1.7

Adjusted Signal

1.7

Raw Pattern Score

100%

Time Factor

—

Last Push

—

Stars

—

Language

141.4K

Lines of Code

238

Files

243

Pattern Hits

2026-10-31

Scan Date

0.00

HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 8.2/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 243 finding(s).

Hallucinated Dependency & Supply Chain Risk 0.0/100 · LOW

Are imports declared and package/API names verified? 0 finding(s).

Agent Over-Engineering Ratio 2.8/100 · LOW

Are wrappers, guards, and repeated structures necessary? 73 finding(s).

PR Review Velocity Impact 8.6/100 · LOW

Which changes need focused human review? 243 finding(s).

What These Metrics Mean

Adjusted Signal: Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score: Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor: A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits: Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate: High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files: Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 0HIGH 0MEDIUM 6LOW 237

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 243 distinct pattern matches across 4 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Over-Commented Block164 hits · 145 pts

Severity	File	Line	Snippet	Context
LOW	tsdown.config.ts	41	format: 'cjs',	COMMENT
LOW	tests/check.spec.ts	701	// a list stops being read.	COMMENT
LOW	tests/profile.spec.ts	541	}	COMMENT
LOW	tests/profile.spec.ts	561	// Another host's repository of the same name still gets nothing, which is	COMMENT
LOW	tests/pnpm-compat.spec.ts	101	// The THIRD face of the same gate, and the only one that fails after the	COMMENT
LOW	tests/pnpm-compat.spec.ts	301	const failed = classifyPnpmFailure(	COMMENT
LOW	tests/pnpm-compat.spec.ts	601	expect(classifyPnpmFailure(ndjson)?.pkg).toBe('dsh-music-huazai')	COMMENT
LOW	tests/pnpm-compat.spec.ts	821	// to require `--store-dir` as the FIX, which is what sent users in a	COMMENT
LOW	tests/flows.spec.ts	381	const def = commit !== undefined ? repo.byCommit?.[commit] : undefined	COMMENT
LOW	tests/flows.spec.ts	2841		COMMENT
LOW	tests/flows.spec.ts	3641		COMMENT
LOW	tests/flows.spec.ts	3701	expect(ran).not.toContain('themer@latest')	COMMENT
LOW	tests/flows.spec.ts	3781		COMMENT
LOW	tests/flows.spec.ts	5081	const restored = JSON.parse(readFileSync(join(pkgDir, 'package.json'), 'utf8')) as Record<string, unknown>	COMMENT
LOW	tests/flows.spec.ts	6761	// The pin comes from the installed spec, with no lookup in between — an	COMMENT
LOW	tests/flows.spec.ts	8181	expect(on.status).toBe(502)	COMMENT
LOW	tests/flows.spec.ts	9041	expect((await restarted.dispatch('GET', '/dsh-market/status')).json.channel).toBe('stable')	COMMENT
LOW	tests/settings.spec.ts	81	// routes read the saved channel off disk at mount and `onChange` — which	COMMENT
LOW	tests/settings.spec.ts	141	effect: (run: () => unknown) => { run() },	COMMENT
LOW	tests/restart.spec.ts	221	// ppid 1 = systemd forked us as a service's main process.	COMMENT
LOW	tests/registry.spec.ts	261	// where the official domain works must not also fetch a mirror.	COMMENT
