/systemGrant.ts	443	async function getCapabilitiesForPrincipal({	CODE
LOW	packages/data-schemas/src/methods/systemGrant.ts	500	async function getCapabilitiesForPrincipals({	CODE
LOW	packages/data-schemas/src/methods/mcpAuthority.ts	267	export function createMCPAuthorityBootRevision(	CODE
LOW	packages/data-schemas/src/methods/mcpAuthority.ts	293	export function createMCPAuthorityConfigSourceRevision(	CODE
LOW	packages/data-schemas/src/methods/mcpAuthority.ts	351	export function createMCPAuthorityDatabaseSourceRevision(server: {	CODE
LOW	packages/data-schemas/src/methods/mcpAuthority.ts	380	export function createMCPAuthorityCredentialRevision(	CODE
LOW	packages/data-schemas/src/methods/mcpAuthority.ts	430	function normalizeCredentialFields(	CODE
LOW	packages/data-schemas/src/methods/mcpAuthority.ts	461	function assertPreparedTargetBounds(targets: readonly PreparedTarget[]): void {	CODE
LOW	packages/data-schemas/src/methods/mcpAuthority.ts	1038	export function createMCPAuthorityMethods(	CODE
LOW	packages/data-schemas/src/methods/mcpAuthority.ts	1624	async function loadAuthoritativeSnapshot(	CODE
LOW	packages/data-schemas/src/methods/mcpAuthority.ts	1798	async function assertMCPAuthorityProofsCurrent(input: MCPAuthorityAssertInput): Promise<void> {	CODE
LOW	…ckages/data-schemas/src/methods/openidRefreshFlight.ts	33	export function createOpenIDRefreshFlightMethods(mongoose: typeof import('mongoose')): {	CODE
LOW	…ckages/data-schemas/src/methods/openidRefreshFlight.ts	73	async function acquireOpenIDRefreshFlight(	CODE
LOW	…ckages/data-schemas/src/methods/openidRefreshFlight.ts	144	async function completeOpenIDRefreshFlight(	CODE
LOW	…ckages/data-schemas/src/methods/openidRefreshFlight.ts	257	async function claimOpenIDRefreshFlightDelivery(	CODE
LOW	…ckages/data-schemas/src/methods/openidRefreshFlight.ts	304	async function releaseOpenIDRefreshFlightDelivery(	CODE
LOW	…ckages/data-schemas/src/methods/openidRefreshFlight.ts	378	async function revokeOpenIDRefreshFlight(	CODE
LOW	packages/data-schemas/src/methods/mcpServer.ts	42	function generateServerNameFromTitle(title: string): string {	CODE
LOW	packages/data-schemas/src/methods/mcpServer.ts	125	async function findNextAvailableServerName(	CODE
LOW	packages/data-schemas/src/methods/mcpServer.ts	227	async function findMCPServerByServerName(serverName: string): Promise<MCPServerDocument \| null> {	CODE
2561 more matches not shown…

Hallucination Indicators33 hits · 305 pts

Severity	File	Line	Snippet	Context
CRITICAL	packages/api/src/app/service.spec.ts	1290	const setCalls = deps._cache.set.mock.calls.filter(	CODE
CRITICAL	api/server/services/Endpoints/agents/initialize.spec.js	1428	req.config.endpoints.agents.capabilities.push('run_in_background');	CODE
CRITICAL	api/server/services/Endpoints/agents/initialize.spec.js	1511	initialReq.config.endpoints.agents.capabilities.push('run_in_background');	CODE
CRITICAL	api/server/services/Endpoints/agents/initialize.spec.js	1523	changedReq.config.endpoints.agents.capabilities.push('run_in_background');	CODE
CRITICAL	api/server/services/Endpoints/agents/initialize.spec.js	1551	req.config.endpoints.agents.capabilities.push('run_in_background');	CODE
CRITICAL	api/server/services/Endpoints/agents/initialize.spec.js	1660	req.config.endpoints.agents.capabilities.push('tools');	CODE
CRITICAL	api/server/services/Endpoints/agents/initialize.spec.js	1697	req.config.endpoints.agents.capabilities.push('execute_code');	CODE
CRITICAL	api/server/services/Endpoints/agents/initialize.spec.js	1816	req.config.endpoints.agents.capabilities.push('tools');	CODE
CRITICAL	api/server/services/Endpoints/agents/initialize.spec.js	1867	req.config.endpoints.agents.capabilities.push('tools');	CODE
CRITICAL	api/server/services/Endpoints/agents/initialize.spec.js	1933	req.config.endpoints.agents.capabilities.push('tools');	CODE
CRITICAL	api/server/services/Endpoints/agents/initialize.spec.js	1976	if (enabled) req.config.endpoints.agents.capabilities.push('tools');	CODE
CRITICAL	api/server/services/Endpoints/agents/initialize.spec.js	2012	req.config.endpoints.agents.capabilities.push('tools');	CODE
CRITICAL	api/server/services/Endpoints/agents/initialize.spec.js	2052	req.config.endpoints.agents.capabilities.push('tools');	CODE
CRITICAL	api/server/services/Endpoints/agents/initialize.spec.js	2103	req.config.endpoints.agents.capabilities.push('tools');	CODE
CRITICAL	api/server/services/Endpoints/agents/initialize.spec.js	2146	req.config.endpoints.agents.capabilities.push('tools');	CODE
CRITICAL	api/server/services/Endpoints/agents/initialize.spec.js	2222	if (state !== 'disabled-skills') req.config.endpoints.agents.capabilities.push('skills');	CODE
CRITICAL	api/server/services/Endpoints/agents/initialize.spec.js	2223	if (state !== 'disabled-tools') req.config.endpoints.agents.capabilities.push('tools');	CODE
CRITICAL	api/server/services/Endpoints/agents/initialize.spec.js	2292	req.config.endpoints.agents.capabilities.push('skills');	CODE
CRITICAL	api/server/services/Endpoints/agents/initialize.spec.js	2320	eventReq.config.endpoints.agents.capabilities.push('skills');	CODE
CRITICAL	api/server/services/Endpoints/agents/initialize.spec.js	2400	req.config.endpoints.agents.capabilities.push('skills');	CODE
CRITICAL	api/server/services/Endpoints/agents/initialize.spec.js	2517	req.config.endpoints.agents.capabilities.push('execute_code', 'stateful_code_sessions');	CODE
CRITICAL	api/server/services/Endpoints/agents/initialize.spec.js	2561	req.config.endpoints.agents.capabilities.push('execute_code', 'stateful_code_sessions');	CODE
CRITICAL	api/server/services/Endpoints/agents/initialize.spec.js	2647	req.config.endpoints.agents.capabilities.push('execute_code', 'stateful_code_sessions');	CODE
CRITICAL	api/server/services/Endpoints/agents/initialize.spec.js	2735	req.config.endpoints.agents.capabilities.push('execute_code', 'stateful_code_sessions');	CODE
CRITICAL	api/server/services/Endpoints/agents/initialize.spec.js	2965	req.config.endpoints.agents.capabilities.push('execute_code', 'stateful_code_sessions');	CODE
CRITICAL	api/server/services/Endpoints/agents/initialize.spec.js	3932	req.config.endpoints.agents.capabilities.push('run_in_background');	CODE
CRITICAL	api/server/services/Endpoints/agents/initialize.spec.js	3998	req.config.endpoints.agents.capabilities.push(	CODE
CRITICAL	api/server/services/__tests__/ToolService.spec.js	3687	req.config.endpoints.agents.capabilities.push(AgentCapabilities.programmatic_tools);	CODE
CRITICAL	api/server/services/Threads/manage.js	488	promises.push(openai.beta.threads.runs.steps.list(run_id, { thread_id }));	CODE
CRITICAL	api/server/services/Runs/RunManager.js	94	// const { data: steps, first_id, last_id, has_more } = await openai.beta.threads.runs.steps.list(run_id, { thread_i	COMMENT
CRITICAL	api/server/services/Runs/RunManager.js	95	const { data: _steps } = await openai.beta.threads.runs.steps.list(	CODE
CRITICAL	api/server/services/Runs/StreamRunManager.js	172	const streamRun = this.openai.beta.threads.runs.createAndStream(	CODE
CRITICAL	api/server/services/Runs/StreamRunManager.js	590	toolRun = this.openai.beta.threads.runs.submitToolOutputsStream(	CODE

