Real-time global intelligence dashboard. AI-powered news aggregation, geopolitical monitoring, and infrastructure tracking in a unified situational awareness interface
This report presents the forensic synthetic code analysis of koala73/worldmonitor, a TypeScript project with 84,653 GitHub stars. SynthScan v2.0 examined 985,275 lines of code across 2689 source files, recording 2891 pattern matches distributed across 15 syntactic categories. The overall adjusted score of 3.9 places this repository in the Likely human-written band.
The scanner applied 160+ deterministic lexical heuristics, multi-line block detectors, abstract syntax tree depth profilers, and a cross-file Jaccard similarity matrix to construct a statistically normalised synthetic code estimate. All matches are individually weighted by severity coefficient and contextual multiplier before summation, and the resulting headline score is temporally discounted to account for the repository's development history relative to the commercial emergence of large language model coding tooling (November 2022 onward).
This chart maps the temporal evolution of the adjusted synthetic code score across successive scan runs. An upward trajectory indicates ongoing incorporation of AI-generated code or expanding LLM-assisted scaffolding; a stable or declining trajectory may reflect active human refactoring, code removal, or the adoption of stricter authorship policies. The dashed secondary line (right axis) independently tracks total raw pattern hit count, which can diverge from the normalised score when codebase size changes significantly between scans.
Classifies detected patterns by their diagnostic confidence and structural impact. CRITICAL patterns (coefficient 10) represent definitive synthetic signatures — hallucinated imports, explicit LLM attribution metadata — virtually never produced by human authors. HIGH (5) indicates strong structural tells such as cross-file repetition or cross-linguistic idioms. MEDIUM (2) covers recognisable conversational padding and AI-specific vocabulary. LOW (1) captures subtle indicators like tautological comments and generic boilerplate that require density to carry independent signal.
This horizontal bar chart decomposes the repository's raw synthetic code score by top-level directory, allowing you to pinpoint precisely which modules or components carry the highest AI authorship density. Directories with disproportionately high scores relative to their size warrant targeted manual review: concentrated AI signatures often trace back to mass-generated configuration layers, auto-ported test suites, LLM-scaffolded boilerplate classes, or entire subsystems authored under heavy copilot assistance. Use this view to prioritise your human code-review effort.
The scanner identified 2891 distinct pattern matches across 15 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a statistically significant AI authorship indicator. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the diagnostic confidence level (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — comment-context matches receive a ×1.5 weight because LLMs systematically over-annotate. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier as dense clusters constitute far stronger evidence of synthetic authorship than isolated hits.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | middleware.ts | 141 | function hasLegacyDashboardRootState(searchParams: URLSearchParams): boolean { | CODE |
| LOW | vite.config.ts | 294 | function dashboardHtmlOutputPlugin(): Plugin { | CODE |
| LOW | vite.config.ts | 329 | function variantDashboardHtmlPlugin(): Plugin { | CODE |
| LOW | vite.config.ts | 350 | function shouldDeferDashboardStylesheet(tag: string, bundle: OutputBundle): boolean { | CODE |
| LOW | vite.config.ts | 376 | function deferDashboardStylesheetLinks(html: string, bundle: OutputBundle): string { | CODE |
| LOW | vite.config.ts | 867 | function webMcpDevSecurityHeadersPlugin(): Plugin { | CODE |
| LOW | pro-test/vite.config.ts | 12 | function isWelcomeHydrationPreload(dep: string) { | CODE |
| LOW | pro-test/src/i18n.ts | 156 | export function effectiveWelcomeContentLanguage(): string { | CODE |
| LOW | pro-test/src/debugbear-rum.ts | 63 | export function resetDebugBearRumForTesting(): void { | CODE |
