The cross-browser extension framework.
This report summarizes scanner evidence for extension-js/extension.js, a TypeScript project with 5,187 GitHub stars. SynthScan examined 283,440 lines of code across 1450 source files, recording 1239 pattern matches distributed across 6 syntactic categories. The legacy adjusted pattern signal is 8.5 (Moderate pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Can maintainers explain intent, assumptions, and trade-offs? 731 finding(s).
Are imports declared and package/API names verified? 3 finding(s).
Are wrappers, guards, and repeated structures necessary? 1109 finding(s).
Which changes need focused human review? 1239 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 1239 distinct pattern matches across 6 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | playwright.config.ts | 6 | // ╚══════╝╚═╝ ╚═╝ ╚═╝ ╚══════╝╚═╝ ╚═══╝╚══════╝╚═╝ ╚═════╝ ╚═╝ ╚═══╝ | COMMENT |
| MEDIUM | extensions/extension-js-devtools/postcss.config.js | 6 | // ╚═════╝ ╚══════╝ ╚═══╝ ╚═╝ ╚═════╝ ╚═════╝ ╚══════╝╚══════╝ | COMMENT |
| MEDIUM | …ensions/extension-js-devtools/pages/welcome/scripts.ts | 6 | // ╚═════╝ ╚══════╝ ╚═══╝ ╚═╝ ╚═════╝ ╚═════╝ ╚══════╝╚══════╝ | COMMENT |
| MEDIUM | …ns/extension-js-devtools/src/background/start-pages.ts | 6 | // ╚═════╝ ╚══════╝ ╚═══╝ ╚═╝ ╚═════╝ ╚═════╝ ╚══════╝╚══════╝ | COMMENT |
| MEDIUM | …nsion-js-devtools/src/background/define-initial-tab.ts | 6 | // ╚═════╝ ╚══════╝ ╚═══╝ ╚═╝ ╚═════╝ ╚═════╝ ╚══════╝╚══════╝ | COMMENT |
| MEDIUM | …tensions/extension-js-devtools/src/background/index.ts | 6 | // ╚═════╝ ╚══════╝ ╚═══╝ ╚═╝ ╚═════╝ ╚═════╝ ╚══════╝╚══════╝ | COMMENT |
| MEDIUM | …ons/extension-js-devtools/src/background/manager-ui.ts | 6 | // ╚═════╝ ╚══════╝ ╚═══╝ ╚═╝ ╚═════╝ ╚═════╝ ╚══════╝╚══════╝ | COMMENT |
| MEDIUM | …/extension-js-devtools/src/background/session-flags.ts | 6 | // ╚═════╝ ╚══════╝ ╚═══╝ ╚═╝ ╚═════╝ ╚═════╝ ╚══════╝╚══════╝ | COMMENT |
| MEDIUM | extensions/extension-js-devtools/src/lib/utils.ts | 6 | // ╚═════╝ ╚══════╝ ╚═══╝ ╚═╝ ╚═════╝ ╚═════╝ ╚══════╝╚══════╝ | COMMENT |
| MEDIUM | programs/install/rslib.config.ts | 6 | // ╚═╝╚═╝ ╚═══╝╚══════╝ ╚═╝ ╚═╝ ╚═╝╚══════╝╚══════╝ | COMMENT |
| MEDIUM | programs/install/module.ts | 6 | // ╚═╝╚═╝ ╚═══╝╚══════╝ ╚═╝ ╚═╝ ╚═╝╚══════╝╚══════╝ | COMMENT |
| MEDIUM | programs/install/vitest.config.ts | 6 | // ╚═╝╚═╝ ╚═══╝╚══════╝ ╚═╝ ╚═╝ ╚═╝╚══════╝╚══════╝ | COMMENT |
| MEDIUM | programs/install/lib/messaging.ts | 6 | // ╚═╝ ╚═╝╚══════╝╚══════╝╚══════╝╚═╝ ╚═╝ ╚═════╝ ╚═╝╚═╝ ╚═══╝ ╚═════╝ | COMMENT |
| MEDIUM | programs/install/lib/browser-target.ts | 6 | // ╚═╝╚═╝ ╚═══╝╚══════╝ ╚═╝ ╚═╝ ╚═╝╚══════╝╚══════╝ | COMMENT |
| MEDIUM | programs/install/lib/cache-root.ts | 6 | // ╚═╝╚═╝ ╚═══╝╚══════╝ ╚═╝ ╚═╝ ╚═╝╚══════╝╚══════╝ | COMMENT |
| MEDIUM | programs/install/lib/messages.ts | 6 | // ╚═╝╚═╝ ╚═══╝╚══════╝ ╚═╝ ╚═╝ ╚═╝╚══════╝╚══════╝ | COMMENT |
| MEDIUM | programs/install/lib/installer-versions.ts | 6 | // ╚═╝╚═╝ ╚═══╝╚══════╝ ╚═╝ ╚═╝ ╚═╝╚══════╝╚══════╝ | COMMENT |
| MEDIUM | programs/install/lib/runner.ts | 6 | // ╚═╝╚═╝ ╚═══╝╚══════╝ ╚═╝ ╚═╝ ╚═╝╚══════╝╚══════╝ | COMMENT |
| MEDIUM | programs/install/lib/corepack-registry.ts | 6 | // ╚═╝╚═╝ ╚═══╝╚══════╝ ╚═╝ ╚═╝ ╚═╝╚══════╝╚══════╝ | COMMENT |
| MEDIUM | programs/develop/contracts-entry.ts | 6 | // ╚═════╝ ╚══════╝ ╚═══╝ ╚══════╝╚══════╝ ╚═════╝ ╚═╝ | COMMENT |
| MEDIUM | programs/develop/rslib.config.ts | 6 | // ╚═════╝ ╚══════╝ ╚═══╝ ╚══════╝╚══════╝ ╚═════╝ ╚═╝ | COMMENT |
| MEDIUM | programs/develop/preview-entry.ts | 6 | // ╚═════╝ ╚══════╝ ╚═══╝ ╚══════╝╚══════╝ ╚═════╝ ╚═╝ | COMMENT |
| MEDIUM | programs/develop/module.ts | 6 | // ╚═════╝ ╚══════╝ ╚═══╝ ╚══════╝╚══════╝ ╚═════╝ ╚═╝ | COMMENT |
| MEDIUM | programs/develop/command-dev.ts | 6 | // ╚═════╝ ╚══════╝ ╚═══╝ ╚══════╝╚══════╝ ╚═════╝ ╚═╝ | COMMENT |
| MEDIUM | programs/develop/rspack-config.ts | 6 | // ╚═════╝ ╚══════╝ ╚═══╝ ╚══════╝╚══════╝ ╚═════╝ ╚═╝ | COMMENT |
| MEDIUM | programs/develop/bridge-entry.ts | 6 | // ╚═════╝ ╚══════╝ ╚═══╝ ╚══════╝╚══════╝ ╚═════╝ ╚═╝ | COMMENT |
| MEDIUM | programs/develop/types.ts | 6 | // ╚═════╝ ╚══════╝ ╚═══╝ ╚══════╝╚══════╝ ╚═════╝ ╚═╝ | COMMENT |
| MEDIUM | programs/develop/manifest-entry.ts | 6 | // ╚═════╝ ╚══════╝ ╚═══╝ ╚══════╝╚══════╝ ╚═════╝ ╚═╝ | COMMENT |