Fake / Example Data274 hits · 276 pts

Severity	File	Line	Snippet	Context
LOW	packages/data-schemas/src/methods/prompt.spec.ts	143	email: 'admin@example.com',	CODE
LOW	packages/data-schemas/src/methods/user.methods.spec.ts	1833	{ name: 'John Doe', email: 'john@example.com', username: 'johnd', provider: 'local' },	CODE
LOW	packages/data-schemas/src/methods/user.methods.spec.ts	2162	email: 'user@example.com',	CODE
LOW	packages/data-schemas/src/methods/user.methods.spec.ts	2212	name: 'John Doe',	CODE
LOW	packages/data-schemas/src/methods/user.methods.spec.ts	2228	expect(found?.name).toBe('John Doe');	CODE
LOW	packages/data-schemas/src/methods/userGroup.spec.ts	1321	{ type: PrincipalType.USER, name: 'John Doe', email: 'jd@gmail.com', source: 'local' },	CODE
LOW	packages/data-schemas/src/methods/file.acl.spec.ts	84	email: 'user@example.com',	CODE
LOW	packages/data-schemas/src/methods/file.acl.spec.ts	234	email: 'user@example.com',	CODE
LOW	packages/data-schemas/src/methods/file.acl.spec.ts	297	email: 'user@example.com',	CODE
LOW	packages/data-schemas/src/methods/token.spec.ts	1227	expect(stored?.email).toBe('user@example.com');	CODE
LOW	packages/data-schemas/src/methods/token.spec.ts	1240	for (const lookup of ['User@Example.COM', 'user@example.com', 'USER@EXAMPLE.COM']) {	CODE
LOW	packages/data-schemas/src/methods/token.spec.ts	1260	const result = await methods.deleteTokens({ email: 'user@example.com' });	CODE
LOW	packages/data-schemas/src/config/parsers.spec.ts	807	nested: { 'k@example.org': 1, 'j@example.org': 2, other: 3 },	CODE
LOW	…s/data-schemas/src/models/plugins/searchTokens.spec.ts	64	emailTokens: ['jose.alvarez@example.org', 'jose', 'alvarez', 'example', 'org'],	CODE
LOW	packages/api/src/middleware/remoteAgentAuth.spec.ts	1460	expect(await captureEmailArg({ sub: 's1', email: 'user@example.com' })).toBe(	CODE
LOW	packages/api/src/middleware/remoteAgentAuth.spec.ts	1461	'user@example.com',	CODE
LOW	packages/api/src/middleware/remoteAgentAuth.spec.ts	1491	email: 'user@example.com',	CODE
LOW	packages/api/src/endpoints/models.spec.ts	183	const userObject = { id: 'user123', email: 'user@example.com' };	CODE
LOW	packages/api/src/endpoints/models.spec.ts	187	'X-User-Email': 'user@example.com',	CODE
LOW	packages/api/src/endpoints/models.spec.ts	209	'X-User-Email': 'user@example.com',	CODE
LOW	packages/api/src/endpoints/config/models.spec.ts	63	user: { id: 'user-1', email: 'user@example.com' },	CODE
LOW	packages/api/src/endpoints/config/models.spec.ts	100	user: { id: 'user-1', email: 'user@example.com' },	CODE
LOW	packages/api/src/endpoints/custom/initialize.spec.ts	380	user: { id: 'user-1', email: 'user@example.com', tenantId: overrides.tenantId },	CODE
LOW	packages/api/src/endpoints/custom/initialize.spec.ts	532	user: { id: 'user-1', email: 'user@example.com' },	CODE
LOW	packages/api/src/endpoints/custom/initialize.spec.ts	617	user: { id: 'user-1', email: 'user@example.com' },	CODE
LOW	packages/api/src/auth/user.spec.ts	7	email: 'user@example.com',	CODE
LOW	packages/api/src/auth/domain.spec.ts	95	const email = 'user@example.com';	CODE
LOW	packages/api/src/auth/refresh.spec.ts	28	email: 'admin@example.com',	CODE
LOW	packages/api/src/auth/refresh.spec.ts	137	email: 'admin@example.com',	CODE
LOW	packages/api/src/auth/refresh.spec.ts	167	expect(result.user.email).toBe('admin@example.com');	CODE
LOW	packages/api/src/auth/refresh.spec.ts	641	'admin@example.com',	CODE
LOW	packages/api/src/auth/userDocCache.spec.ts	165	email: 'user@example.com',	CODE
LOW	packages/api/src/auth/userDocCache.spec.ts	181	email: 'user@example.com',	CODE
LOW	packages/api/src/auth/userDocCache.spec.ts	222	email: 'user@example.com',	CODE
LOW	packages/api/src/auth/userDocCache.spec.ts	248	email: 'user@example.com',	CODE
LOW	packages/api/src/auth/userDocCache.spec.ts	257	email: 'user@example.com',	CODE
LOW	packages/api/src/auth/userDocCache.spec.ts	315	const user = { _id: userId, email: 'user@example.com' };	CODE
LOW	packages/api/src/auth/userDocCache.spec.ts	354	{ _id: userId, email: 'user@example.com' },	CODE
LOW	packages/api/src/auth/userDocCache.spec.ts	367	{ _id: userId, email: 'user@example.com' },	CODE
LOW	packages/api/src/auth/googleRefresh.spec.ts	25	email: 'admin@example.com',	CODE
LOW	packages/api/src/auth/googleRefresh.spec.ts	102	email: 'admin@example.com',	CODE
LOW⚡	packages/api/src/auth/passwordReset.spec.ts	10	updateUser: jest.fn().mockResolvedValue({ email: 'user@example.com' }),	CODE
LOW⚡	packages/api/src/auth/passwordReset.spec.ts	19	return { token: RESET_HASH, email: 'user@example.com', type: 'password_reset', ...overrides };	CODE
LOW⚡	packages/api/src/auth/passwordReset.spec.ts	27	return { _id: 'user-reset', email: 'user@example.com', ...overrides };	CODE
LOW	packages/api/src/auth/passwordReset.spec.ts	88	{ email: 'user@example.com' },	CODE
LOW	packages/api/src/auth/exchange.spec.ts	28	email: 'admin@example.com',	CODE
LOW	packages/api/src/auth/exchange.spec.ts	53	expect(result!.user.email).toBe('admin@example.com');	CODE
LOW	packages/api/src/auth/passkey.spec.ts	45	const user = { id: '65f0000000000000000000aa', email: 'user@example.com', name: 'Ada' };	CODE
LOW⚡	packages/api/src/auth/openid.spec.ts	319	email: 'user@example.com',	CODE
LOW⚡	packages/api/src/auth/openid.spec.ts	329	email: 'user@example.com',	CODE
LOW⚡	packages/api/src/auth/openid.spec.ts	337	email: 'user@example.com',	CODE
LOW⚡	packages/api/src/auth/openid.spec.ts	706	email: 'user@example.com',	CODE
LOW⚡	packages/api/src/auth/openid.spec.ts	711	expect(mockFindUser).toHaveBeenCalledWith({ email: 'user@example.com' });	CODE
LOW⚡	packages/api/src/auth/openid.spec.ts	720	email: 'user@example.com',	CODE
LOW⚡	packages/api/src/auth/openid.spec.ts	759	email: 'user@example.com',	CODE
LOW⚡	packages/api/src/auth/openid.spec.ts	768	email: 'user@example.com',	CODE
LOW⚡	packages/api/src/auth/openid.spec.ts	772	expect(mockFindUser).toHaveBeenCalledWith({ email: 'user@example.com' });	CODE
LOW⚡	packages/api/src/auth/openid.spec.ts	979	email: 'user@example.com',	CODE
LOW⚡	packages/api/src/auth/openid.spec.ts	988	expect(getOpenIdEmail({ email: 'user@example.com' }, 'remoteAgentAuth')).toBe(	CODE
LOW⚡	packages/api/src/auth/openid.spec.ts	989	'user@example.com',	CODE
214 more matches not shown…

