EmDash is a full-stack TypeScript CMS based on Astro; the spiritual successor to WordPress
This report presents the forensic synthetic code analysis of emdash-cms/emdash, a TypeScript project with 11,149 GitHub stars. SynthScan v2.0 examined 650,582 lines of code across 2306 source files, recording 1057 pattern matches distributed across 9 syntactic categories. The overall adjusted score of 3.1 places this repository in the Likely human-written band.
The scanner applied 160+ deterministic lexical heuristics, multi-line block detectors, abstract syntax tree depth profilers, and a cross-file Jaccard similarity matrix to construct a statistically normalised synthetic code estimate. All matches are individually weighted by severity coefficient and contextual multiplier before summation, and the resulting headline score is temporally discounted to account for the repository's development history relative to the commercial emergence of large language model coding tooling (November 2022 onward).
This chart maps the temporal evolution of the adjusted synthetic code score across successive scan runs. An upward trajectory indicates ongoing incorporation of AI-generated code or expanding LLM-assisted scaffolding; a stable or declining trajectory may reflect active human refactoring, code removal, or the adoption of stricter authorship policies. The dashed secondary line (right axis) independently tracks total raw pattern hit count, which can diverge from the normalised score when codebase size changes significantly between scans.
Classifies detected patterns by their diagnostic confidence and structural impact. CRITICAL patterns (coefficient 10) represent definitive synthetic signatures — hallucinated imports, explicit LLM attribution metadata — virtually never produced by human authors. HIGH (5) indicates strong structural tells such as cross-file repetition or cross-linguistic idioms. MEDIUM (2) covers recognisable conversational padding and AI-specific vocabulary. LOW (1) captures subtle indicators like tautological comments and generic boilerplate that require density to carry independent signal.
This horizontal bar chart decomposes the repository's raw synthetic code score by top-level directory, allowing you to pinpoint precisely which modules or components carry the highest AI authorship density. Directories with disproportionately high scores relative to their size warrant targeted manual review: concentrated AI signatures often trace back to mass-generated configuration layers, auto-ported test suites, LLM-scaffolded boilerplate classes, or entire subsystems authored under heavy copilot assistance. Use this view to prioritise your human code-review effort.
The scanner identified 1057 distinct pattern matches across 9 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a statistically significant AI authorship indicator. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the diagnostic confidence level (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — comment-context matches receive a ×1.5 weight because LLMs systematically over-annotate. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier as dense clusters constitute far stronger evidence of synthetic authorship than isolated hits.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | infra/perf-monitor/worker-configuration.d.ts | 10185 | // ── Error types ────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | infra/perf-monitor/worker-configuration.d.ts | 10206 | // ── Binding ────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | infra/discord-bot/src/index.ts | 40 | // ─── Discord Interaction Handler ───────────────────────────────── | COMMENT |
| MEDIUM | infra/discord-bot/src/index.ts | 100 | // ─── GitHub OAuth Callback ─────────────────────────────────────── | COMMENT |
| MEDIUM | infra/discord-bot/src/index.ts | 175 | // ─── GitHub Webhook Handler ────────────────────────────────────── | COMMENT |
| MEDIUM | infra/discord-bot/src/index.ts | 262 | // ─── Message Templates ─────────────────────────────────────────── | COMMENT |
| MEDIUM | infra/discord-bot/src/index.ts | 296 | // ─── Helpers ───────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/blocks/playground/src/templates.ts | 9 | // ── Sample data generators ─────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/blocks/playground/src/Playground.tsx | 10 | // ── Types ──────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/blocks/playground/src/Playground.tsx | 18 | // ── Hash sharing ───────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/blocks/playground/src/Playground.tsx | 42 | // ── Drag handle ────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/blocks/playground/src/Playground.tsx | 62 | // ── Component ──────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/blocks/tests/form-conditions.test.tsx | 8 | // ── Mocks ──────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/blocks/tests/form-conditions.test.tsx | 198 | // ── Helpers ────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/blocks/tests/form-conditions.test.tsx | 208 | // ── Tests ──────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/blocks/tests/renderer.test.tsx | 8 | // ── Mocks ──────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/blocks/tests/renderer.test.tsx | 272 | // ── Helpers ────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/blocks/tests/renderer.test.tsx | 279 | // ── Tests ──────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/blocks/tests/validation.test.ts | 6 | // ── Valid blocks ───────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/blocks/tests/validation.test.ts | 209 | // ── Invalid blocks ─────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/blocks/tests/validation.test.ts | 771 | // ── Edge cases ─────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/blocks/src/types.ts | 1 | // ── Composition Objects ────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/blocks/src/types.ts | 11 | // ── Elements ───────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/blocks/src/types.ts | 167 | // ── Form Fields (elements + optional condition) ────────────────────────────── | COMMENT |