| LOW | pro-test/src/welcome-language.ts | 37 | export function resolveEffectiveWelcomeContentLanguage( | CODE |
| LOW | pro-test/src/sentry-filter-policy.ts | 59 | export function sanitizeMarketingRequestUrl(value: string): string | undefined { | CODE |
| LOW | pro-test/src/services/checkout-intent-url.ts | 32 | export function parseCheckoutIntentFromSearch(search: string): CheckoutIntentFromUrl | null { | CODE |
| LOW | pro-test/src/services/checkout-intent-url.ts | 52 | export function stripCheckoutIntentFromSearch(search: string): string { | CODE |
| LOW | pro-test/src/services/checkout-transport.ts | 48 | export function createDefaultCheckoutTransportDeps(): CreateCheckoutTransportDeps { | CODE |
| LOW | pro-test/src/services/clerk-dom-safety.ts | 73 | export function collectRemoveChildEvidence(source: RemoveChildEvidenceSource): RemoveChildEvidence { | CODE |
| LOW | pro-test/src/services/clerk-dom-safety.ts | 158 | export function protectClerkDomFromTranslators(doc: Document = document): () => void { | CODE |
| LOW | pro-test/src/services/clerk-dom-safety.ts | 201 | export function protectReactRootFromTranslators(root: Element): void { | CODE |
| LOW | pro-test/src/services/clerk-dom-safety.ts | 205 | function isInsideClerkTranslatorProtectedRoot(node: unknown): boolean { | CODE |
| LOW | pro-test/src/services/clerk-dom-safety.ts | 223 | export function installDetachedNodeGuards( | CODE |
| LOW | pro-test/src/services/checkout.ts | 76 | function persistFunnelEventForReplay(event: string, data?: Record<string, unknown>): void { | CODE |
| LOW | pro-test/src/services/checkout.ts | 90 | function clearPersistedFunnelEvents(): void { | CODE |
| LOW | pro-test/src/services/checkout.ts | 167 | function bucketProductIdForAnalytics(productId: string): string { | CODE |
| LOW | pro-test/src/services/checkout.ts | 211 | function currentCheckoutRateLimitSeconds(): number { | CODE |
| LOW | pro-test/src/services/checkout.ts | 216 | function activateCheckoutRateLimit(retryAfterHeader: string | null): number { | CODE |
| LOW | pro-test/src/services/checkout.ts | 537 | function mountCheckoutInterstitial(): void { | CODE |
| LOW | pro-test/src/services/checkout.ts | 575 | function unmountCheckoutInterstitial(): void { | CODE |
| LOW | pro-test/src/services/checkout.ts | 620 | function showCheckoutRateLimitToast(retryAfterSeconds: number): void { | CODE |
| LOW | pro-test/src/services/checkout.ts | 675 | function prereserveBillingPortalTab(): Window | null { | CODE |
| LOW | pro-test/src/services/checkout.ts | 735 | function resolveProPlanDisplayName(planKey: unknown): string { | CODE |
| LOW | pro-test/src/services/checkout.ts | 774 | function showProDuplicateSubscriptionDialog(options: ProDuplicateDialogOptions): void { | CODE |
| LOW | pro-test/src/services/checkout.ts | 853 | function showProPendingPaymentDialog(options: ProDuplicateDialogOptions): void { | CODE |
| LOW | pro-test/src/services/welcome-redirect.ts | 10 | export function welcomeDashboardRedirectTarget(location: Pick<WelcomeRedirectLocation, 'search' | 'hash'>): string { | CODE |
| LOW | pro-test/src/services/welcome-redirect.ts | 14 | export function maybeRedirectWelcomeVisitor( | CODE |
| LOW | pro-test/src/services/checkout-rate-limit.ts | 9 | export function parseCheckoutRetryAfterSeconds( | CODE |
| LOW | pro-test/src/services/checkout-rate-limit.ts | 25 | export function checkoutRetryRemainingSeconds( | CODE |
| LOW | pro-test/src/services/clerk-user-state.ts | 19 | function applyClientSessionBaseline(current: ClerkUserState, signedIn: boolean): ClerkUserState { | CODE |
| LOW | server/request-validator.ts | 146 | export function collapseAdjacentClassQuantifiers(source: string): string { | CODE |
| LOW | server/auth-session.ts | 27 | export function getClerkJwtVerifyBaseOptions() { | CODE |
| LOW | server/cors.ts | 101 | function isWorldMonitorGoogleTranslateOrigin(origin: string): boolean { | CODE |
| LOW | server/cors.ts | 143 | export function getOriginDeniedCorsHeaders(req: Request): Record<string, string> { | CODE |
| LOW | server/gateway.ts | 133 | function getRateLimitTelemetryReason( | CODE |
| LOW | server/gateway.ts | 143 | async function claimInternalMcpReplayNonce(userId: string, nonce: string): Promise<InternalMcpReplayClaim> { | CODE |