Decorative Section Separators68 hits · 208 pts

Severity	File	Line	Snippet	Context
MEDIUM	librechat.example.yaml	1199	# # ============================================================================	COMMENT
MEDIUM	librechat.example.yaml	1202	# # ============================================================================	COMMENT
MEDIUM	config/test-subdirectory-setup.sh	2	# =============================================================================	COMMENT
MEDIUM	config/test-subdirectory-setup.sh	21	# =============================================================================	COMMENT
MEDIUM	…ta-schemas/misc/ferretdb/multiTenancy.ferretdb.spec.ts	166	// ─── PHASE 1: DATABASE-PER-ORG SCHEMA MAPPING ────────────────────────────	COMMENT
MEDIUM	…ta-schemas/misc/ferretdb/multiTenancy.ferretdb.spec.ts	231	// ─── PHASE 2: INDEX INITIALIZATION ────────────────────────────────────────	COMMENT
MEDIUM	…ta-schemas/misc/ferretdb/multiTenancy.ferretdb.spec.ts	328	// ─── PHASE 3: SCALING CURVE ───────────────────────────────────────────────	COMMENT
MEDIUM	…ta-schemas/misc/ferretdb/multiTenancy.ferretdb.spec.ts	458	// ─── PHASE 4: WRITE AMPLIFICATION ────────────────────────────────────────	COMMENT
MEDIUM	…ta-schemas/misc/ferretdb/multiTenancy.ferretdb.spec.ts	528	// ─── PHASE 5: SHARED-COLLECTION ALTERNATIVE ──────────────────────────────	COMMENT
MEDIUM	…s/data-schemas/misc/ferretdb/sharding.ferretdb.spec.ts	26	// ─── TYPES ──────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	…s/data-schemas/misc/ferretdb/sharding.ferretdb.spec.ts	46	// ─── TENANT ROUTER (INLINE POC) ────────────────────────────────────────────	COMMENT
MEDIUM	…s/data-schemas/misc/ferretdb/sharding.ferretdb.spec.ts	245	// ─── TESTS ──────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	…/data-schemas/misc/ferretdb/bulkWrite.ferretdb.spec.ts	106	// ─── FLOW 1: import — bulkSaveConvos + bulkSaveMessages ───────────────────	COMMENT
MEDIUM	…/data-schemas/misc/ferretdb/bulkWrite.ferretdb.spec.ts	258	// ─── FLOW 2: bulkWriteAclEntries ───────────────────────────────────────────	COMMENT
MEDIUM	…/data-schemas/misc/ferretdb/bulkWrite.ferretdb.spec.ts	365	// ─── FLOW 3: bulkIncrementTagCounts ────────────────────────────────────────	COMMENT
MEDIUM	…/data-schemas/misc/ferretdb/bulkWrite.ferretdb.spec.ts	416	// ─── FLOW 4: Transaction.insertMany (bulkInsertTransactions) ──────────────	COMMENT
MEDIUM	…/data-schemas/misc/ferretdb/bulkWrite.ferretdb.spec.ts	501	// ─── FLOW 5: file-TTL bulkWrite (extendFilesTTL) ───────────────────────────	COMMENT
MEDIUM	…a-schemas/misc/ferretdb/orgOperations.ferretdb.spec.ts	66	// ─── BACKUP/RESTORE UTILITIES ───────────────────────────────────────────────	COMMENT
MEDIUM	…a-schemas/misc/ferretdb/orgOperations.ferretdb.spec.ts	109	// ─── MIGRATION UTILITIES ────────────────────────────────────────────────────	COMMENT
MEDIUM	…a-schemas/misc/ferretdb/orgOperations.ferretdb.spec.ts	171	// ─── TESTS ──────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	…a-schemas/misc/ferretdb/orgOperations.ferretdb.spec.ts	192	// ─── RETRY UTILITY ──────────────────────────────────────────────────────	COMMENT
MEDIUM	…a-schemas/misc/ferretdb/orgOperations.ferretdb.spec.ts	280	// ─── REAL DEADLOCK RETRY ────────────────────────────────────────────────	COMMENT
MEDIUM	…a-schemas/misc/ferretdb/orgOperations.ferretdb.spec.ts	310	// ─── BACKUP/RESTORE ─────────────────────────────────────────────────────	COMMENT
MEDIUM	…a-schemas/misc/ferretdb/orgOperations.ferretdb.spec.ts	511	// ─── SCHEMA MIGRATION ──────────────────────────────────────────────────	COMMENT
MEDIUM	packages/api/src/app/service.ts	464	// ── Types ────────────────────────────────────────────────────────────	COMMENT
MEDIUM	packages/api/src/app/service.ts	601	// ── Helpers ──────────────────────────────────────────────────────────	COMMENT
MEDIUM	packages/api/src/app/service.ts	682	// ── Service factory ──────────────────────────────────────────────────	COMMENT
MEDIUM	packages/api/src/admin/config.handler.spec.ts	1982	// ── Invariant tests: rules that must hold across ALL handlers ──────	COMMENT
MEDIUM	packages/api/src/admin/config.ts	1015	// ── Validation helpers ───────────────────────────────────────────────	COMMENT
MEDIUM	packages/api/src/admin/config.ts	1827	// ── Change batches ───────────────────────────────────────────────────	COMMENT