| MEDIUM | programs/develop/command-build.ts | 6 | // ╚═════╝ ╚══════╝ ╚═══╝ ╚══════╝╚══════╝ ╚═════╝ ╚═╝ | COMMENT |
| MEDIUM | programs/develop/command-preview.ts | 6 | // ╚═════╝ ╚══════╝ ╚═══╝ ╚══════╝╚══════╝ ╚═════╝ ╚═╝ | COMMENT |
| MEDIUM | …grams/develop/plugin-compatibility/feature-polyfill.ts | 6 | // ╚═════╝ ╚═════╝ ╚═╝ ╚═╝╚═╝ ╚═╝ ╚═╝ ╚═╝ ╚═╝╚═════╝ ╚═╝╚══════╝╚═╝ ╚═╝ ╚═╝ | COMMENT |
| MEDIUM | programs/develop/plugin-compatibility/index.ts | 6 | // ╚═════╝ ╚═════╝ ╚═╝ ╚═╝╚═╝ ╚═╝ ╚═╝ ╚═╝ ╚═╝╚═════╝ ╚═╝╚══════╝╚═╝ ╚═╝ ╚═╝ | COMMENT |
| MEDIUM | …develop/plugin-compatibility/feature-browser-global.ts | 6 | // ╚═════╝ ╚═════╝ ╚═╝ ╚═╝╚═╝ ╚═╝ ╚═╝ ╚═╝ ╚═╝╚═════╝ ╚═╝╚══════╝╚═╝ ╚═╝ ╚═╝ | COMMENT |
| MEDIUM | …atibility/compatibility-lib/free-browser-references.ts | 6 | // ╚═════╝ ╚═════╝ ╚═╝ ╚═╝╚═╝ ╚═╝ ╚═╝ ╚═╝ ╚═╝╚═════╝ ╚═╝╚══════╝╚═╝ ╚═╝ ╚═╝ | COMMENT |
| MEDIUM | …lop/plugin-compatibility/compatibility-lib/messages.ts | 6 | // ╚═════╝ ╚═════╝ ╚═╝ ╚═╝╚═╝ ╚═╝ ╚═╝ ╚═╝ ╚═╝╚═════╝ ╚═╝╚══════╝╚═╝ ╚═╝ ╚═╝ | COMMENT |
| MEDIUM | programs/develop/dev-server/compiler-hooks.ts | 6 | // ╚═════╝ ╚══════╝ ╚═══╝ ╚══════╝╚══════╝╚═╝ ╚═╝ ╚═══╝ ╚══════╝╚═╝ ╚═╝ | COMMENT |
| MEDIUM | programs/develop/dev-server/frameworks.ts | 6 | // ╚═════╝ ╚══════╝ ╚═══╝ ╚══════╝╚══════╝╚═╝ ╚═╝ ╚═══╝ ╚══════╝╚═╝ ╚═╝ | COMMENT |
| MEDIUM | programs/develop/dev-server/messages.ts | 6 | // ╚═════╝ ╚══════╝ ╚═══╝ ╚══════╝╚══════╝╚═╝ ╚═╝ ╚═══╝ ╚══════╝╚═╝ ╚═╝ | COMMENT |
| MEDIUM | programs/develop/dev-server/dev-middleware-body.ts | 6 | // ╚═════╝ ╚══════╝ ╚═══╝ ╚══════╝╚══════╝ ╚═════╝ ╚═╝ | COMMENT |
| MEDIUM | programs/develop/dev-server/cleanup.ts | 6 | // ╚═════╝ ╚══════╝ ╚═══╝ ╚══════╝╚══════╝╚═╝ ╚═╝ ╚═══╝ ╚══════╝╚═╝ ╚═╝ | COMMENT |
| MEDIUM | programs/develop/dev-server/emulator-lane.ts | 6 | // ╚═════╝ ╚══════╝ ╚═══╝ ╚══════╝╚══════╝╚═╝ ╚═╝ ╚═══╝ ╚══════╝╚═╝ ╚═╝ | COMMENT |
| MEDIUM | programs/develop/dev-server/auto-exit.ts | 6 | // ╚═════╝ ╚══════╝ ╚═══╝ ╚══════╝╚══════╝╚═╝ ╚═╝ ╚═══╝ ╚══════╝╚═╝ ╚═╝ | COMMENT |
| MEDIUM | programs/develop/dev-server/index.ts | 6 | // ╚═════╝ ╚══════╝ ╚═══╝ ╚══════╝╚══════╝╚═╝ ╚═╝ ╚═══╝ ╚══════╝╚═╝ ╚═╝ | COMMENT |
| MEDIUM | programs/develop/dev-server/cors.ts | 6 | // ╚═════╝ ╚══════╝ ╚═══╝ ╚══════╝╚══════╝╚═╝ ╚═╝ ╚═══╝ ╚══════╝╚═╝ ╚═╝ | COMMENT |
| MEDIUM | programs/develop/dev-server/lifecycle-stream.ts | 6 | // ╚═════╝ ╚══════╝ ╚═══╝ ╚══════╝╚══════╝╚═╝ ╚═╝ ╚═══╝ ╚══════╝╚═╝ ╚═╝ | COMMENT |
| MEDIUM | programs/develop/dev-server/session-start-prune.ts | 6 | // ╚═════╝ ╚══════╝ ╚═══╝ ╚══════╝╚══════╝╚═╝ ╚═╝ ╚═══╝ ╚══════╝╚═╝ ╚═╝ | COMMENT |
| MEDIUM | programs/develop/dev-server/session-restart.ts | 6 | // ╚═════╝ ╚══════╝ ╚═══╝ ╚══════╝╚══════╝╚═╝ ╚═╝ ╚═══╝ ╚══════╝╚═╝ ╚═╝ | COMMENT |
| MEDIUM | programs/develop/dev-server/connectable-host.ts | 6 | // ╚═════╝ ╚══════╝ ╚═══╝ ╚══════╝╚══════╝╚═╝ ╚═╝ ╚═══╝ ╚══════╝╚═╝ ╚═╝ | COMMENT |
| MEDIUM | programs/develop/dev-server/port-manager.ts | 6 | // ╚═════╝ ╚══════╝ ╚═══╝ ╚══════╝╚══════╝╚═╝ ╚═╝ ╚═══╝ ╚══════╝╚═╝ ╚═╝ | COMMENT |
| MEDIUM | …evelop/dev-server/control-bridge/control-port-store.ts | 6 | // ╚═════╝ ╚══════╝ ╚═══╝ ╚══════╝╚══════╝╚═╝ ╚═╝ ╚═══╝ ╚══════╝╚═╝ ╚═╝ | COMMENT |
| MEDIUM | programs/develop/dev-server/control-bridge/logs-file.ts | 6 | // ╚═════╝ ╚══════╝ ╚═══╝ ╚══════╝╚══════╝╚═╝ ╚═╝ ╚═══╝ ╚══════╝╚═╝ ╚═╝ | COMMENT |
| MEDIUM | programs/develop/dev-server/control-bridge/broker.ts | 6 | // ╚═════╝ ╚══════╝ ╚═══╝ ╚══════╝╚══════╝╚═╝ ╚═╝ ╚═══╝ ╚══════╝╚═╝ ╚═╝ | COMMENT |
| MEDIUM | …grams/develop/dev-server/control-bridge/ring-buffer.ts | 6 | // ╚═════╝ ╚══════╝ ╚═══╝ ╚══════╝╚══════╝╚═╝ ╚═╝ ╚═══╝ ╚══════╝╚═╝ ╚═╝ | COMMENT |
| MEDIUM | programs/develop/dev-server/control-bridge/contracts.ts | 6 | // ╚═════╝ ╚══════╝ ╚═══╝ ╚══════╝╚══════╝╚═╝ ╚═╝ ╚═══╝ ╚══════╝╚═╝ ╚═╝ | COMMENT |
| MEDIUM | …ograms/develop/dev-server/control-bridge/logs-query.ts | 6 | // ╚═════╝ ╚══════╝ ╚═══╝ ╚══════╝╚══════╝╚═╝ ╚═╝ ╚═══╝ ╚══════╝╚═╝ ╚═╝ | COMMENT |
| MEDIUM | …develop/dev-server/control-bridge/ws-control-server.ts | 6 | // ╚═════╝ ╚══════╝ ╚═══╝ ╚══════╝╚══════╝╚═╝ ╚═╝ ╚═══╝ ╚══════╝╚═╝ ╚═╝ | COMMENT |
| MEDIUM | …ams/develop/dev-server/control-bridge/session-token.ts | 6 | // ╚═════╝ ╚══════╝ ╚═══╝ ╚══════╝╚══════╝╚═╝ ╚═╝ ╚═══╝ ╚══════╝╚═╝ ╚═╝ | COMMENT |