| MEDIUM | packages/blocks/src/types.ts | 188 | // ── Block Sub-types ────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/blocks/src/types.ts | 245 | // ── Blocks ─────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/blocks/src/types.ts | 387 | // ── Interactions ───────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/blocks/src/types.ts | 410 | // ── Response ───────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/blocks/src/builders.ts | 43 | // ── Block Builders ─────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/blocks/src/builders.ts | 169 | // ── Element Builders ───────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/blocks/src/builders.ts | 498 | // ── Exports ────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/blocks/src/blocks/chart.tsx | 27 | // ── Security: HTML-escape untrusted strings before they reach ECharts ──────── | COMMENT |
| MEDIUM | packages/blocks/src/blocks/chart.tsx | 46 | // ── Security: Sanitize custom ECharts options ──────────────────────────────── | COMMENT |
| MEDIUM | packages/atproto-test-utils/tests/round-trip.test.ts | 421 | // ── helpers ──────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/atproto-test-utils/src/mock-pds.ts | 121 | // ─── handlers ──────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/atproto-test-utils/src/mock-pds.ts | 252 | // ─── helpers ───────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …es/core/tests/unit/plugins/adapt-sandbox-entry.test.ts | 453 | // ── Deprecation alias layer ──────────────────────────────── | COMMENT |
| MEDIUM | …ges/core/tests/unit/plugins/marketplace-client.test.ts | 26 | // ── Helpers ───────────���──────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/core/tests/unit/plugins/define-plugin.test.ts | 269 | // ── Deprecation alias layer ──────────────────────────────── | COMMENT |
| MEDIUM | …es/core/tests/unit/api/registry-artifact-proxy.test.ts | 130 | // ── auth ─────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …es/core/tests/unit/api/registry-artifact-proxy.test.ts | 142 | // ── param validation ─────────────────────────────────────────────── | COMMENT |
| MEDIUM | …es/core/tests/unit/api/registry-artifact-proxy.test.ts | 185 | // ── config ───────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …es/core/tests/unit/api/registry-artifact-proxy.test.ts | 198 | // ── resolution → declared URL is proxied ─────────────────────────── | COMMENT |
| MEDIUM | …es/core/tests/unit/api/registry-artifact-proxy.test.ts | 250 | // ── 404s ─────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …es/core/tests/unit/api/registry-artifact-proxy.test.ts | 277 | // ── content-type allowlist ───────────────────────────────────────── | COMMENT |
| MEDIUM | …es/core/tests/unit/api/registry-artifact-proxy.test.ts | 325 | // ── SSRF on the RESOLVED url ──────────────────────────────────────── | COMMENT |
| MEDIUM | …es/core/tests/unit/api/registry-artifact-proxy.test.ts | 371 | // ── upstream + size ───────────────────────────────────────────────── | COMMENT |
| MEDIUM | …kages/core/tests/unit/api/marketplace-handlers.test.ts | 40 | // ── Mock factories ──────────────────────────────────────────────── | COMMENT |
| MEDIUM | …kages/core/tests/unit/api/marketplace-handlers.test.ts | 291 | // ── Install ──────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …kages/core/tests/unit/api/marketplace-handlers.test.ts | 438 | // ── Update ───────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …kages/core/tests/unit/api/marketplace-handlers.test.ts | 699 | // ── Uninstall ────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …kages/core/tests/unit/api/marketplace-handlers.test.ts | 783 | // ── Update check ─────────────────────────────────────────────── | COMMENT |
| MEDIUM | …kages/core/tests/unit/api/marketplace-handlers.test.ts | 865 | // ── Search proxy ─────────────────────────────────────────────── | COMMENT |
| MEDIUM | …kages/core/tests/unit/api/marketplace-handlers.test.ts | 885 | // ── GetPlugin proxy ──────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/core/tests/unit/api/backup-handlers.test.ts | 30 | // ── Storage fake ──────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/core/tests/unit/api/backup-handlers.test.ts | 92 | // ── Tests ─────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/core/tests/unit/api/registry-handlers.test.ts | 36 | // ── Mock storage ───────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/core/tests/unit/api/registry-handlers.test.ts | 91 | // ── Suite ──────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …s/core/tests/unit/import/wordpress-plugin-i18n.test.ts | 13 | // ─── Mock fetch ────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …s/core/tests/unit/import/wordpress-plugin-i18n.test.ts | 31 | // ─── Fixtures ──────────────────────────────────────────────────────────────── | COMMENT |
| 336 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | infra/discord-bot/src/discord.ts | 102 | export function interactionResponseWithButton( | CODE |
| LOW | infra/flue-review/.flue/sandboxes/cloudflare-shell.ts | 72 | function createWorkspaceSessionEnv( | CODE |
| LOW | packages/blocks/src/validation.ts | 80 | function validateInitialValueInOptions( | CODE |
| LOW | packages/blocks/src/elements/number-input.tsx | 6 | export function NumberInputElementComponent({ | CODE |
| LOW | packages/blocks/src/elements/text-input.tsx | 6 | export function TextInputElementComponent({ | CODE |
| LOW | packages/blocks/src/elements/secret-input.tsx | 6 | export function SecretInputElementComponent({ | CODE |
| LOW | packages/blocks/src/elements/date-input.tsx | 5 | export function DateInputElementComponent({ | CODE |
| LOW | packages/atproto-test-utils/src/fake-publisher.ts | 148 | export function createFakePublisherFixture( | CODE |