MEDIUM	packages/api/src/admin/config.ts	2565	// ── Handler factory ──────────────────────────────────────────────────	COMMENT
MEDIUM	…/agents/responses/__tests__/responses-api.live.test.sh	23	# ── Helpers ───────────────────────────────────────────────────────────	COMMENT
MEDIUM	…/agents/responses/__tests__/responses-api.live.test.sh	80	# ── Test 1: Basic single-turn request ─────────────────────────────────	COMMENT
MEDIUM	…/agents/responses/__tests__/responses-api.live.test.sh	91	# ── Test 2: Multi-turn with output_text assistant blocks ──────────────	COMMENT
MEDIUM	…/agents/responses/__tests__/responses-api.live.test.sh	118	# ── Test 3: Multi-turn with refusal blocks ────────────────────────────	COMMENT
MEDIUM	…/agents/responses/__tests__/responses-api.live.test.sh	145	# ── Test 4: Streaming request ─────────────────────────────────────────	COMMENT
MEDIUM	…/agents/responses/__tests__/responses-api.live.test.sh	156	# ── Test 5: Back-and-forth using previous_response_id ─────────────────	COMMENT
MEDIUM	…/agents/responses/__tests__/responses-api.live.test.sh	185	# ── Summary ───────────────────────────────────────────────────────────	COMMENT
MEDIUM⚡	…ges/api/src/agents/responses/__tests__/service.test.ts	406	// ── String input shorthand ─────────────────────────────────────────	COMMENT
MEDIUM⚡	…ges/api/src/agents/responses/__tests__/service.test.ts	412	// ── Empty input array ──────────────────────────────────────────────	COMMENT
MEDIUM⚡	…ges/api/src/agents/responses/__tests__/service.test.ts	418	// ── Role mapping ───────────────────────────────────────────────────	COMMENT
MEDIUM	…ges/api/src/agents/responses/__tests__/service.test.ts	450	// ── input_text content blocks ──────────────────────────────────────	COMMENT
MEDIUM	…ges/api/src/agents/responses/__tests__/service.test.ts	463	// ── output_text content blocks (the original bug) ──────────────────	COMMENT
MEDIUM	…ges/api/src/agents/responses/__tests__/service.test.ts	478	// ── refusal content blocks ─────────────────────────────────────────	COMMENT
MEDIUM	…ges/api/src/agents/responses/__tests__/service.test.ts	493	// ── input_image content blocks ─────────────────────────────────────	COMMENT
MEDIUM	…ges/api/src/agents/responses/__tests__/service.test.ts	518	// ── input_file content blocks ──────────────────────────────────────	COMMENT
MEDIUM	…ges/api/src/agents/responses/__tests__/service.test.ts	547	// ── Null / undefined filtering ─────────────────────────────────────	COMMENT
MEDIUM	…ges/api/src/agents/responses/__tests__/service.test.ts	560	// ── Missing text field defaults to empty string ────────────────────	COMMENT
MEDIUM	…ges/api/src/agents/responses/__tests__/service.test.ts	597	// ── Unknown block types are filtered out ───────────────────────────	COMMENT
MEDIUM	…ges/api/src/agents/responses/__tests__/service.test.ts	613	// ── Mixed valid/invalid content in same array ──────────────────────	COMMENT
MEDIUM	…ges/api/src/agents/responses/__tests__/service.test.ts	639	// ── Non-array, non-string content defaults to empty string ─────────	COMMENT
MEDIUM	…ges/api/src/agents/responses/__tests__/service.test.ts	646	// ── Function call items ────────────────────────────────────────────	COMMENT
MEDIUM	…ges/api/src/agents/responses/__tests__/service.test.ts	720	// ── Item references are skipped ────────────────────────────────────	COMMENT
MEDIUM	…ges/api/src/agents/responses/__tests__/service.test.ts	730	// ── Multi-turn conversation (the real-world scenario) ──────────────	COMMENT
MEDIUM	api/server/middleware/__tests__/requireJwtAuth.spec.js	13	// ── Mocks ──────────────────────────────────────────────────────────────	COMMENT
MEDIUM	api/server/middleware/__tests__/requireJwtAuth.spec.js	124	// ── Helpers ─────────────────────────────────────────────────────────────	COMMENT
MEDIUM	api/server/middleware/__tests__/requireJwtAuth.spec.js	171	// ── Tests ──────────────────────────────────────────────────────────────	COMMENT
MEDIUM	…rvices/Config/__tests__/invalidateConfigCaches.spec.js	1	// ── Mocks ──────────────────────────────────────────────────────────────	COMMENT
MEDIUM	…rvices/Config/__tests__/invalidateConfigCaches.spec.js	61	// ── Tests ──────────────────────────────────────────────────────────────	COMMENT
MEDIUM	…c/utils/__tests__/applyModelSpecEphemeralAgent.test.ts	44	// ─── New Conversations ─────────────────────────────────────────────	COMMENT
8 more matches not shown…