| MEDIUM | …rams/develop/dev-server/control-bridge/actions-file.ts | 6 | // ╚═════╝ ╚══════╝ ╚═══╝ ╚══════╝╚══════╝╚═╝ ╚═╝ ╚═══╝ ╚══════╝╚═╝ ╚═╝ | COMMENT |
| MEDIUM | …develop/dev-server/control-bridge/controller-client.ts | 6 | // ╚═════╝ ╚══════╝ ╚═══╝ ╚══════╝╚══════╝╚═╝ ╚═╝ ╚═══╝ ╚══════╝╚═╝ ╚═╝ | COMMENT |
| MEDIUM | …s/develop/dev-server/control-bridge/consumer-client.ts | 6 | // ╚═════╝ ╚══════╝ ╚═══╝ ╚══════╝╚══════╝╚═╝ ╚═╝ ╚═══╝ ╚══════╝╚═╝ ╚═╝ | COMMENT |
| 445 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | programs/install/module.ts | 71 | export function getManagedBrowsersCacheRoot(): string { | CODE |
| LOW | programs/install/module.ts | 75 | export function getManagedBrowserInstallDir(browser: string): string { | CODE |
| LOW | programs/install/module.ts | 96 | function discardUnusableInstallTree(destination: string): boolean { | CODE |
| LOW | programs/install/lib/browser-target.ts | 37 | export function isBrowserNotInstallableError( | CODE |
| LOW | programs/install/lib/browser-target.ts | 60 | export function isBrowserInstallPrivilegeError( | CODE |
| LOW | programs/install/lib/messages.ts | 87 | export function edgeInstallNeedsInteractivePrivilegedSession(): string { | CODE |
| LOW | programs/install/lib/messages.ts | 99 | export function edgeInstallUsingSystemBinary(path: string): string { | CODE |
| LOW | programs/install/lib/runner.ts | 58 | function detectCurrentPackageManager(): PackageManager { | CODE |
| LOW | programs/install/lib/runner.ts | 235 | export function edgeInstallNeedsInteractivePrivilegedSession(): boolean { | CODE |
| LOW | programs/install/lib/runner.ts | 239 | export function isEdgePrivilegeEscalationFailure(stderr: string): boolean { | CODE |
| LOW | …lop/plugin-compatibility/compatibility-lib/messages.ts | 19 | export function webextensionPolyfillNotFound() { | CODE |
| LOW | …lop/plugin-compatibility/compatibility-lib/messages.ts | 31 | export function browserGlobalWithoutPolyfill( | CODE |
| LOW⚡ | …lop/plugin-compatibility/compatibility-lib/messages.ts | 48 | export function compatibilityPolyfillEnabled( | CODE |
| LOW⚡ | …lop/plugin-compatibility/compatibility-lib/messages.ts | 58 | export function compatibilityPolyfillSkipped( | CODE |
| LOW⚡ | …lop/plugin-compatibility/compatibility-lib/messages.ts | 68 | export function compatibilityPolyfillDisabled(browser: DevOptions['browser']) { | CODE |
| LOW | programs/develop/dev-server/compiler-hooks.ts | 16 | export function setupCompilerLifecycleHooks(compiler: Compiler): void { | CODE |
| LOW | programs/develop/dev-server/compiler-hooks.ts | 30 | export function setupNoBrowserBannerOnFirstDone(opts: { | CODE |
| LOW | programs/develop/dev-server/compiler-hooks.ts | 63 | export function setupCompilerDoneDiagnostics( | CODE |
| LOW | programs/develop/dev-server/messages.ts | 214 | export function manifestGoneDuringSession( | CODE |
| LOW | programs/develop/dev-server/emulator-lane.ts | 114 | function hotModuleReplacementNames(assets: readonly EmulatorAssetLike[]) { | CODE |
| LOW | programs/develop/dev-server/emulator-lane.ts | 225 | export function createEmulatorFileIndexHolder( | CODE |
| LOW | programs/develop/dev-server/emulator-lane.ts | 341 | export function createEmulatorFilesMiddlewareEntry( | CODE |
| LOW | programs/develop/dev-server/emulator-lane.ts | 358 | export function createEmulatorFilesMiddleware( | CODE |
| LOW | programs/develop/dev-server/index.ts | 158 | function hasGuardedManifestDiskPath(filePath: unknown) { | CODE |
| LOW | programs/develop/dev-server/index.ts | 198 | export function suppressManifestOutputWrites( | CODE |
| LOW | programs/develop/dev-server/index.ts | 296 | export function installManifestDiskWriteGuard( | CODE |
| LOW | programs/develop/dev-server/cors.ts | 107 | export function createHostCheckMiddleware( | CODE |
| LOW | programs/develop/dev-server/port-manager.ts | 94 | function resolveInstanceIdOverride(): string | undefined { | CODE |
| LOW | …evelop/dev-server/control-bridge/control-port-store.ts | 29 | export function writePersistedControlPort( | CODE |
| LOW | programs/develop/dev-server/control-bridge/broker.ts | 158 | function executorAbsentNoControlPort(reason: string): string { | CODE |
| LOW | programs/develop/dev-server/control-bridge/broker.ts | 170 | function undeliveredReloadWarnNoControlPort(reason: string): string { | CODE |