| LOW | …ckages/core/tests/unit/plugins/exclusive-hooks.test.ts | 970 | function createSelectCountingPlugin(): { plugin: KyselyPlugin; counter: { count: number } } { | CODE |
| LOW | packages/core/tests/unit/menus/menus.test.ts | 419 | async function insertMenuWithCollectionItem(item: { | CODE |
| LOW | …e/tests/unit/astro/middleware-security-headers.test.ts | 137 | function anonymousPublicPageContext() { | CODE |
| LOW | …ges/core/tests/unit/astro/middleware-prerender.test.ts | 174 | function createAnonymousPublicPageContext(locals: Record<string, unknown> = {}) { | CODE |
| LOW | …ges/core/tests/unit/astro/middleware-prerender.test.ts | 582 | function anonymousCategoryPageContext() { | CODE |
| LOW | packages/core/tests/unit/import/wxr-taxonomies.test.ts | 45 | async function createPostsCollectionWithEntry( | CODE |
| LOW | packages/core/tests/unit/client/client.test.ts | 58 | function mediaUsageRepairCollection( | CODE |
| LOW | …core/tests/integration/smoke/site-matrix-smoke.test.ts | 29 | function nodeOptionsWithFontFetchRetry(): string { | CODE |
| LOW | …tegration/database/media-usage-content-refresh.test.ts | 535 | async function installSourceReplacementConflictTrigger(ctx: DialectTestContext): Promise<void> { | CODE |
| LOW | …tegration/database/media-usage-content-refresh.test.ts | 639 | async function installOneTimeSourceReplacementConflictTrigger( | CODE |
| LOW | …tegration/database/media-usage-content-refresh.test.ts | 747 | async function installDraftOverlayDeletionConflictTrigger(ctx: DialectTestContext): Promise<void> { | CODE |
| LOW | …ntegration/database/media-usage-content-repair.test.ts | 1223 | async function createInvalidRepeaterField( | CODE |
| LOW | …ntegration/database/media-usage-content-repair.test.ts | 1245 | async function setMismatchedDraftRevision( | CODE |
| LOW | …ntegration/database/media-usage-content-repair.test.ts | 1406 | async function installConcurrentPostInsertTrigger(ctx: DialectTestContext): Promise<void> { | CODE |
| LOW | …ntegration/database/media-usage-content-repair.test.ts | 1485 | async function installConcurrentPostDeleteTrigger(ctx: DialectTestContext): Promise<void> { | CODE |
| LOW | …ntegration/database/media-usage-content-repair.test.ts | 1519 | async function installStaleStatusTrigger(ctx: DialectTestContext): Promise<void> { | CODE |
| LOW | …ntegration/database/media-usage-content-repair.test.ts | 1562 | async function installDoomedCollectionDeleteTrigger(ctx: DialectTestContext): Promise<void> { | CODE |
| LOW | …ntegration/database/media-usage-content-repair.test.ts | 1596 | async function installVanishingCollectionDeleteTrigger(ctx: DialectTestContext): Promise<void> { | CODE |
| LOW | …ntegration/database/media-usage-content-repair.test.ts | 1630 | async function installRecreatedCollectionRecreateTrigger(ctx: DialectTestContext): Promise<void> { | CODE |
| LOW | …ntegration/database/media-usage-content-repair.test.ts | 1702 | async function installFresherColumnsSourceDuringRepairTrigger( | CODE |
| LOW | …ntegration/database/media-usage-content-repair.test.ts | 1884 | async function installFresherDraftSourceDuringRepairTrigger( | CODE |
| LOW | …gration/database/media-usage-content-snapshots.test.ts | 596 | async function allowMissingDraftRevision(ctx: DialectTestContext): Promise<void> { | CODE |
| LOW | …ts/integration/database/media-usage-repository.test.ts | 1386 | async function insertOccurrenceGeneration( | CODE |
| LOW | …ts/integration/database/media-usage-repository.test.ts | 1437 | async function installSourceDeleteFailureTrigger(ctx: DialectTestContext): Promise<void> { | CODE |
| LOW | …tegration/database/media-usage-runtime-refresh.test.ts | 892 | async function corruptFuturePostDraftRevisionSnapshots(ctx: DialectTestContext): Promise<void> { | CODE |
| LOW | …/integration/database/media-usage-stale-bypass.test.ts | 273 | async function createCollectionWithFields(slug: string) { | CODE |
| LOW | packages/core/tests/integration/mcp/search.test.ts | 31 | async function setupSearchablePostCollection(db: Kysely<Database>): Promise<void> { | CODE |
| LOW | packages/core/tests/utils/test-db.ts | 26 | function resetSchemaCachesForTests(): void { | CODE |
| LOW | packages/core/tests/utils/test-db.ts | 76 | export async function setupTestDatabaseWithCollections(): Promise<Kysely<DatabaseSchema>> { | CODE |
| LOW | packages/core/tests/utils/test-db.ts | 176 | function getWorkerConnectionString(): Promise<string> { | CODE |
| LOW | packages/core/tests/utils/test-db.ts | 266 | export async function createTestPostgresDatabase(): Promise<PgTestContext> { | CODE |
| LOW | packages/core/tests/utils/test-db.ts | 301 | export async function setupTestPostgresDatabase(): Promise<PgTestContext> { | CODE |
| LOW | packages/core/tests/utils/test-db.ts | 310 | export async function setupTestPostgresDatabaseWithCollections(): Promise<PgTestContext> { | CODE |
| LOW | packages/core/tests/utils/test-db.ts | 352 | export async function teardownTestPostgresDatabase(ctx: PgTestContext): Promise<void> { | CODE |
| LOW | packages/core/tests/utils/test-db.ts | 416 | export async function setupForDialectWithCollections( | CODE |
| LOW | packages/core/tests/utils/test-db.ts | 443 | export function getMigrationStatusForDialect(ctx: DialectTestContext): Promise<MigrationStatus> { | CODE |
| LOW | packages/core/src/plugin-utils.ts | 39 | export function getPublicPluginApiRouteHandler( | CODE |
| LOW | packages/core/src/emdash-runtime.ts | 102 | function isValidMetadataContribution(c: unknown): c is PageMetadataContribution { | CODE |
| LOW | packages/core/src/query.ts | 1336 | export function invalidateUrlPatternCache(): void { | CODE |
| LOW | packages/core/src/settings/index.ts | 66 | export function invalidateSiteSettingsCache(): void { | CODE |
| LOW | packages/core/src/database/connection.ts | 22 | export function formatNativeModuleVersionError(error: unknown): string | null { | CODE |