Over-Commented Block162 hits · 124 pts

Severity	File	Line	Snippet	Context
LOW	librechat.example.yaml	1	# For more information, see the Configuration Guide:	COMMENT
LOW	librechat.example.yaml	21	# infrastructure legitimately needs longer.	COMMENT
LOW	librechat.example.yaml	41	# previews when it loads a conversation (the start and end of each long output, arguments	COMMENT
LOW	librechat.example.yaml	61	# place a plaintext langfuse.secretKey in this file. Environment-managed central	COMMENT
LOW	librechat.example.yaml	81	# separate central host — gets a warning and no headers, rather than having a	COMMENT
LOW	librechat.example.yaml	101	#	COMMENT
LOW	librechat.example.yaml	121	# avatar: "s3" # Storage for user/agent avatar images	COMMENT
LOW	librechat.example.yaml	141	# imageSigning: "none" # "none" (public) \| "cookies" (signed cookies)	COMMENT
LOW	librechat.example.yaml	161	# includeRegionInPath: false	COMMENT
LOW	librechat.example.yaml	181	# repo: your-skills-repo	COMMENT
LOW	librechat.example.yaml	201	customWelcome: 'Welcome to LibreChat! Enjoy your experience.'	COMMENT
LOW	librechat.example.yaml	221	# It is not saved to the browser, outranks REACT_APP_THEME_* colors and stored themes,	COMMENT
LOW	librechat.example.yaml	301	# Allow the artifacts pane to be moved into its own browser window	COMMENT
LOW	librechat.example.yaml	321	# schedules:	COMMENT
LOW	librechat.example.yaml	341	# # projectId: '000000000000000000000000'	COMMENT
LOW	librechat.example.yaml	361	# # page is not a matter of raising this.	COMMENT
LOW	librechat.example.yaml	381	# # requests to Langfuse per listed page, and Langfuse returns each round's full	COMMENT
LOW	librechat.example.yaml	401	# - 'execute_code'	COMMENT
LOW	librechat.example.yaml	421	# statusRefreshInterval: 30000	COMMENT
LOW	librechat.example.yaml	441	# temporaryChatRetention: 1	COMMENT
LOW	librechat.example.yaml	461	# Example Cloudflare turnstile (optional)	COMMENT
LOW	librechat.example.yaml	481	socialLogins: ['github', 'google', 'discord', 'openid', 'facebook', 'apple', 'saml']	COMMENT
LOW	librechat.example.yaml	501	# reservationTtlMs: 1800000 # How long an in-flight request's reserved credits count if never released	COMMENT
LOW	librechat.example.yaml	521	# must include a port (`host:port`, `private.ip:port`, or `[ipv6]:port`); do not use URLs, paths,	COMMENT
LOW	librechat.example.yaml	541	# apiKey: '${STT_API_KEY}'	COMMENT
LOW	librechat.example.yaml	561	# Worker threads that hash passwords and auth tokens off the event loop.	COMMENT
LOW	librechat.example.yaml	581	# messages:	COMMENT
LOW	librechat.example.yaml	601	# requestsPerFiveMinutes: 7	COMMENT
LOW	librechat.example.yaml	621	# # address is bounded as well as the account the link names.	COMMENT
LOW	librechat.example.yaml	641	# Hostname/IP + port pairs listed here bypass the default-deny block for that	COMMENT
LOW	librechat.example.yaml	661	# the same SSRF block as Actions and MCP. If your users legitimately point at private	COMMENT
LOW	librechat.example.yaml	681	# public destination not also listed.	COMMENT
LOW	librechat.example.yaml	701	# # Hostname entries trust whatever IP they resolve to on the listed port.	COMMENT
LOW	librechat.example.yaml	721	# url: http://localhost:3001/sse	COMMENT
LOW	librechat.example.yaml	741	# # tools listed in `oauthToolCatalog`; without one the turn-start prompt is kept.	COMMENT
LOW	librechat.example.yaml	761	# # a `{{LIBRECHAT_BODY_*}}` placeholder here no longer hides the server's tool list.	COMMENT
LOW	librechat.example.yaml	781	# args:	COMMENT
LOW	librechat.example.yaml	801	# # privateAssistants: false # Does not work with `supportedIds` or `excludedIds`	COMMENT
LOW	librechat.example.yaml	821	# maxRecursionLimit: 100	COMMENT
LOW	librechat.example.yaml	841	# disableBuilder: false	COMMENT
LOW	librechat.example.yaml	861	# # unless the active redaction policy suppresses the label call.	COMMENT
LOW	librechat.example.yaml	881	# # (optional) Shared files during an active agent run. Each delegating agent must	COMMENT
LOW	librechat.example.yaml	901	# # (optional) Maximum total time spent waiting on Code API rate limits. Defaults to 20000 ms.	COMMENT
LOW	librechat.example.yaml	921	# maxEnvironmentChoices: 32	COMMENT
LOW	librechat.example.yaml	941	# name: Managed Code API	COMMENT
LOW	librechat.example.yaml	961	# owner: deployment	COMMENT
LOW	librechat.example.yaml	981	# # Do NOT enable until every LibreChat API replica recognizes this	COMMENT
LOW	librechat.example.yaml	1001	# commandExecution:	COMMENT
LOW	librechat.example.yaml	1021	# completionReceiptBatching: true	COMMENT
LOW	librechat.example.yaml	1041	# # GitHub Enterprise Server, a *.ghe.com tenant, or a self-managed GitLab host; the	COMMENT
LOW	librechat.example.yaml	1061	# allowedRepositories: ["LibreChat-AI/LibreChat"]	COMMENT
LOW	librechat.example.yaml	1081	# lookupTimeoutSeconds: 30 # longest the whole lookup may take (1 to 120)	COMMENT
LOW	librechat.example.yaml	1101	# # Explicit administrator ask/deny rules and hooks remain authoritative.	COMMENT
LOW	librechat.example.yaml	1121	# # (optional) Authenticate machine clients for the Agent Management API.	COMMENT
LOW	librechat.example.yaml	1141	# (optional) Title settings under `endpoints.all` apply to every endpoint one field at a	COMMENT
LOW	librechat.example.yaml	1161	# headers:	COMMENT
LOW	librechat.example.yaml	1181	# # This is similar to Azure OpenAI but for Anthropic models on Google Cloud	COMMENT
LOW	librechat.example.yaml	1201	# # Similar to Azure OpenAI model naming pattern	COMMENT
LOW	librechat.example.yaml	1221	# claude-fable-5.1:	COMMENT
LOW	librechat.example.yaml	1241	# # Set a default deploymentName and use boolean values for models	COMMENT
102 more matches not shown…