LOW	tests/registry.spec.ts	321	// The package is a DIFFERENT source, so the origin's ETag must not ride	COMMENT
LOW	tests/market-data.spec.ts	301	})	COMMENT
LOW	tests/market-data.spec.ts	521		COMMENT
LOW	tests/market-data.spec.ts	1001		COMMENT
LOW	tests/web/channel.e2e.ts	61	// installed. Which of 'stable'/'beta' is "the derived default" and which	COMMENT
LOW	tests/web/scaffold.ts	561	let browseCatalog: BrowseCatalogServer \| null = null	COMMENT
LOW	tests/web/market.e2e.ts	101	await waitMarketCatalog(page)	COMMENT
LOW	tests/web/market.e2e.ts	161	// only while the chosen category does not happen to own the top of the	COMMENT
LOW	tests/setup/no-proxy.ts	1	// The unit lane never reaches the network: every request a spec cares about	COMMENT
LOW	tests/client/market-section.client.spec.tsx	641	})	COMMENT
LOW	tests/client/market-section.client.spec.tsx	5201		COMMENT
LOW	tests/client/market-section.client.spec.tsx	8181		COMMENT
LOW	tests/client/market-section.client.spec.tsx	8501	})	COMMENT
LOW	.github/workflows/release.yml	1	name: release	COMMENT
LOW	.github/workflows/site-health.yml	1	name: Site health	COMMENT
LOW	.github/workflows/build-site.yml	41	- run: npm install	COMMENT
LOW	.github/workflows/ci.yml	61	# hide). npm run check just rebuilt it; if the rebuild differs from	COMMENT
LOW	.github/workflows/ci.yml	101	- run: npm run test:compat	COMMENT
LOW	.github/workflows/ci.yml	121	# 0.1.7 is the next line, and it is the one that changed the most	COMMENT
LOW	.github/workflows/ci.yml	141	# line after this one.	COMMENT
LOW	.github/workflows/ci.yml	161	# every failing spec times out on the HOST's own Settings button	COMMENT
LOW	.github/workflows/ci.yml	181	# the profile's package.json). The market never runs it from inside a	COMMENT
LOW	.github/workflows/ci.yml	221	# Not `npm install -g`: the older CLIs pin only themselves while their	COMMENT
LOW	src/dsh-cli.ts	101	const out: NodeJS.ProcessEnv = {}	COMMENT
LOW	src/dsh-cli.ts	121	// the caller has said anything in the standard vars, that is their	COMMENT
LOW	src/dsh-cli.ts	141	// `PNPM_CONFIG_*` and does not read `npm_config_registry` at all — measured	COMMENT
LOW	src/dsh-cli.ts	361	// A packaged host ships its runtime rather than relying on PATH, and says	COMMENT
LOW	src/dsh-cli.ts	381	// interactive prompt, and either being overridden by a config value would	COMMENT
LOW	src/dsh-cli.ts	481	// Desktop's installed `dsh web` uses this CLI carrier too. Keep	COMMENT
LOW	src/dsh-cli.ts	1121	}	COMMENT
LOW	src/routes.ts	341		COMMENT
LOW	src/routes.ts	381	}	COMMENT
LOW	src/routes.ts	1061	// carrier's disables) was never tried, so there is no crash to	COMMENT
LOW	src/routes.ts	1141	// opt-in rows open — `enableRow` answers a row with no `disabled` block	COMMENT
LOW	src/routes.ts	1161	// (including any config side effects it carries). Enabling re-adds it.	COMMENT
LOW	src/routes.ts	1221	// An enable that could not move the package back into the stack has	COMMENT
LOW	src/routes.ts	1261	// The two layers move together or neither does (#696): an enable	COMMENT
LOW	src/routes.ts	1361	live.add(entry.options.name)	COMMENT
LOW	src/routes.ts	1721	lockfileBefore: ProfileLockfileSnapshot,	COMMENT
104 more matches not shown…