| LOW | …kages/core/src/database/repositories/plugin-storage.ts | 318 | export function createPluginStorageAccessor( | CODE |
| LOW | packages/core/src/comments/notifications.ts | 33 | export function buildCommentNotificationEmail( | CODE |
| LOW | packages/core/src/page/seo-contributions.ts | 28 | export function generateBaseSeoContributions( | CODE |
| LOW | packages/core/src/page/seo-contributions.ts | 157 | export function generateSiteSeoContributions( | CODE |
| LOW | packages/core/src/seed/apply.ts | 1417 | function getExtensionFromContentType(contentType: string): string | null { | CODE |
| LOW | packages/core/src/config/secrets.ts | 351 | export async function validateEncryptionKeyAtStartup(env?: SecretsEnv): Promise<boolean> { | CODE |
| LOW | packages/core/src/security/ssrf.ts | 388 | export async function resolveAndValidateExternalUrl( | CODE |
| LOW | packages/core/src/auth/allowed-origins.ts | 34 | export function getConfiguredAllowedOrigins(config?: EmDashConfig): TaggedOrigin[] { | CODE |
| LOW | packages/core/src/plugins/context.ts | 368 | export function createContentAccessWithWrite(db: Kysely<Database>): ContentAccessWithWrite { | CODE |
| LOW | packages/core/src/plugins/context.ts | 549 | export function createMediaAccessWithWrite( | CODE |
| LOW | packages/core/src/plugins/context.ts | 756 | export function createUnrestrictedHttpAccess(pluginId: string): HttpAccess { | CODE |
| 186 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | infra/perf-monitor/worker-configuration.d.ts | 11961 | // PubSubMessage represents an incoming PubSub message. | COMMENT |
| LOW | infra/perf-monitor/worker-configuration.d.ts | 12081 | // Note `unknown & T` is equivalent to `T`. | COMMENT |
| LOW | infra/perf-monitor/worker-configuration.d.ts | 12101 | type MaybeCallableProvider<T> = T extends (...args: any[]) => any ? MethodOrProperty<T> : unknown; | COMMENT |
| LOW | infra/perf-monitor/worker-configuration.d.ts | 12121 | // declaration will be merged with this one. | COMMENT |
| LOW | infra/perf-monitor/worker-configuration.d.ts | 13201 | } | COMMENT |
| LOW | infra/discord-bot/worker-configuration.d.ts | 13041 | } | COMMENT |
| LOW | infra/discord-bot/worker-configuration.d.ts | 13221 | [K in keyof T]: MethodOrProperty<T[K]>; | COMMENT |
| LOW | infra/discord-bot/worker-configuration.d.ts | 13241 | // interface GlobalProps { | COMMENT |
| LOW | infra/flue-review/.flue/app.ts | 1 | // Custom Flue application: the GitHub App webhook orchestrator. | COMMENT |
| LOW | infra/flue-review/.flue/workflows/review.ts | 1 | // Review workflow (Cloudflare target) -- cf-shell (Cloudflare Shell) variant. | COMMENT |
| LOW | infra/flue-review/.flue/workflows/review.ts | 81 | } | COMMENT |
| LOW | infra/flue-review/.flue/lib/capacity.ts | 1 | // Graceful handling for Workers AI capacity (HTTP 429) errors and stalled | COMMENT |
| LOW | .flue/workflows/investigate.ts | 1 | // Investigate workflow. | COMMENT |
| LOW | .flue/workflows/investigate.ts | 21 | // implements diagnose's proposedFix). Writes the change, runs the | COMMENT |
| LOW | .flue/workflows/investigate.ts | 101 | // markdown, but unescaped `]` could close the alt-text | COMMENT |
| LOW | .flue/workflows/investigate.ts | 561 | COMMENT | |
| LOW | .flue/scripts/run-local.ts | 1 | // Local prototype runner. | COMMENT |
| LOW | .flue/lib/capacity.ts | 1 | // Graceful handling for Workers AI capacity (HTTP 429) errors and stalled | COMMENT |
| LOW | docs/worker-configuration.d.ts | 12261 | // Message ID | COMMENT |
| LOW | docs/worker-configuration.d.ts | 12401 | }; | COMMENT |
| LOW | docs/worker-configuration.d.ts | 12441 | // Type of `env`. | COMMENT |
| LOW | docs/worker-configuration.d.ts | 12461 | // // thus should behave as Durable Object namsepace bindings. | COMMENT |
| LOW | scripts/sync-blog-demos.sh | 1 | #!/bin/bash | COMMENT |
| LOW | packages/core/tsdown.config.ts | 121 | // Standard plugin adapter (loaded by virtual:emdash/plugins at runtime) | COMMENT |
| LOW | packages/core/tests/unit/settings/settings.test.ts | 461 | // URL, contentType, width, and height into a worker-scoped cache. Every code | COMMENT |
| LOW | …s/core/tests/unit/database/repositories/byline.test.ts | 1281 | // Both posts must see the byline with its customFields populated | COMMENT |
| LOW | packages/core/tests/unit/config/secrets.test.ts | 121 | // has zero low-2-bits: A(0), E(4), I(8), M(12), Q(16), U(20), | COMMENT |
| LOW | packages/core/tests/unit/bylines/bylines-query.test.ts | 361 | // the per-bucket findByUserIds calls each fired their own | COMMENT |
| LOW | packages/core/tests/unit/import/ssrf.test.ts | 621 | }); | COMMENT |
| LOW | …ore/tests/integration/redirects/log404-bounded.test.ts | 181 | COMMENT | |
| LOW | …sts/integration/api/bylines-customfields-write.test.ts | 101 | beforeEach(async () => { | COMMENT |
| LOW | …tegration/wordpress-import/wxr-i18n-taxonomies.test.ts | 841 | // disagree only on `tag`. | COMMENT |
| LOW | packages/core/tests/utils/mcp-runtime.ts | 81 | // --------------------------------------------------------------------------- | COMMENT |
| LOW | packages/core/tests/utils/test-db.ts | 121 | await db.destroy(); | COMMENT |
| LOW | packages/core/src/loader.ts | 1401 | const locale = filter?.locale; | COMMENT |
| LOW | packages/core/src/emdash-runtime.ts | 1081 | const db = await phase("rt.db", "DB init + migrations", () => EmDashRuntime.getDatabase(deps)); | COMMENT |
| LOW | packages/core/src/emdash-runtime.ts | 1701 | // piling up as idle Postgres connections). | COMMENT |
| LOW | packages/core/src/emdash-runtime.ts | 2581 | // Return a clone rather than mutating in place. The response | COMMENT |
| LOW | packages/core/src/query.ts | 621 | // | COMMENT |
| LOW | packages/core/src/plugins/marketplace.ts | 381 | * same parse / validate / hash primitive. Despite the file name, this | COMMENT |
| LOW | packages/core/src/plugins/types.ts | 1461 | // wire shape uses looser types like `string` for hook names so the registry | COMMENT |