| LOW | programs/develop/dev-server/control-bridge/broker.ts | 181 | function executorAbsentBrowserExited(at: string, how: string | null): string { | CODE |
| LOW | …s/develop/dev-server/control-bridge/consumer-client.ts | 65 | export function readReadyContractDocument( | CODE |
| LOW | …/develop/dev-server/control-bridge/producer-runtime.ts | 711 | function reinjectContentScriptEntry(entry, opts) { | CODE |
| LOW | …/develop/dev-server/control-bridge/producer-runtime.ts | 814 | function reregisterForFutureNavigations(entries) { | CODE |
| LOW | …/develop/dev-server/control-bridge/producer-runtime.ts | 974 | function restoreOverrideTabsAtBoot() { | CODE |
| LOW | …/develop/dev-server/control-bridge/producer-runtime.ts | 1090 | function replayProgrammaticScripts(changedScriptFiles) { | CODE |
| LOW | …/develop/dev-server/control-bridge/producer-runtime.ts | 1474 | function unregisterDevContentScripts(onDone) { | CODE |
| LOW | …/develop/dev-server/control-bridge/producer-runtime.ts | 1848 | export function buildBridgeProducerSource(opts: BuildProducerOptions): string { | CODE |
| LOW | programs/develop/plugin-special-folders/messages.ts | 13 | export function serverRestartRequiredFromSpecialFolderMessageOnly( | CODE |
| LOW | programs/develop/plugin-special-folders/messages.ts | 44 | export function publicMustBeAtProjectRoot( | CODE |
| LOW | programs/develop/plugin-special-folders/messages.ts | 75 | export function specialFoldersSetupSummary( | CODE |
| LOW | programs/develop/plugin-special-folders/messages.ts | 86 | export function specialFolderChangeDetected( | CODE |
| LOW | programs/develop/plugin-special-folders/messages.ts | 111 | export function publicFileCollidesWithEntry( | CODE |
| LOW | …grams/develop/plugin-special-folders/folders-config.ts | 16 | export function rememberSpecialFoldersConfig( | CODE |
| LOW | …lugin-special-folders/check-public-output-collision.ts | 20 | export function explainPublicOutputCollision( | CODE |
| LOW | programs/develop/plugin-special-folders/get-data.ts | 327 | function filterPackageToolingScripts( | CODE |
| LOW | programs/develop/plugin-special-folders/get-data.ts | 496 | export function getSpecialFoldersDataForCompiler( | CODE |
| LOW | programs/develop/plugin-special-folders/get-data.ts | 504 | export function getSpecialFoldersDataForProjectRoot( | CODE |
| LOW | programs/develop/plugin-special-folders/get-data.ts | 525 | function finalizeSpecialFoldersData( | CODE |
| LOW | …in-special-folders/folder-extensions/resolve-config.ts | 125 | function ensurePathsUnderExtensions( | CODE |
| LOW | …in-special-folders/folder-extensions/resolve-config.ts | 199 | async function resolveStoreExtensionToPath(opts: { | CODE |
| LOW | …in-special-folders/folder-extensions/resolve-config.ts | 245 | export async function resolveCompanionExtensionsConfig(opts: { | CODE |
| LOW | …ugin-special-folders/folder-extensions/resolve-dirs.ts | 23 | export function resolveCompanionExtensionDirs(opts: { | CODE |
| LOW⚡ | …elop/plugin-special-folders/folder-extensions/utils.ts | 83 | export function isBrowserNamedCompanionFolder(name: string): boolean { | CODE |
| LOW⚡ | …elop/plugin-special-folders/folder-extensions/utils.ts | 87 | export function companionFolderForBrowser(browser: string | undefined): string { | CODE |
| LOW⚡ | …elop/plugin-special-folders/folder-extensions/utils.ts | 94 | export function companionFolderMatchesBrowser( | CODE |
| LOW | programs/develop/plugin-compilation/zip.ts | 329 | function warnOnMissingDefaultLocale( | CODE |
| LOW | …ograms/develop/plugin-compilation/__spec__/env.spec.ts | 150 | function createCompilationWithAssets(files: Record<string, string>) { | CODE |
| LOW | …develop/plugin-compilation/compilation-lib/messages.ts | 80 | export function projectConfigChangedRestartRequired(configPath: string) { | CODE |
| 544 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | …tension/feature-manifest/__spec__/legacy-paths.spec.ts | 140 | // scaffold layout; only the field's own legacy path is a hit. | COMMENT |
| MEDIUM | …sion/feature-manifest/__spec__/legacy-warnings.spec.ts | 125 | // Author still on the old scaffold; original content is what we scan. | COMMENT |
| MEDIUM | …ms/develop/plugin-js-frameworks/js-tools/typescript.ts | 96 | // compiler context) silently blocks the other's scaffold. | COMMENT |