Hyper-Verbose Identifiers73 hits · 80 pts

Severity	File	Line	Snippet	Context
LOW	tests/snapshot.spec.ts	47	function mustCreateProfileSnapshot(dir: string, maxSnapshots?: number): ProfileSnapshot {	CODE
LOW	tests/web/scaffold.ts	96	export function processLaunchUrlFromOutput(baseUrl: string, output: string): string \| null {	CODE
LOW	tests/web/scaffold.ts	108	export function createStartupOutputCapture(baseUrl: string, tailLimit = 8192): {	CODE
LOW	tests/web/scaffold.ts	150	export function redactAuthenticationSecrets(output: string, exactSecrets: readonly string[] = []): string {	CODE
LOW	tests/web/scaffold.ts	304	export async function exchangeProcessLaunchToken(	CODE
LOW	tests/client/market-section.client.spec.tsx	8230	function stubWindowControlsOverlay(initialHeight: number) {	CODE
LOW	tests/client/primitives-guard.spec.ts	160	function hostWhoseSectionRegistrationThrows() {	CODE
LOW	client/client.js	2633	function findCatalogEntryForLocalUncached(plugins, name, identities, hints) {	CODE
LOW	client/client.js	3528	function extractReadmeImageCandidates(markdown, owner, repo, subpath) {	CODE
LOW	client/client.js	3607	function warnRefusedCuratedScreenshots(plugin, rejections) {	CODE
LOW	client/client.js	3623	function pluginScreenshotCandidates(plugin) {	CODE
LOW	client/client.js	7796	function HostDependencyDiagnostics({ findings, t }) {	CODE
LOW	client/client.js	9473	function clearHostCompatibilityCache() {	CODE
LOW	client/client.js	9478	function subscribeHostCompatibility(onStoreChange) {	CODE
LOW	src/dsh-install.ts	176	export function setLauncherInstallAnchorSource(source: () => string \| null): () => string \| null {	CODE
LOW	src/dsh-cli.ts	879	export function hostPackageManagerInvocation(): HostPackageManager \| null {	CODE
LOW	src/dsh-cli.ts	884	export function lastHostPackageManagerFailure(): { command: string; output: string } \| null {	CODE
LOW	src/dsh-cli.ts	1433	export function createDesktopPluginRuntime(	CODE
LOW	src/routes.ts	91	function isGitHubReleaseTarballSpec(spec: string): boolean {	CODE
LOW	src/routes.ts	1499	function cannotRematerializeDetail(name: string, pinned: string \| undefined): string {	CODE
LOW	src/routes.ts	1900	function captureProfileStateFingerprint(): ProfileStateFingerprint \| null {	CODE
LOW	src/verify.ts	898	export function findUnservedConfigNamespaces(	CODE
LOW	src/install.ts	534	export function isNumericReleaseAgeWindow(key: string, value: string \| undefined): boolean {	CODE
LOW	src/install.ts	540	function readReleaseAgeMinutesFromEnv(): number \| 'invalid' \| null {	CODE
LOW	src/install.ts	581	function readReleaseAgeMinutesFromWorkspace(dir: string): number \| 'invalid' \| null {	CODE
LOW	src/install.ts	592	function readReleaseAgeMinutesFromNpmrc(dir: string): number \| 'invalid' \| null {	CODE
LOW	src/install.ts	643	function formatRemainingReleaseAgeWait(remainingMs: number): { zh: string, en: string } {	CODE
LOW	src/install.ts	1109	export function allowBuildKeyFromIgnoredBuild(depPath: string): string {	CODE
LOW	src/settings.ts	160	export function installDesktopMarketSettings(ctx: Context): void {	CODE
LOW	src/restart.ts	38	export function setDetectedDebuggerOverride(value: 'inspector' \| null \| undefined): void {	CODE
LOW	src/restart.ts	346	export function trustedSelfUninstallRequest(request: Pick<IncomingMessage, 'headers' \| 'socket'>): boolean {	CODE
LOW	src/restart.ts	358	export function selfUninstallReachableFrom(request: Pick<IncomingMessage, 'headers' \| 'socket'>): boolean {	CODE
LOW	src/sources.ts	936	export function restoreBlockedByWorkspace(target: string, workspaceDeps: readonly string[]): boolean {	CODE
LOW	src/changelog.ts	303	function catalogEntryForNpmInstall(	CODE