| LOW | packages/core/src/schema/zod-generator.ts | 81 | // `deserializeValue` never converts them back, so reads return | COMMENT |
| LOW | packages/core/src/api/handlers/content.ts | 721 | COMMENT | |
| LOW | packages/core/src/api/handlers/taxonomies.ts | 481 | }; | COMMENT |
| LOW | packages/core/src/api/handlers/registry.ts | 741 | error: { | COMMENT |
| LOW | packages/core/src/api/handlers/registry.ts | 821 | // Step 3a: enforce the configured minimum release age. The browser | COMMENT |
| LOW | packages/core/src/api/handlers/registry.ts | 1041 | error: { | COMMENT |
| LOW | packages/core/src/api/handlers/registry.ts | 1061 | // | COMMENT |
| LOW | packages/core/src/api/handlers/registry.ts | 1101 | // Step 7: store in R2 under the registry prefix. | COMMENT |
| LOW | packages/core/src/api/handlers/registry.ts | 1121 | // loser of that race would delete the winner's bundle and the | COMMENT |
| LOW | packages/core/src/bylines/index.ts | 221 | // Pre-migration databases (bylines table missing) fall through to the | COMMENT |
| LOW | packages/core/src/astro/middleware.ts | 481 | // so auth middleware can verify their session for visual editing | COMMENT |
| LOW | packages/core/src/astro/middleware.ts | 521 | // Public pages call getSiteSettings() / getMenu() via getDb(), which | COMMENT |
| LOW | packages/core/src/astro/middleware.ts | 621 | ? { ...parent, db: anonScoped.db } | COMMENT |
| LOW | packages/core/src/astro/middleware.ts | 741 | COMMENT | |
| LOW | packages/core/src/astro/middleware/request-context.ts | 221 | const needsContext = hasEditCookie || hasPreviewToken; | COMMENT |
| LOW | packages/core/src/astro/integration/vite-config.ts | 301 | // Generate wait-until module — re-exports cloudflare:workers' | COMMENT |
| LOW | packages/core/src/astro/integration/vite-config.ts | 381 | // The styles.css alias must come before the package alias, otherwise | COMMENT |
| LOW | packages/core/src/astro/integration/vite-config.ts | 421 | }, | COMMENT |
| LOW | packages/core/src/astro/integration/vite-config.ts | 441 | // Exclude EmDash virtual modules from esbuild's dependency | COMMENT |
| 103 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | packages/blocks/src/validation.ts | 188 | message: "Field 'placeholder' must be a string", | CODE |
| LOW | packages/blocks/src/validation.ts | 293 | message: "Field 'placeholder' must be a string", | CODE |
| LOW | packages/blocks/src/validation.ts | 414 | message: "Field 'placeholder' must be a string", | CODE |
| LOW | packages/blocks/src/validation.ts | 462 | message: "Field 'placeholder' must be a string", | CODE |
| LOW | packages/blocks/src/validation.ts | 581 | message: "Field 'placeholder' must be a string", | CODE |
| LOW | …s/core/tests/unit/database/repositories/byline.test.ts | 36 | displayName: "Jane Doe", | CODE |
| LOW | …s/core/tests/unit/database/repositories/byline.test.ts | 41 | expect(created.displayName).toBe("Jane Doe"); | CODE |
| LOW | …s/core/tests/unit/database/repositories/byline.test.ts | 400 | displayName: "Jane Doe", | CODE |
| LOW | …s/core/tests/unit/database/repositories/byline.test.ts | 410 | displayName: "Jane Doe", | CODE |
| LOW | …s/core/tests/unit/database/repositories/byline.test.ts | 439 | displayName: "Jane Doe", | CODE |
| LOW | …s/core/tests/unit/database/repositories/byline.test.ts | 456 | displayName: "Jane Doe", | CODE |
| LOW | …s/core/tests/unit/database/repositories/byline.test.ts | 470 | expect(enHit?.displayName).toBe("Jane Doe"); | CODE |
| LOW | …s/core/tests/unit/database/repositories/byline.test.ts | 508 | displayName: "Jane Doe", | CODE |
| LOW | …s/core/tests/unit/database/repositories/byline.test.ts | 536 | displayName: "Jane Doe", | CODE |
| LOW | …s/core/tests/unit/database/repositories/byline.test.ts | 567 | displayName: "Jane Doe", | CODE |
| LOW | …s/core/tests/unit/database/repositories/byline.test.ts | 592 | displayName: "Jane Doe", | CODE |
| LOW | …s/core/tests/unit/database/repositories/byline.test.ts | 613 | expect(enCredits[0]?.byline.displayName).toBe("Jane Doe"); | CODE |
| LOW | …s/core/tests/unit/database/repositories/byline.test.ts | 621 | displayName: "Jane Doe", | CODE |
| LOW | …s/core/tests/unit/database/repositories/byline.test.ts | 651 | displayName: "Jane Doe", | CODE |
| LOW | …s/core/tests/unit/database/repositories/byline.test.ts | 677 | displayName: "Jane Doe", | CODE |
| LOW | …s/core/tests/unit/database/repositories/byline.test.ts | 704 | expect(enResult.get(enPost.id)?.[0]?.byline.displayName).toBe("Jane Doe"); | CODE |
| LOW | …s/core/tests/unit/database/repositories/byline.test.ts | 705 | expect(enResult.get(frPost.id)?.[0]?.byline.displayName).toBe("Jane Doe"); | CODE |
| LOW | …s/core/tests/unit/database/repositories/byline.test.ts | 717 | displayName: "Jane Doe", | CODE |
| LOW | …s/core/tests/unit/database/repositories/byline.test.ts | 780 | displayName: "Jane Doe", | CODE |
| LOW | …s/core/tests/unit/database/repositories/byline.test.ts | 847 | displayName: "Jane Doe", | CODE |
| LOW | …s/core/tests/unit/database/repositories/byline.test.ts | 878 | displayName: "Jane Doe", | CODE |
| LOW | …s/core/tests/unit/database/repositories/byline.test.ts | 910 | displayName: "Jane Doe", | CODE |
| LOW | …s/core/tests/unit/database/repositories/byline.test.ts | 941 | displayName: "Jane Doe", | CODE |
| LOW | …s/core/tests/unit/database/repositories/byline.test.ts | 988 | displayName: "Jane Doe", | CODE |
| LOW | …s/core/tests/unit/database/repositories/byline.test.ts | 2073 | await bylineRepo.update(byline.id, { displayName: "Jane Doe" }); | CODE |
| LOW | …s/core/tests/unit/database/repositories/byline.test.ts | 2076 | expect(reloaded?.displayName).toBe("Jane Doe"); | CODE |
| LOW | …/tests/unit/auth/invite-register-options-route.test.ts | 41 | email: "admin@example.com", | CODE |
| LOW | packages/core/tests/unit/auth/oauth-invite.test.ts | 32 | email: "admin@example.com", | CODE |