| MEDIUM | …ms/develop/plugin-js-frameworks/js-tools/typescript.ts | 98 | // project) earns no scaffold: only TypeScript sources need a tsconfig. | COMMENT |
| MEDIUM | …ms/develop/plugin-js-frameworks/js-tools/typescript.ts | 155 | // project has no package.json to sit beside, so without it the scaffold is | COMMENT |
| MEDIUM | …ms/develop/plugin-js-frameworks/js-tools/typescript.ts | 188 | // the scaffold must land there too: writing beside a nested manifest dir | COMMENT |
| MEDIUM | programs/extension/__spec__/template-catalog.spec.ts | 226 | // nobody has grouped yet is still one the CLI can scaffold, so it has to | COMMENT |
| MEDIUM | programs/extension/__spec__/create-command.spec.ts | 16 | // The real scaffold copy, imported from source on purpose: createErrorCode | COMMENT |
| MEDIUM | programs/extension/__spec__/create-command.spec.ts | 121 | // Each row renders the CURRENT scaffold message; nothing is hardcoded, so a | COMMENT |
| MEDIUM | programs/extension/__spec__/create-command.spec.ts | 222 | // The scaffold rewraps the inner message, which is what reaches the CLI. | COMMENT |
| MEDIUM | programs/extension/commands/create.ts | 138 | // The scaffold logs its progress lines on stdout. Under --output json | COMMENT |
| MEDIUM | programs/extension/helpers/template-corpus.generated.ts | 12 | // advertises and the names it can scaffold are one list. | COMMENT |
| MEDIUM | programs/create/module.ts | 65 | // The package manager the scaffold was created with; programmatic hosts read | COMMENT |
| MEDIUM | programs/create/module.ts | 68 | // Which template corpus the scaffold was cut from (ref/source), also stamped | COMMENT |
| MEDIUM | programs/create/module.ts | 109 | // is the same lie as a swapped scaffold (section 126). | COMMENT |
| MEDIUM | programs/create/module.ts | 130 | // the scaffold, so a failure there must leave nothing half-named behind, | COMMENT |
| MEDIUM | programs/create/module.ts | 217 | // package.json flavor and type generation follow the real scaffold. | COMMENT |
| MEDIUM | programs/create/module.ts | 220 | // One manager for the whole scaffold: declared, installed with, printed | COMMENT |
| MEDIUM | programs/create/module.ts | 308 | // The name the scaffold actually came from, which is what the provenance | COMMENT |
| MEDIUM | programs/create/__spec__/create-failure-cleanup.spec.ts | 16 | // Every step that makes the scaffold the user's own runs after the install, so | COMMENT |
| MEDIUM | …grams/create/__spec__/package-manager-identity.spec.ts | 13 | // manager that ran the scaffold; a host with no user agent still declares | COMMENT |
| MEDIUM | …rams/create/__spec__/create-into-existing-repo.spec.ts | 11 | // folder and a bare repository with a licence scaffold as they always did. | COMMENT |
| MEDIUM | programs/create/steps/import-external-template.ts | 124 | // Where a scaffold's files actually came from, so the created project can record | COMMENT |
| MEDIUM | programs/create/steps/import-external-template.ts | 440 | // unpack just the requested template, so catalog slugs scaffold without git. | COMMENT |
| MEDIUM | programs/create/steps/import-external-template.ts | 1144 | // Clean the partial scaffold so a retry into the same name is not | COMMENT |
| MEDIUM | programs/create/steps/initialize-git-repository.ts | 94 | // owner never wrote. Leave the scaffold uncommitted for them to review. | COMMENT |
| MEDIUM | programs/create/steps/write-readme-file.ts | 57 | // Always overwrite the template's README so the scaffold reads as the user's | COMMENT |
| MEDIUM | programs/create/steps/write-readme-file.ts | 60 | // The README is the file the user keeps, so it names the scaffold's one | COMMENT |
| MEDIUM | programs/create/steps/install-internal-deps.ts | 310 | // These land in extension-develop's own node_modules, so a Deno scaffold | COMMENT |
| MEDIUM⚡ | programs/create/steps/write-deno-jsonc.ts | 173 | // `extension`: that always matches the CLI doing the scaffold, same as | COMMENT |
| MEDIUM⚡ | programs/create/steps/write-deno-jsonc.ts | 175 | // template pin would otherwise install a CLI the rest of the scaffold | COMMENT |
| MEDIUM⚡ | programs/create/steps/write-deno-jsonc.ts | 183 | // Always materialize a real node_modules: scaffold tasks invoke the | COMMENT |