Structural Annotation Overuse54 hits · 104 pts

Severity	File	Line	Snippet	Context
LOW	config/smart-reinstall.js	143	// Step 1: Dependencies	COMMENT
LOW	config/smart-reinstall.js	163	// Step 2: Build via Turborepo	COMMENT
LOW	packages/data-schemas/README.md	134	### Step 1: Create the Type Definition	COMMENT
LOW	packages/data-schemas/README.md	153	### Step 2: Update Types Index	COMMENT
LOW	packages/data-schemas/README.md	161	### Step 3: Create the Schema	COMMENT
LOW	packages/data-schemas/README.md	180	### Step 4: Create the Model Factory	COMMENT
LOW	packages/data-schemas/README.md	196	### Step 5: Update Models Index	COMMENT
LOW	packages/data-schemas/README.md	210	### Step 6: Create Database Methods	COMMENT
LOW	packages/data-schemas/README.md	235	### Step 7: Update Methods Index	COMMENT
LOW⚡	packages/api/src/utils/oidc.spec.ts	667	// Step 1: Extract token info	COMMENT
LOW⚡	packages/api/src/utils/oidc.spec.ts	671	// Step 2: Validate token	COMMENT
LOW⚡	packages/api/src/utils/oidc.spec.ts	675	// Step 3: Process placeholders	COMMENT
LOW⚡	packages/api/src/mcp/__tests__/mcp.spec.ts	967	// Step 1: preProcessGraphTokens resolves graph token placeholders (async)	COMMENT
LOW⚡	packages/api/src/mcp/__tests__/mcp.spec.ts	973	// Step 2: processMCPEnv resolves user and env placeholders (sync)	COMMENT
LOW⚡	packages/api/src/mcp/__tests__/mcp.spec.ts	1005	// Step 1: preProcessGraphTokens	COMMENT
LOW⚡	packages/api/src/mcp/__tests__/mcp.spec.ts	1011	// Step 2: processMCPEnv	COMMENT
LOW⚡	packages/api/src/mcp/__tests__/mcp.spec.ts	1083	// Step 1: preProcessGraphTokens	COMMENT
LOW⚡	packages/api/src/mcp/__tests__/mcp.spec.ts	1089	// Step 2: processMCPEnv with customUserVars	COMMENT
LOW⚡	packages/api/src/mcp/__tests__/mcp.spec.ts	1116	// Step 1: preProcessGraphTokens (no-op since no graph placeholders)	COMMENT
LOW⚡	packages/api/src/mcp/__tests__/mcp.spec.ts	1122	// Step 2: processMCPEnv	COMMENT
LOW⚡	packages/api/src/mcp/__tests__/mcp.spec.ts	1155	// Step 1: preProcessGraphTokens	COMMENT
LOW⚡	packages/api/src/mcp/__tests__/mcp.spec.ts	1161	// Step 2: processMCPEnv	COMMENT
LOW⚡	…ages/api/src/mcp/__tests__/MCPOAuthTokenExpiry.test.ts	1072	// Step 2: Store tokens with valid expiry first	COMMENT
LOW⚡	…ages/api/src/mcp/__tests__/MCPOAuthTokenExpiry.test.ts	1082	// Step 3: Verify tokens work	COMMENT
LOW⚡	…ages/api/src/mcp/__tests__/MCPOAuthTokenExpiry.test.ts	1091	// Step 4: Simulate token expiry by directly updating the stored token's expiresAt	COMMENT
LOW⚡	…ages/api/src/mcp/__tests__/MCPOAuthTokenExpiry.test.ts	1094	// Step 5: Revoke refresh token on server side (simulating server-side revocation)	COMMENT
LOW⚡	…ages/api/src/mcp/__tests__/MCPOAuthTokenExpiry.test.ts	1097	// Step 6: Try to get tokens — refresh should fail, return null	COMMENT
LOW⚡	…ages/api/src/mcp/__tests__/MCPOAuthTokenExpiry.test.ts	1154	// Step 9: Complete the flow	COMMENT
LOW⚡	…ages/api/src/mcp/__tests__/MCPOAuthTokenExpiry.test.ts	1162	// Step 10: Store the new tokens	COMMENT
LOW⚡	…ages/api/src/mcp/__tests__/MCPOAuthTokenExpiry.test.ts	1174	// Step 11: Verify new tokens work	COMMENT
LOW⚡	…ages/api/src/mcp/__tests__/MCPOAuthTokenExpiry.test.ts	1183	// Step 12: Verify new token works against server	COMMENT
LOW	…ages/api/src/mcp/__tests__/MCPOAuthTokenExpiry.test.ts	1058	// Step 1: Get initial tokens	COMMENT
LOW	…ages/api/src/mcp/__tests__/MCPOAuthTokenExpiry.test.ts	1124	// Step 7: Simulate the re-auth flow via FlowStateManager	COMMENT
LOW	…ages/api/src/mcp/__tests__/MCPOAuthTokenExpiry.test.ts	1140	// Step 8: Get a new auth code and exchange for tokens (simulating user re-auth)	COMMENT
LOW⚡	…er/controllers/agents/__tests__/jobReplacement.spec.js	242	// Step 1: Save message	COMMENT
LOW⚡	…er/controllers/agents/__tests__/jobReplacement.spec.js	245	// Step 2: Check for replacement	COMMENT
LOW⚡	…er/controllers/agents/__tests__/jobReplacement.spec.js	249	// Step 3: Emit if not replaced	COMMENT
LOW	api/server/services/PermissionService.js	524	// Step 1: Get all group IDs user should be member of	COMMENT
LOW	api/server/services/PermissionService.js	552	// Step 2: Try to add user to existing groups (fast operation)	COMMENT
LOW	api/server/services/PermissionService.js	567	// Step 3: Find which groups don't exist in DB using db layer	COMMENT
LOW	api/server/services/PermissionService.js	578	// Step 4: Fetch details only for missing groups (optimized batch request)	COMMENT
LOW	api/server/services/PermissionService.js	590	// Step 5: Upsert missing groups (race-safe by design)	COMMENT
LOW	api/server/services/PermissionService.js	607	// Step 6: Add user to all newly created/upserted groups	COMMENT
LOW	api/server/services/PermissionService.js	632	// Step 7: Remove user from Entra groups they're no longer member of	COMMENT
LOW⚡	client/src/utils/__tests__/citations.test.ts	200	// Step 1: Extract highlighted spans	COMMENT
LOW⚡	client/src/utils/__tests__/citations.test.ts	209	// Step 2: Extract composite blocks	COMMENT
LOW	client/src/utils/__tests__/citations.test.ts	224	// Step 3: Extract standalone citations (not in composites)	COMMENT
LOW	client/src/utils/__tests__/citations.test.ts	241	// Step 4: Clean up text	COMMENT
LOW⚡	client/src/hooks/Messages/useCopyToClipboard.ts	315	// Step 1: Process highlighted text first (simplify by just making it bold in markdown)	COMMENT
LOW⚡	client/src/hooks/Messages/useCopyToClipboard.ts	321	// Step 2: Find all standalone citations and composite citation blocks	COMMENT
LOW	client/src/hooks/Messages/useCopyToClipboard.ts	370	// Step 3: Process each citation and build the reference mapping	COMMENT
LOW⚡	client/src/hooks/Messages/useCopyToClipboard.ts	514	// Step 4: Apply all replacements (from longest to shortest to avoid nested replacement issues)	COMMENT
LOW⚡	client/src/hooks/Messages/useCopyToClipboard.ts	520	// Step 5: Remove any orphaned composite blocks at the end of the text	COMMENT
LOW⚡	client/src/hooks/Messages/useCopyToClipboard.ts	524	// Step 6: Clean up any remaining citation markers	COMMENT