| LOW | packages/core/tests/unit/auth/invite.test.ts | 35 | email: "admin@example.com", | CODE |
| LOW | packages/core/tests/unit/plugins/email-pipeline.test.ts | 81 | to: "user@example.com", | CODE |
| LOW | packages/core/tests/unit/plugins/email-pipeline.test.ts | 1154 | to: "admin@example.com", | CODE |
| LOW | packages/core/tests/unit/plugins/email-pipeline.test.ts | 1167 | to: "admin@example.com", | CODE |
| LOW | packages/core/tests/unit/plugins/email-pipeline.test.ts | 1199 | await emailPipeline.send(createTestMessage({ to: "admin@example.com" }), "system"); | CODE |
| LOW | packages/core/tests/unit/plugins/email-pipeline.test.ts | 1305 | await emailPipeline.send(createTestMessage({ to: "user@example.com" }), "some-plugin"); | CODE |
| LOW | packages/core/tests/unit/plugins/email-pipeline.test.ts | 1308 | expect(infoSpy).toHaveBeenCalledWith(expect.stringContaining("user@example.com")); | CODE |
| LOW | packages/core/tests/unit/cli/wxr-parser.test.ts | 211 | expect(result.authors[0]?.email).toBe("admin@example.com"); | CODE |
| LOW | packages/core/tests/unit/api/content-handlers.test.ts | 350 | displayName: "Jane Doe", | CODE |
| LOW | packages/core/tests/unit/api/content-handlers.test.ts | 383 | displayName: "Jane Doe", | CODE |
| LOW | packages/core/tests/unit/api/content-handlers.test.ts | 451 | displayName: "Jane Doe", | CODE |
| LOW | packages/core/tests/unit/api/content-handlers.test.ts | 600 | displayName: "Jane Doe", | CODE |
| LOW | packages/core/tests/unit/api/handlers/bylines.test.ts | 30 | displayName: "Jane Doe", | CODE |
| LOW | packages/core/tests/unit/api/handlers/bylines.test.ts | 71 | displayName: "Jane Doe", | CODE |
| LOW | packages/core/tests/unit/api/handlers/bylines.test.ts | 99 | displayName: "Jane Doe", | CODE |
| LOW | packages/core/tests/unit/api/handlers/bylines.test.ts | 134 | displayName: "Jane Doe", | CODE |
| LOW | packages/core/tests/unit/api/handlers/bylines.test.ts | 164 | displayName: "Jane Doe", | CODE |
| LOW | packages/core/tests/unit/api/handlers/bylines.test.ts | 193 | displayName: "Jane Doe", | CODE |
| LOW | packages/core/tests/unit/bylines/bylines-query.test.ts | 46 | displayName: "Jane Doe", | CODE |
| LOW | packages/core/tests/unit/bylines/bylines-query.test.ts | 53 | expect(result?.displayName).toBe("Jane Doe"); | CODE |
| LOW | packages/core/tests/unit/bylines/bylines-query.test.ts | 90 | displayName: "Jane Doe", | CODE |
| LOW | packages/core/tests/unit/bylines/bylines-query.test.ts | 103 | expect(result?.displayName).toBe("Jane Doe"); | CODE |
| LOW | packages/core/tests/unit/bylines/bylines-query.test.ts | 114 | displayName: "Jane Doe", | CODE |
| LOW | packages/core/tests/unit/bylines/bylines-query.test.ts | 561 | displayName: "Jane Doe", | CODE |
| LOW | packages/core/tests/unit/bylines/bylines-query.test.ts | 581 | expect(enCredits[0]?.byline.displayName).toBe("Jane Doe"); | CODE |
| LOW | packages/core/tests/unit/bylines/bylines-query.test.ts | 606 | displayName: "Jane Doe", | CODE |
| LOW | packages/core/tests/unit/bylines/bylines-query.test.ts | 631 | displayName: "Jane Doe", | CODE |
| 74 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …ckages/core/tests/integration/auth/device-flow.test.ts | 104 | // Step 1: Request device code | COMMENT |
| LOW⚡ | …ckages/core/tests/integration/auth/device-flow.test.ts | 115 | // Step 2: Poll before authorization → pending | COMMENT |
| LOW⚡ | …ckages/core/tests/integration/auth/device-flow.test.ts | 123 | // Step 3: User authorizes (admin role = 50) | COMMENT |
| LOW⚡ | …ckages/core/tests/integration/auth/device-flow.test.ts | 131 | // Step 4: Exchange for tokens | COMMENT |
| LOW⚡ | …ckages/core/tests/integration/auth/device-flow.test.ts | 145 | // Step 5: Device code should be consumed | COMMENT |
| LOW⚡ | …ckages/core/tests/integration/auth/device-flow.test.ts | 153 | // Step 6: Tokens should be stored | COMMENT |
| LOW⚡ | …core/tests/integration/auth/authorization-code.test.ts | 166 | // Step 1: Generate PKCE pair | COMMENT |
| LOW⚡ | …core/tests/integration/auth/authorization-code.test.ts | 170 | // Step 2: Get authorization code | COMMENT |
| LOW | …core/tests/integration/auth/authorization-code.test.ts | 186 | // Step 3: Exchange code for tokens | COMMENT |
| LOW | …core/tests/integration/auth/authorization-code.test.ts | 203 | // Step 4: Verify tokens are stored | COMMENT |
| LOW | …core/tests/integration/auth/authorization-code.test.ts | 215 | // Step 5: Authorization code is consumed (single-use) | COMMENT |
| LOW⚡ | …/core/tests/integration/client/oauth-discovery.test.ts | 43 | // Step 1: get the authorization server URL from protected resource metadata | COMMENT |
| LOW⚡ | …/core/tests/integration/client/oauth-discovery.test.ts | 49 | // Step 2: the SDK constructs /.well-known/oauth-authorization-server/_emdash | COMMENT |
| LOW⚡ | packages/core/src/cli/commands/publish.ts | 76 | // Step 1: Fetch auth discovery to get GitHub client_id | COMMENT |
| LOW⚡ | packages/core/src/cli/commands/publish.ts | 84 | // Step 2: Request device code from GitHub | COMMENT |
| LOW | packages/core/src/cli/commands/publish.ts | 103 | // Step 3: Display instructions | COMMENT |
| LOW⚡ | packages/core/src/cli/commands/publish.ts | 125 | // Step 4: Poll GitHub for access token | COMMENT |
| LOW⚡ | packages/core/src/cli/commands/publish.ts | 135 | // Step 5: Exchange GitHub token for marketplace JWT | COMMENT |
| LOW | packages/core/src/cli/commands/login.ts | 208 | // Step 1: Fetch auth discovery. | COMMENT |
| LOW | packages/core/src/cli/commands/login.ts | 263 | // Step 2: Request device code | COMMENT |
| LOW | packages/core/src/cli/commands/login.ts | 285 | // Step 3: Display instructions | COMMENT |
| LOW | packages/core/src/cli/commands/login.ts | 307 | // Step 4: Poll for token | COMMENT |
| LOW | packages/core/src/cli/commands/login.ts | 319 | // Step 5: Fetch user info | COMMENT |
| LOW | packages/core/src/cli/commands/login.ts | 346 | // Step 6: Save credentials (persist custom headers so subsequent commands inherit them) | COMMENT |