| MEDIUM | programs/create/steps/write-gitignore.ts | 51 | // that the owner did not have before the scaffold ran. | COMMENT |
| MEDIUM | programs/create/steps/install-dependencies.ts | 261 | // again. The scaffold is removed on failure, so the install command itself | COMMENT |
| MEDIUM | programs/create/steps/install-dependencies.ts | 275 | // whole scaffold, and a caller that passes none reads the same resolver. | COMMENT |
| MEDIUM | programs/create/steps/write-package-json.ts | 228 | // The template author is the template's, never the scaffold's. A fresh | COMMENT |
| MEDIUM | programs/create/steps/write-package-json.ts | 229 | // scaffold has no author yet, so the field is dropped rather than guessed. | COMMENT |
| MEDIUM | programs/create/steps/write-template-provenance.ts | 16 | // A scaffold drops this so the project records exactly which template corpus it | COMMENT |
| MEDIUM | programs/create/steps/write-template-provenance.ts | 65 | // Provenance is advisory: warn but never fail an otherwise-good scaffold. | COMMENT |
| MEDIUM | programs/create/steps/create-directory.ts | 21 | // directory can pass as scaffold-ready while still holding user data that a | COMMENT |
| MEDIUM | programs/create/steps/create-directory.ts | 27 | // scaffold in place, but the ones a template ships are named up front | COMMENT |
| MEDIUM | …reate/steps/__spec__/scaffold-type-definitions.spec.ts | 46 | // vue, the ai templates and playwright all scaffold a tsconfig, and all of | COMMENT |
| MEDIUM | programs/create/steps/__spec__/write-deno-jsonc.spec.ts | 215 | // scaffold contract still lands: extension import, deps, no package.json. | COMMENT |
| MEDIUM | programs/create/steps/__spec__/write-deno-jsonc.spec.ts | 217 | // Tasks the template did not define still come from the scaffold defaults. | COMMENT |
| MEDIUM | programs/create/steps/__spec__/write-deno-jsonc.spec.ts | 311 | // not wipe the scaffold contract that the banner and README advertise. | COMMENT |
| MEDIUM | …s/__spec__/import-external-template.init-alias.spec.ts | 130 | // scaffold itself became truthful. The card must name what the user typed. | COMMENT |
| MEDIUM | …s/__spec__/import-external-template.init-alias.spec.ts | 164 | // types, the provenance names it and the scaffold is that folder's bytes. | COMMENT |
| MEDIUM | …pec__/import-external-template.local-directory.spec.ts | 185 | // hold a folder of that name, so no scaffold changes meaning by location. | COMMENT |
| MEDIUM | …ams/create/steps/__spec__/install-dependencies.spec.ts | 224 | // leave the exact canary the scaffold wrote, and leave JSONC alone. | COMMENT |
| MEDIUM⚡ | programs/create/lib/messages.ts | 379 | // A lockfile copied from a template can never match the scaffold, because | COMMENT |
| MEDIUM⚡ | programs/create/lib/messages.ts | 601 | // The one manifest key the scaffold writes rather than copies, so the id the | COMMENT |
| MEDIUM | programs/create/lib/messages.ts | 362 | // than fail the whole create, the scaffold falls back to the bundled template | COMMENT |
| MEDIUM | programs/create/lib/messages.ts | 464 | // name the scaffold run after it and a half-named project is worse than none. | COMMENT |
| MEDIUM⚡ | programs/create/lib/package-manager.ts | 55 | // file directly, so a CLI running ON Bun would otherwise scaffold as npm. | COMMENT |
| MEDIUM⚡ | programs/create/lib/package-manager.ts | 63 | // The package managers a scaffold can be created with; deno is folded in here | COMMENT |
| MEDIUM⚡ | programs/create/lib/package-manager.ts | 67 | // Single source of truth for a scaffold's package manager: the runtime first, | COMMENT |
| MEDIUM | programs/create/lib/find-manifest-json.ts | 77 | // Both scaffold steps that personalize the manifest read it the same way, so | COMMENT |
| MEDIUM | …ms/create/lib/__spec__/runtime-package-manager.spec.ts | 69 | // check a scaffold created ON Bun was pinned to npm. | COMMENT |
| MEDIUM | scripts/check-bundled-template-drift.sh | 62 | # scaffolding (stripped at create time anyway, see TEMPLATE_SCAFFOLDING_FILES | COMMENT |
| MEDIUM | .github/workflows/publish-release.yml | 58 | # scaffold. The cut moves the pin to the corpus head and the release | COMMENT |
| 1 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …ensions/extension-js-devtools/pages/welcome/scripts.ts | 1 | // ██████╗ ███████╗██╗ ██╗████████╗ ██████╗ ██████╗ ██╗ ███████╗ | COMMENT |