LOW	src/changelog.ts	325	function catalogEntryForGitSubpath(plugins: readonly RegistryPlugin[], spec: string): RegistryPlugin \| undefined {	CODE
LOW	src/body-progress.ts	172	export async function fetchBodyWhileProgressing(	CODE
LOW	src/net.ts	59	export function releaseHostUndiciDispatcher(	CODE
LOW	src/official-desktop.ts	438	export function createOfficialDesktopRuntime(	CODE
LOW	src/profile.ts	242	export function readProfileManifestSnapshot(profile: string, explicitDir?: string): ProfileManifestSnapshot {	CODE
LOW	src/profile.ts	280	export function bundlesDroppedFromProfile(	CODE
LOW	src/profile.ts	569	function installedPackageDirectory(root: string, name: string): string \| null {	CODE
LOW	src/profile.ts	658	export function readInstalledRepoIdentities(	CODE
LOW	src/profile.ts	701	export function readInstalledRepoEvidence(	CODE
LOW	src/profile.ts	1807	export function mergeDuplicateReleaseAgeExcludes(profile: string, explicitDir?: string): string[] {	CODE
LOW	src/diagnostics.ts	47	function inspectKnownHostDependencyDeclarations(	CODE
LOW	src/updates.ts	391	export async function resolveDesktopMatureUpdate(name: string, installed: string \| null, profile: string, activeProfileD	CODE
LOW	src/regions.ts	271	export function resetGithubRoutePreferences(): void {	CODE
LOW	src/check.ts	464	function readProfileVisibleVersion(profileDirectory: string, name: string): string \| null {	CODE
LOW	src/check.ts	991	export function duplicateEntryIdsAreFatal(profileDirectory: string, dshInstallDir?: string \| null): boolean {	CODE
LOW	src/pnpm-compat.ts	101	function isChinaMirrorTarballReset(output: string): boolean {	CODE
LOW	src/pnpm-compat.ts	154	function withDecodedPnpmDiagnostics(output: string): string {	CODE
LOW	src/host-recovery.ts	157	export function restoreHostRecoveryBackup(	CODE
LOW	src/patch.ts	198	export function userPatchPackageReferences(patchPath: string, packageName: string): string[] \| null {	CODE
LOW⚡	src/client/primitives.d.ts	143	export function IconChevronDownOutlineRegular(props: IconProps): ReactElement	CODE
LOW⚡	src/client/primitives.d.ts	144	export function IconChevronUpOutlineRegular(props: IconProps): ReactElement	CODE
LOW⚡	src/client/primitives.d.ts	147	export function IconChevronLeftOutlineRegular(props: IconProps): ReactElement	CODE
LOW⚡	src/client/primitives.d.ts	148	export function IconChevronRightOutlineRegular(props: IconProps): ReactElement	CODE
LOW⚡	src/client/primitives.d.ts	151	export function IconRefreshOutlineRegular(props: IconProps): ReactElement	CODE
LOW⚡	src/client/primitives.d.ts	152	export function IconWarningOutlineRegular(props: IconProps): ReactElement	CODE
LOW⚡	src/client/primitives.d.ts	154	export function IconQuestionOutlineRegular(props: IconProps): ReactElement	CODE
13 more matches not shown…

Modern AI Meta-Vocabulary4 hits · 12 pts

Severity	File	Line	Snippet	Context
MEDIUM	vitest.web.config.ts	6	// Specs skip when no dsh CLI is reachable (see tests/web/scaffold.ts).	COMMENT
MEDIUM	tsconfig.tests.json	2	// The layer-3 scaffold is plain Node code that the main config does not	COMMENT
MEDIUM	tests/web/registry.ts	25	// fileURLToPath, not .pathname — see the note in scaffold.ts: a Windows	COMMENT
MEDIUM	.github/workflows/ci.yml	220	# `--no-open`, which tests/web/scaffold.ts now passes.	COMMENT

AI Slop Vocabulary2 hits · 6 pts

Severity	File	Line	Snippet	Context
MEDIUM	tests/profile.spec.ts	2182	// The report's shape (#1043): ds-harness-remote ships BOTH of its rows	COMMENT
MEDIUM	.github/workflows/ci.yml	166	# reachable in this harness", not as a compatibility verdict.	COMMENT

dsh-market/dsh-market

Open-Source Code Quality, Security and Technical Debt Review