| LOW⚡ | packages/core/src/api/handlers/registry.ts | 685 | // Step 1: look up the package by DID + slug. The browser already | COMMENT |
| LOW⚡ | packages/core/src/api/handlers/registry.ts | 695 | // Step 2: select the target release. | COMMENT |
| LOW⚡ | packages/core/src/api/handlers/registry.ts | 1101 | // Step 7: store in R2 under the registry prefix. | COMMENT |
| LOW⚡ | packages/core/src/api/handlers/registry.ts | 1104 | // Step 8: write plugin state. | COMMENT |
| LOW | packages/core/src/api/handlers/registry.ts | 791 | // Step 3: takedown label check (hard-enforced via aggregator's | COMMENT |
| LOW | packages/core/src/api/handlers/registry.ts | 938 | // Step 4: fetch the artifact bytes. | COMMENT |
| LOW | packages/core/src/api/handlers/registry.ts | 960 | // Step 5: verify the bytes against the signed record's checksum. | COMMENT |
| LOW | packages/core/src/api/handlers/registry.ts | 973 | // Step 6: extract the bundle. | COMMENT |
| LOW⚡ | packages/marketplace/src/workflows/audit.ts | 75 | // Step 1: Run code audit | COMMENT |
| LOW | packages/marketplace/src/workflows/audit.ts | 96 | // Step 2: Run image audit (skip if no images) | COMMENT |
| LOW | packages/marketplace/src/workflows/audit.ts | 112 | // Step 3: Store results in D1 and link to version | COMMENT |
| LOW | packages/marketplace/src/workflows/audit.ts | 146 | // Step 4: Resolve version status and update D1 | COMMENT |
| LOW | packages/admin/src/components/auth/PasskeyLogin.tsx | 165 | // Step 1: Get authentication options from server | COMMENT |
| LOW | packages/admin/src/components/auth/PasskeyLogin.tsx | 179 | // Step 2: Get assertion from browser | COMMENT |
| LOW | packages/admin/src/components/auth/PasskeyLogin.tsx | 210 | // Step 3: Send credential to server for verification | COMMENT |
| LOW | …ages/admin/src/components/auth/PasskeyRegistration.tsx | 169 | // Step 1: Get registration options from server | COMMENT |
| LOW | …ages/admin/src/components/auth/PasskeyRegistration.tsx | 183 | // Step 2: Create credential with browser | COMMENT |
| LOW | …ages/admin/src/components/auth/PasskeyRegistration.tsx | 214 | // Step 3: Send credential to server for verification | COMMENT |
| LOW⚡ | e2e/tests/invite-flow.spec.ts | 192 | // Step 1: Create invite via server-side API | COMMENT |
| LOW⚡ | e2e/tests/invite-flow.spec.ts | 196 | // Step 2: Set up virtual authenticator | COMMENT |
| LOW⚡ | e2e/tests/invite-flow.spec.ts | 200 | // Step 3: Navigate to invite accept page | COMMENT |
| LOW⚡ | e2e/tests/invite-flow.spec.ts | 204 | // Step 4: Verify the registration form renders | COMMENT |
| LOW⚡ | e2e/tests/invite-flow.spec.ts | 210 | // Step 5: Fill in name and click Create Account | COMMENT |
| LOW⚡ | e2e/tests/invite-flow.spec.ts | 216 | // Step 6: Wait for passkey flow to complete and redirect | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …ckages/core/tests/integration/auth/device-flow.test.ts | 104 | // Step 1: Request device code | COMMENT |
| LOW⚡ | …ckages/core/tests/integration/auth/device-flow.test.ts | 115 | // Step 2: Poll before authorization → pending | COMMENT |
| LOW⚡ | …ckages/core/tests/integration/auth/device-flow.test.ts | 123 | // Step 3: User authorizes (admin role = 50) | COMMENT |
| LOW⚡ | …ckages/core/tests/integration/auth/device-flow.test.ts | 131 | // Step 4: Exchange for tokens | COMMENT |
| LOW⚡ | …ckages/core/tests/integration/auth/device-flow.test.ts | 145 | // Step 5: Device code should be consumed | COMMENT |
| LOW⚡ | …ckages/core/tests/integration/auth/device-flow.test.ts | 153 | // Step 6: Tokens should be stored | COMMENT |
| LOW⚡ | …core/tests/integration/auth/authorization-code.test.ts | 166 | // Step 1: Generate PKCE pair | COMMENT |
| LOW⚡ | …core/tests/integration/auth/authorization-code.test.ts | 170 | // Step 2: Get authorization code | COMMENT |
| LOW | …core/tests/integration/auth/authorization-code.test.ts | 186 | // Step 3: Exchange code for tokens | COMMENT |
| LOW | …core/tests/integration/auth/authorization-code.test.ts | 203 | // Step 4: Verify tokens are stored | COMMENT |
| LOW | …core/tests/integration/auth/authorization-code.test.ts | 215 | // Step 5: Authorization code is consumed (single-use) | COMMENT |
| LOW⚡ | …/core/tests/integration/client/oauth-discovery.test.ts | 43 | // Step 1: get the authorization server URL from protected resource metadata | COMMENT |
| LOW⚡ | …/core/tests/integration/client/oauth-discovery.test.ts | 49 | // Step 2: the SDK constructs /.well-known/oauth-authorization-server/_emdash | COMMENT |
| LOW⚡ | packages/core/src/cli/commands/publish.ts | 76 | // Step 1: Fetch auth discovery to get GitHub client_id | COMMENT |
| LOW⚡ | packages/core/src/cli/commands/publish.ts | 84 | // Step 2: Request device code from GitHub | COMMENT |
| LOW | packages/core/src/cli/commands/publish.ts | 103 | // Step 3: Display instructions | COMMENT |
| LOW⚡ | packages/core/src/cli/commands/publish.ts | 125 | // Step 4: Poll GitHub for access token | COMMENT |
| LOW⚡ | packages/core/src/cli/commands/publish.ts | 135 | // Step 5: Exchange GitHub token for marketplace JWT | COMMENT |
| LOW | packages/core/src/cli/commands/login.ts | 208 | // Step 1: Fetch auth discovery. | COMMENT |
| LOW | packages/core/src/cli/commands/login.ts | 263 | // Step 2: Request device code | COMMENT |
| LOW | packages/core/src/cli/commands/login.ts | 285 | // Step 3: Display instructions | COMMENT |
| LOW | packages/core/src/cli/commands/login.ts | 307 | // Step 4: Poll for token | COMMENT |
| LOW | packages/core/src/cli/commands/login.ts | 319 | // Step 5: Fetch user info | COMMENT |
| LOW | packages/core/src/cli/commands/login.ts | 346 | // Step 6: Save credentials (persist custom headers so subsequent commands inherit them) | COMMENT |
| LOW⚡ | packages/core/src/api/handlers/registry.ts | 685 | // Step 1: look up the package by DID + slug. The browser already | COMMENT |