| LOW | extensions/extension-js-devtools/src/styles.d.css.ts | 1 | // Declaration twin for styles.css so its side-effect imports typecheck | COMMENT |
| LOW | …ns/extension-js-devtools/src/background/start-pages.ts | 1 | // ██████╗ ███████╗██╗ ██╗████████╗ ██████╗ ██████╗ ██╗ ███████╗ | COMMENT |
| LOW | programs/install/lib/installer-versions.ts | 1 | // ██╗███╗ ██╗███████╗████████╗ █████╗ ██╗ ██╗ | COMMENT |
| LOW | programs/develop/dev-server/control-bridge/broker.ts | 281 | // producer can ever dial in, so this outranks every other absence cause. | COMMENT |
| LOW | …ograms/develop/dev-server/control-bridge/logs-query.ts | 1 | // ██████╗ ███████╗██╗ ██╗ ███████╗███████╗██████╗ ██╗ ██╗███████╗██████╗ | COMMENT |
| LOW | …lugin-special-folders/check-public-output-collision.ts | 1 | // ███████╗██████╗ ███████╗ ██████╗██╗ █████╗ ██╗ ███████╗ ██████╗ ██╗ ██████╗ ███████╗██████╗ ███████╗ | COMMENT |
| LOW | …ams/develop/plugin-compilation/watch-project-config.ts | 1 | // ██████╗ ██████╗ ███╗ ███╗██████╗ ██╗██╗ █████╗ ████████╗██╗ ██████╗ ███╗ ██╗ | COMMENT |
| LOW | …lugin-web-extension/shared/discover-devtools-panels.ts | 1 | // ██╗ ██╗███████╗██████╗ ███████╗██╗ ██╗████████╗███████╗███╗ ██╗███████╗██╗ ██████╗ ███╗ ██╗ | COMMENT |
| LOW | …ature-web-resources/web-resources-lib/clean-matches.ts | 1 | // ██╗ ██╗███████╗██████╗ ██████╗ ███████╗███████╗ ██████╗ ██╗ ██╗██████╗ ██████╗███████╗███████╗ | COMMENT |
| LOW | …/feature-manifest/manifest-overrides/mv2/background.ts | 1 | // ███╗ ███╗ █████╗ ███╗ ██╗██╗███████╗███████╗███████╗████████╗ | COMMENT |
| LOW | …t/manifest-overrides/common/content_security_policy.ts | 1 | // ███╗ ███╗ █████╗ ███╗ ██╗██╗███████╗███████╗███████╗████████╗ | COMMENT |
| LOW | …nsion/feature-manifest/manifest-lib/filter-key-edge.ts | 1 | // ███╗ ███╗ █████╗ ███╗ ██╗██╗███████╗███████╗███████╗████████╗ | COMMENT |
| LOW | …/feature-manifest/steps/patch-chromium-theme-colors.ts | 1 | // ███╗ ███╗ █████╗ ███╗ ██╗██╗███████╗███████╗███████╗████████╗ | COMMENT |
| LOW | …nsion/feature-manifest/steps/patch-gecko-background.ts | 1 | // ███╗ ███╗ █████╗ ███╗ ██╗██╗███████╗███████╗███████╗████████╗ | COMMENT |
| LOW | …on/feature-manifest/steps/patch-chromium-background.ts | 1 | // ███╗ ███╗ █████╗ ███╗ ██╗██╗███████╗███████╗███████╗████████╗ | COMMENT |
| LOW | …sion/feature-manifest/steps/patch-webkit-background.ts | 1 | // ███╗ ███╗ █████╗ ███╗ ██╗██╗███████╗███████╗███████╗████████╗ | COMMENT |
| LOW | …est/steps/apply-dev-defaults-lib/dev-injected-hosts.ts | 1 | // ███╗ ███╗ █████╗ ███╗ ██╗██╗███████╗███████╗███████╗████████╗ | COMMENT |
| LOW | …st/steps/apply-dev-defaults-lib/patch-web-resources.ts | 1 | // ███╗ ███╗ █████╗ ███╗ ██╗██╗███████╗███████╗███████╗████████╗ | COMMENT |
| LOW | …sion/feature-scripts/steps/warn-page-context-worker.ts | 1 | // ███████╗ ██████╗██████╗ ██╗██████╗ ████████╗███████╗ | COMMENT |
| LOW | …eature-scripts/steps/validate-emitted-script-syntax.ts | 1 | // ███████╗ ██████╗██████╗ ██╗██████╗ ████████╗███████╗ | COMMENT |
| LOW | …eature-scripts/steps/add-public-path-runtime-module.ts | 1 | // ███████╗ ██████╗██████╗ ██╗██████╗ ████████╗███████╗ | COMMENT |
| LOW | …ps/add-content-script-wrapper/classic-concat-loader.ts | 1 | // ███████╗ ██████╗██████╗ ██╗██████╗ ████████╗███████╗ | COMMENT |
| LOW | programs/develop/plugin-js-frameworks/swc-targets.ts | 1 | // ██╗███████╗ ███████╗██████╗ █████╗ ███╗ ███╗███████╗██╗ ██╗ ██████╗ ██████╗ ██╗ ██╗███████╗ | COMMENT |
| LOW | programs/develop/plugin-perf-budgets/index.ts | 1 | // ██████╗ ███████╗██████╗ ███████╗ ██████╗ ██╗ ██╗██████╗ ██████╗ ███████╗████████╗███████╗ | COMMENT |
| LOW | programs/develop/lib/dark-mode.ts | 1 | // ██████╗ ███████╗██╗ ██╗███████╗██╗ ██████╗ ██████╗ | COMMENT |
| LOW | programs/develop/lib/resource-path.ts | 1 | // ██████╗ ███████╗██╗ ██╗███████╗██╗ ██████╗ ██████╗ | COMMENT |
| LOW | programs/develop/lib/resource-path.ts | 21 | // non-native realpath both resolve it, a raw path does not. | COMMENT |
| LOW | programs/develop/lib/resource-query.ts | 1 | // ██████╗ ███████╗██╗ ██╗███████╗██╗ ██████╗ ██████╗ | COMMENT |
| LOW | programs/develop/lib/manifest-utils.ts | 1 | // ██████╗ ███████╗██╗ ██╗███████╗██╗ ██████╗ ██████╗ | COMMENT |