Verbosity Indicators47 hits · 93 pts

Severity	File	Line	Snippet	Context
LOW	config/smart-reinstall.js	143	// Step 1: Dependencies	COMMENT
LOW	config/smart-reinstall.js	163	// Step 2: Build via Turborepo	COMMENT
LOW⚡	packages/api/src/utils/oidc.spec.ts	667	// Step 1: Extract token info	COMMENT
LOW⚡	packages/api/src/utils/oidc.spec.ts	671	// Step 2: Validate token	COMMENT
LOW⚡	packages/api/src/utils/oidc.spec.ts	675	// Step 3: Process placeholders	COMMENT
LOW⚡	packages/api/src/mcp/__tests__/mcp.spec.ts	967	// Step 1: preProcessGraphTokens resolves graph token placeholders (async)	COMMENT
LOW⚡	packages/api/src/mcp/__tests__/mcp.spec.ts	973	// Step 2: processMCPEnv resolves user and env placeholders (sync)	COMMENT
LOW⚡	packages/api/src/mcp/__tests__/mcp.spec.ts	1005	// Step 1: preProcessGraphTokens	COMMENT
LOW⚡	packages/api/src/mcp/__tests__/mcp.spec.ts	1011	// Step 2: processMCPEnv	COMMENT
LOW⚡	packages/api/src/mcp/__tests__/mcp.spec.ts	1083	// Step 1: preProcessGraphTokens	COMMENT
LOW⚡	packages/api/src/mcp/__tests__/mcp.spec.ts	1089	// Step 2: processMCPEnv with customUserVars	COMMENT
LOW⚡	packages/api/src/mcp/__tests__/mcp.spec.ts	1116	// Step 1: preProcessGraphTokens (no-op since no graph placeholders)	COMMENT
LOW⚡	packages/api/src/mcp/__tests__/mcp.spec.ts	1122	// Step 2: processMCPEnv	COMMENT
LOW⚡	packages/api/src/mcp/__tests__/mcp.spec.ts	1155	// Step 1: preProcessGraphTokens	COMMENT
LOW⚡	packages/api/src/mcp/__tests__/mcp.spec.ts	1161	// Step 2: processMCPEnv	COMMENT
LOW⚡	…ages/api/src/mcp/__tests__/MCPOAuthTokenExpiry.test.ts	1072	// Step 2: Store tokens with valid expiry first	COMMENT
LOW⚡	…ages/api/src/mcp/__tests__/MCPOAuthTokenExpiry.test.ts	1082	// Step 3: Verify tokens work	COMMENT
LOW⚡	…ages/api/src/mcp/__tests__/MCPOAuthTokenExpiry.test.ts	1091	// Step 4: Simulate token expiry by directly updating the stored token's expiresAt	COMMENT
LOW⚡	…ages/api/src/mcp/__tests__/MCPOAuthTokenExpiry.test.ts	1094	// Step 5: Revoke refresh token on server side (simulating server-side revocation)	COMMENT
LOW⚡	…ages/api/src/mcp/__tests__/MCPOAuthTokenExpiry.test.ts	1097	// Step 6: Try to get tokens — refresh should fail, return null	COMMENT
LOW⚡	…ages/api/src/mcp/__tests__/MCPOAuthTokenExpiry.test.ts	1154	// Step 9: Complete the flow	COMMENT
LOW⚡	…ages/api/src/mcp/__tests__/MCPOAuthTokenExpiry.test.ts	1162	// Step 10: Store the new tokens	COMMENT
LOW⚡	…ages/api/src/mcp/__tests__/MCPOAuthTokenExpiry.test.ts	1174	// Step 11: Verify new tokens work	COMMENT
LOW⚡	…ages/api/src/mcp/__tests__/MCPOAuthTokenExpiry.test.ts	1183	// Step 12: Verify new token works against server	COMMENT
LOW	…ages/api/src/mcp/__tests__/MCPOAuthTokenExpiry.test.ts	1058	// Step 1: Get initial tokens	COMMENT
LOW	…ages/api/src/mcp/__tests__/MCPOAuthTokenExpiry.test.ts	1124	// Step 7: Simulate the re-auth flow via FlowStateManager	COMMENT
LOW	…ages/api/src/mcp/__tests__/MCPOAuthTokenExpiry.test.ts	1140	// Step 8: Get a new auth code and exchange for tokens (simulating user re-auth)	COMMENT
LOW⚡	…er/controllers/agents/__tests__/jobReplacement.spec.js	242	// Step 1: Save message	COMMENT
LOW⚡	…er/controllers/agents/__tests__/jobReplacement.spec.js	245	// Step 2: Check for replacement	COMMENT
LOW⚡	…er/controllers/agents/__tests__/jobReplacement.spec.js	249	// Step 3: Emit if not replaced	COMMENT
LOW	api/server/services/PermissionService.js	524	// Step 1: Get all group IDs user should be member of	COMMENT
LOW	api/server/services/PermissionService.js	552	// Step 2: Try to add user to existing groups (fast operation)	COMMENT
LOW	api/server/services/PermissionService.js	567	// Step 3: Find which groups don't exist in DB using db layer	COMMENT
LOW	api/server/services/PermissionService.js	578	// Step 4: Fetch details only for missing groups (optimized batch request)	COMMENT
LOW	api/server/services/PermissionService.js	590	// Step 5: Upsert missing groups (race-safe by design)	COMMENT
LOW	api/server/services/PermissionService.js	607	// Step 6: Add user to all newly created/upserted groups	COMMENT
LOW	api/server/services/PermissionService.js	632	// Step 7: Remove user from Entra groups they're no longer member of	COMMENT
LOW⚡	client/src/utils/__tests__/citations.test.ts	200	// Step 1: Extract highlighted spans	COMMENT
LOW⚡	client/src/utils/__tests__/citations.test.ts	209	// Step 2: Extract composite blocks	COMMENT
LOW	client/src/utils/__tests__/citations.test.ts	224	// Step 3: Extract standalone citations (not in composites)	COMMENT
LOW	client/src/utils/__tests__/citations.test.ts	241	// Step 4: Clean up text	COMMENT
LOW⚡	client/src/hooks/Messages/useCopyToClipboard.ts	315	// Step 1: Process highlighted text first (simplify by just making it bold in markdown)	COMMENT
LOW⚡	client/src/hooks/Messages/useCopyToClipboard.ts	321	// Step 2: Find all standalone citations and composite citation blocks	COMMENT
LOW	client/src/hooks/Messages/useCopyToClipboard.ts	370	// Step 3: Process each citation and build the reference mapping	COMMENT
LOW⚡	client/src/hooks/Messages/useCopyToClipboard.ts	514	// Step 4: Apply all replacements (from longest to shortest to avoid nested replacement issues)	COMMENT
LOW⚡	client/src/hooks/Messages/useCopyToClipboard.ts	520	// Step 5: Remove any orphaned composite blocks at the end of the text	COMMENT
LOW⚡	client/src/hooks/Messages/useCopyToClipboard.ts	524	// Step 6: Clean up any remaining citation markers	COMMENT