| LOW⚡ | packages/core/src/api/handlers/registry.ts | 695 | // Step 2: select the target release. | COMMENT |
| LOW⚡ | packages/core/src/api/handlers/registry.ts | 1101 | // Step 7: store in R2 under the registry prefix. | COMMENT |
| LOW⚡ | packages/core/src/api/handlers/registry.ts | 1104 | // Step 8: write plugin state. | COMMENT |
| LOW | packages/core/src/api/handlers/registry.ts | 791 | // Step 3: takedown label check (hard-enforced via aggregator's | COMMENT |
| LOW | packages/core/src/api/handlers/registry.ts | 938 | // Step 4: fetch the artifact bytes. | COMMENT |
| LOW | packages/core/src/api/handlers/registry.ts | 960 | // Step 5: verify the bytes against the signed record's checksum. | COMMENT |
| LOW | packages/core/src/api/handlers/registry.ts | 973 | // Step 6: extract the bundle. | COMMENT |
| LOW⚡ | packages/marketplace/src/workflows/audit.ts | 75 | // Step 1: Run code audit | COMMENT |
| LOW | packages/marketplace/src/workflows/audit.ts | 96 | // Step 2: Run image audit (skip if no images) | COMMENT |
| LOW | packages/marketplace/src/workflows/audit.ts | 112 | // Step 3: Store results in D1 and link to version | COMMENT |
| LOW | packages/marketplace/src/workflows/audit.ts | 146 | // Step 4: Resolve version status and update D1 | COMMENT |
| LOW | packages/admin/src/components/auth/PasskeyLogin.tsx | 165 | // Step 1: Get authentication options from server | COMMENT |
| LOW | packages/admin/src/components/auth/PasskeyLogin.tsx | 179 | // Step 2: Get assertion from browser | COMMENT |
| LOW | packages/admin/src/components/auth/PasskeyLogin.tsx | 210 | // Step 3: Send credential to server for verification | COMMENT |
| LOW | …ages/admin/src/components/auth/PasskeyRegistration.tsx | 169 | // Step 1: Get registration options from server | COMMENT |
| LOW | …ages/admin/src/components/auth/PasskeyRegistration.tsx | 183 | // Step 2: Create credential with browser | COMMENT |
| LOW | …ages/admin/src/components/auth/PasskeyRegistration.tsx | 214 | // Step 3: Send credential to server for verification | COMMENT |
| LOW⚡ | e2e/tests/invite-flow.spec.ts | 192 | // Step 1: Create invite via server-side API | COMMENT |
| LOW⚡ | e2e/tests/invite-flow.spec.ts | 196 | // Step 2: Set up virtual authenticator | COMMENT |
| LOW⚡ | e2e/tests/invite-flow.spec.ts | 200 | // Step 3: Navigate to invite accept page | COMMENT |
| LOW⚡ | e2e/tests/invite-flow.spec.ts | 204 | // Step 4: Verify the registration form renders | COMMENT |
| LOW⚡ | e2e/tests/invite-flow.spec.ts | 210 | // Step 5: Fill in name and click Create Account | COMMENT |
| LOW⚡ | e2e/tests/invite-flow.spec.ts | 216 | // Step 6: Wait for passkey flow to complete and redirect | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | infra/perf-monitor/README.md | 122 | pnpm db:migrations:create # scaffold a new migration file | CODE |
| MEDIUM⚡ | packages/create-emdash/CHANGELOG.md | 78 | - [#900](https://github.com/emdash-cms/emdash/pull/900) [`b3d1f40`](https://github.com/emdash-cms/emdash/commit/b3d1f40b | CODE |
| MEDIUM⚡ | packages/create-emdash/CHANGELOG.md | 78 | - [#900](https://github.com/emdash-cms/emdash/pull/900) [`b3d1f40`](https://github.com/emdash-cms/emdash/commit/b3d1f40b | CODE |
| MEDIUM⚡ | packages/create-emdash/CHANGELOG.md | 84 | - [#859](https://github.com/emdash-cms/emdash/pull/859) [`3015280`](https://github.com/emdash-cms/emdash/commit/30152807 | CODE |
| MEDIUM | packages/create-emdash/CHANGELOG.md | 128 | - [#785](https://github.com/emdash-cms/emdash/pull/785) [`e0dd616`](https://github.com/emdash-cms/emdash/commit/e0dd6168 | CODE |
| MEDIUM | packages/create-emdash/CHANGELOG.md | 128 | - [#785](https://github.com/emdash-cms/emdash/pull/785) [`e0dd616`](https://github.com/emdash-cms/emdash/commit/e0dd6168 | CODE |
| MEDIUM | packages/create-emdash/tests/utils.test.ts | 234 | // scaffold-time-no-emdash-dep constraint) so both need their own tests. | COMMENT |
| MEDIUM | packages/create-emdash/src/flags.ts | 119 | // Positional name: first non-flag arg. We accept "." for "scaffold into | COMMENT |
| MEDIUM | packages/plugin-cli/tests/init-scaffold.test.ts | 80 | // `version` is intentionally omitted from the scaffold manifest; | COMMENT |
| MEDIUM | packages/plugin-cli/tests/init-scaffold.test.ts | 88 | // Minimal scaffold writes TODO placeholders. The loader's JSONC | COMMENT |
| MEDIUM | packages/plugin-cli/tests/init-scaffold.test.ts | 138 | // The scaffold wrote the real package.json over the stub. | COMMENT |
| MEDIUM | packages/plugin-cli/tests/init-scaffold.test.ts | 160 | // scaffold.ts). The exact order is part of the API surface | COMMENT |
| MEDIUM | packages/plugin-cli/tests/init-templates.test.ts | 63 | // `version` deliberately omitted from the manifest scaffold — | COMMENT |
| MEDIUM | packages/plugin-cli/tests/init-templates.test.ts | 228 | // definePlugin must not appear in the scaffold — it's | COMMENT |
| MEDIUM | packages/plugin-cli/src/init/scaffold.ts | 93 | // partial scaffold can't leave the target dir in a half-broken state. | COMMENT |
| MEDIUM | packages/plugin-cli/src/init/templates.ts | 99 | // plugins (no package.json) would set it here, but the scaffold | COMMENT |
| MEDIUM | packages/plugin-cli/src/commands/init.ts | 609 | consola.info(` 3. ${pc.cyan("pnpm test")} # confirm the scaffold passes its own test`); | CODE |
| MEDIUM | .github/workflows/review.yml | 133 | # remain enabled in the agent definition so it can scaffold fixes | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | CONTRIBUTING.md | 136 | ### AI-generated PRs | COMMENT |
| HIGH | .github/PULL_REQUEST_TEMPLATE.md | 32 | ## AI-generated code disclosure | COMMENT |
| HIGH | .github/PULL_REQUEST_TEMPLATE.md | 34 | <!-- If any part of this PR was generated by AI tools (Copilot, Claude, GPT, Cursor, etc.), check the box and name the m | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | .github/workflows/query-counts-apply.yml | 89 | // matches the workflow_run's head SHA. This is more robust | COMMENT |