| LOW | programs/develop/lib/package-json.ts | 1 | // ██████╗ ███████╗██╗ ██╗███████╗██╗ ██████╗ ██████╗ | COMMENT |
| LOW | programs/develop/lib/parse-json-safe.ts | 1 | // ██████╗ ███████╗██╗ ██╗███████╗██╗ ██████╗ ██████╗ | COMMENT |
| LOW | programs/develop/lib/dev-server-client-import.ts | 21 | if (typeof value === 'boolean') return String(value) | COMMENT |
| LOW | …elop/plugin-reload/steps/inject-scripts-replay-shim.ts | 1 | // ██████╗ ███████╗██╗ ██████╗ █████╗ ██████╗ | COMMENT |
| LOW | …evelop/plugin-reload/steps/prune-unreachable-chunks.ts | 1 | // ██████╗ ███████╗██╗ ██████╗ █████╗ ██████╗ | COMMENT |
| LOW | …-target-webextension-fork/lib/webpack5/HMRDevServer.ts | 21 | // Overlay doesn't work well in content script. | COMMENT |
| LOW | …evelop/plugin-reload/reload-lib/dev-content-scripts.ts | 1 | // ██████╗ ███████╗██╗ ██████╗ █████╗ ██████╗ | COMMENT |
| LOW | programs/develop/plugin-css/css-lib/verbatim-css.ts | 1 | // ██████╗███████╗███████╗ | COMMENT |
| LOW | programs/extension/config-types.ts | 1 | // ██████╗██╗ ██╗ | COMMENT |
| LOW | …browsers/run-firefox/rdp/remote-firefox/manager-tab.ts | 1 | // ██████╗ ██╗ ██╗███╗ ██╗ ███████╗██╗██████╗ ███████╗███████╗ ██████╗ ██╗ ██╗ | COMMENT |
| LOW | …ms/extension/browsers/browsers-lib/resolve-live-pid.ts | 1 | // ██████╗ ██████╗ ██████╗ ██╗ ██╗███████╗███████╗██████╗ ███████╗ | COMMENT |
| LOW | …run-chromium/cdp/cdp-extension-controller/ownership.ts | 101 | } | COMMENT |
| LOW | …rowsers/run-chromium/chromium-launch/browser-config.ts | 61 | // Use mock keychain on Mac to prevent the blocking permissions dialog about | COMMENT |
| LOW | programs/extension/helpers/node-version-guard.ts | 1 | // ██████╗██╗ ██╗ | COMMENT |
| LOW | programs/extension/helpers/template-corpus.generated.ts | 1 | // ██████╗██╗ ██╗ | COMMENT |
| LOW | programs/extension/helpers/no-browser.ts | 1 | // ███╗ ██╗ ██████╗ ██████╗ ██████╗ ██████╗ ██╗ ██╗███████╗███████╗██████╗ | COMMENT |
| LOW | programs/create/steps/write-manifest-json.ts | 21 | COMMENT | |
| LOW | programs/create/steps/import-external-template.ts | 81 | COMMENT | |
| LOW | programs/create/steps/import-external-template.ts | 121 | return urls | COMMENT |
| LOW | programs/create/lib/install-runner.ts | 1 | // ██████╗██████╗ ███████╗ █████╗ ████████╗███████╗ | COMMENT |
| LOW | programs/create/lib/utils.ts | 1 | // ██████╗██████╗ ███████╗ █████╗ ████████╗███████╗ | COMMENT |
| LOW | scripts/push-release-refs.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | scripts/hydrate-templates-from-examples.sh | 61 | # content-reload.spec.ts`) can resolve their non-workspace imports | COMMENT |
| LOW | scripts/hydrate-templates-from-examples.sh | 81 | "ws": "^8.19.0" | COMMENT |
| LOW | scripts/check-bundled-template-drift.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | .github/dependabot.yml | 21 | - dependency-name: "typescript" | COMMENT |
| LOW | .github/workflows/reload-matrix-smoke.yml | 1 | name: CI – Reload Matrix Smoke | COMMENT |
| LOW | .github/workflows/release-attest.yml | 1 | name: Extension.js – Release Attest | COMMENT |
| LOW | .github/workflows/release-attest.yml | 21 | # --bundle provenance.intoto.jsonl | COMMENT |
| LOW | .github/workflows/publish-release.yml | 81 | run: bash scripts/check-bundled-template-drift.sh | COMMENT |
| 2 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | programs/develop/plugin-compilation/env.ts | 529 | // Prefer compilation assets to be robust against different bundler versions | COMMENT |
| MEDIUM | .github/workflows/reload-matrix-smoke.yml | 3 | # EXPERIMENTAL / MANUAL. The reload-matrix harness measures ground-truth | COMMENT |
| MEDIUM | .github/workflows/reload-matrix-smoke.yml | 44 | # Produces programs/extension/dist/cli.cjs, which the harness runs in | COMMENT |
| MEDIUM | .github/workflows/reload-matrix-smoke.yml | 49 | # Reconstruct the gitignored vendored path the harness expects. Try the | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …/extension/browsers/__spec__/dry-run-plan.unit.spec.ts | 55 | writeFileSync(join(tmp, 'placeholder'), '') | CODE |
| LOW | …un-firefox/rdp/remote-firefox/manager-tab.unit.spec.ts | 49 | {actor: 'desc1', id: 'user@example.com'}, | CODE |
| LOW | …un-firefox/rdp/remote-firefox/manager-tab.unit.spec.ts | 92 | const client = fakeClient([{actor: 'a', id: 'user@example.com'}]) | CODE |