AI Slop Vocabulary12 hits · 31 pts

Severity	File	Line	Snippet	Context
MEDIUM	librechat.example.yaml	1417	# # - "enabled_full": Include comprehensive trace details (recommended for debugging)	COMMENT
MEDIUM	search/compose.yml	64	# differential-test harness at	COMMENT
MEDIUM	…ckages/data-schemas/src/methods/convoStructure.spec.ts	104	// buildTree is order-robust: a child sorted before its parent must still	COMMENT
MEDIUM	…ckages/data-schemas/src/methods/convoStructure.spec.ts	173	// Interleaved timestamps scramble retrieval order, but the order-robust	COMMENT
MEDIUM	packages/api/src/tools/toolkits/web.ts	6	Use this tool when the user's request calls for it, whether directly, indirectly, or implicitly, or when answering requi	CODE
MEDIUM	.github/workflows/workspace-acceptance.yml	85	# The native harness retains private identities and cookies for local debugging.	COMMENT
MEDIUM	api/server/utils/import/__data__/chatgpt-export.json	606	"result": "# \u30100\u20202014 Volkswagen Transporter MPG - Actual MPG from 14 2014 ... - Fuelly\u2020www.fu	CODE
MEDIUM	api/server/utils/import/__data__/chatgpt-export.json	783	"text": "# \u30100\u20202014 Volkswagen Transporter MPG - Actual MPG from 14 2014 ... - Fuelly\u2020ww	CODE
MEDIUM	api/server/utils/import/__data__/chatgpt-citations.json	20	"result": "# 【0†Signal Sciences - Crunchbase Company Profile & Funding†www.crunchbase.com】\nFounded Date Mar	CODE
MEDIUM	api/server/utils/import/__data__/chatgpt-citations.json	199	"text": "# 【0†Signal Sciences - Crunchbase Company Profile & Funding†www.crunchbase.com】\nFounded Date	CODE
MEDIUM	e2e/config/librechat.e2e.yaml	34	# Scheduled chats are EXPERIMENTAL and default-off, so the e2e harness must opt in	COMMENT
MEDIUM	e2e/config/librechat.real.yaml	12	# Local stdio fixture reused from the mock harness: gives the real model a	COMMENT

Modern AI Meta-Vocabulary5 hits · 15 pts

Severity	File	Line	Snippet	Context
MEDIUM	librechat.example.yaml	567	# ragMs: 30000 # RAG API queries for file search and message context	COMMENT
MEDIUM	e2e/config/librechat.e2e.yaml	463	# Short enough that a stalled fake RAG query fails the tool call well inside a test.	COMMENT
MEDIUM	helm/librechat-rag-api/readme.md	1	# Librechat RAG API Helm CHart	COMMENT
MEDIUM	helm/librechat-rag-api/values.yaml	1	# Required as vectorDB for RAG	COMMENT
MEDIUM	helm/librechat/values.yaml	125	# only lite RAG is supported	COMMENT

Redundant / Tautological Comments10 hits · 15 pts

Severity	File	Line	Snippet	Context
LOW	librechat.example.yaml	457	# Set retainAgentFiles to true to keep persistent agent resource files from expiring under	COMMENT
LOW	redis-config/stop-cluster.sh	22	# Check if still running and force kill if needed	COMMENT
LOW	redis-config/start-redis-tls.sh	6	# Check if Redis is already running	COMMENT
LOW	redis-config/start-cluster.sh	17	# Check if Redis is installed	COMMENT
LOW	redis-config/start-cluster.sh	26	# Check if Redis CLI is available	COMMENT
LOW	redis-config/start-cluster.sh	40	# Check if all nodes are running	COMMENT
LOW	redis-config/start-cluster.sh	57	# Check if cluster is already initialized	COMMENT
LOW	utils/update_env.py	58	# Check if the environment variable is set in the local environment	COMMENT
LOW	packages/data-provider/check_updates.sh	33	# Check if this date is within the last three days	COMMENT
LOW	client/check_updates.sh	32	# Check if this date is within the last three days	COMMENT

Slop Phrases5 hits · 14 pts

Severity	File	Line	Snippet	Context
MEDIUM	librechat.example.yaml	1335	# For `apiKey` and `baseURL`, you can use environment variables that you define.	COMMENT
MEDIUM	librechat.example.yaml	1377	# For `apiKey` and `baseURL`, you can use environment variables that you define.	COMMENT
MEDIUM	api/server/utils/import/__data__/chatgpt-export.json	1127	"To find the point where all intervals intersect, you need to determine the common overlap region among al	CODE
MEDIUM	helm/librechat-rag-api/values.yaml	30	# postgres-password is needed to enable pgvector extension. If you enable it manually you can use "password" and use	COMMENT
MEDIUM	helm/librechat/examples/dns-configuration.yaml	37	# Note: For simple host-to-IP mappings, you can also use hostAliases	COMMENT

Example Usage Blocks2 hits · 3 pts

Severity	File	Line	Snippet	Context
LOW	config/test-subdirectory-setup.sh	10	# Usage:	COMMENT
LOW	…/agents/responses/__tests__/responses-api.live.test.sh	7	# Usage:	COMMENT

Unused Imports1 hit · 0 pts

Severity	File	Line	Snippet	Context
LOW	.github/scripts/test_main_promotion.py	3		CODE

danny-avila/LibreChat

Open-Source Code Quality, Security and Technical Debt Review