| LOW | server/gateway.ts | 509 | function isPostToGetCompatibleBodySize(headers: Headers): boolean { | CODE |
| LOW | server/gateway.ts | 595 | function applyPostToGetCompatFields(searchParams: URLSearchParams, fields: PostToGetCompatField[]): void { | CODE |
| LOW | server/gateway.ts | 624 | function getRequiredBboxQueryProblems(searchParams: URLSearchParams): { missing: string[]; invalid: string[]; allZero: b | CODE |
| LOW | server/gateway.ts | 661 | function getRequiredBboxDiagnostic(request: Request, pathname: string): RequiredBboxDiagnostic | null { | CODE |
| LOW | server/gateway.ts | 675 | function attachRequiredBboxDiagnosticHeaders( | CODE |
| LOW | server/gateway.ts | 720 | function createGatewayAuthErrorResponse( | CODE |
| LOW | server/gateway.ts | 745 | function methodForGetEquivalentPolicy(method: string): string { | CODE |
| LOW | server/gateway.ts | 749 | async function shouldReserveGatewayDirectLlmQuota(request: Request, pathname: string): Promise<boolean> { | CODE |
| LOW | server/gateway.ts | 768 | function createDirectLlmQuotaFailureResponse( | CODE |
| LOW | server/gateway.ts | 810 | function hasCredentialBearingHeader(request: Request): boolean { | CODE |
| LOW | server/gateway.ts | 819 | async function isResilienceRankingSeedRefreshRequest(request: Request, pathname: string): Promise<boolean> { | CODE |
| LOW | server/gateway.ts | 846 | function assertProMcpGatewayHmacConfig(): void { | CODE |
| LOW | server/gateway.ts | 931 | function denyForBillingVerification( | CODE |
| LOW | server/worldmonitor/research/v1/list-tech-events.ts | 46 | function readTechEventsPagingPresence(ctx: ServerContext): TechEventsPagingPresence { | CODE |
| LOW | server/worldmonitor/maritime/v1/get-vessel-snapshot.ts | 170 | async function fetchVesselSnapshotFromRelay( | CODE |
| LOW | server/worldmonitor/giving/v1/published-estimates.ts | 42 | function annualizedPlatformValueUsd(claim: PublishedEstimateClaim): number | undefined { | CODE |
| LOW | server/worldmonitor/giving/v1/published-estimates.ts | 145 | export function buildPublishedEstimateSummary( | CODE |
| LOW | …tor/consumer-prices/v1/get-consumer-price-freshness.ts | 10 | export async function getConsumerPriceFreshness( | CODE |
| 1291 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM⚡ | docker-compose.yml | 1 | # ============================================================================= | COMMENT |
| MEDIUM⚡ | docker-compose.yml | 3 | # ============================================================================= | COMMENT |
| MEDIUM⚡ | docker-compose.yml | 11 | # ============================================================================= | COMMENT |
| MEDIUM | server/gateway.ts | 1489 | // ── Active-subscription gate for user API keys (#4611) ────────────────── | COMMENT |
| MEDIUM | server/gateway.ts | 1489 | // ── Active-subscription gate for user API keys (#4611) ────────────────── | COMMENT |
| MEDIUM | server/gateway.ts | 1819 | // ── Idempotency-Key support (mutation retry-safety) ────────────────────── | COMMENT |
| MEDIUM | server/gateway.ts | 1887 | // ── Per-account API rate limit (#3199) ────────────────────────────── | COMMENT |
| MEDIUM | server/gateway.ts | 1887 | // ── Per-account API rate limit (#3199) ────────────────────────────── | COMMENT |
| MEDIUM | …r/worldmonitor/intelligence/v1/chat-analyst-context.ts | 623 | // ── Keyword extraction (shared by GDELT + digest search) ───────────────────── | COMMENT |
| MEDIUM | …r/worldmonitor/intelligence/v1/chat-analyst-context.ts | 665 | // ── GDELT headlines (materialized, never fetched at request time) ───────────── | COMMENT |
| MEDIUM | …r/worldmonitor/intelligence/v1/chat-analyst-context.ts | 855 | // ── Digest keyword search ───────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …r/worldmonitor/intelligence/v1/chat-analyst-context.ts | 950 | // ── Source labels ───────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …rldmonitor/intelligence/v1/brief-why-matters-prompt.ts | 64 | // ── Category-gated context sections ────────────────────────────────────── | COMMENT |
| MEDIUM | server/worldmonitor/news/v1/list-feed-digest.ts | 1398 | // ── Story persistence tracking ──────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/worldmonitor/news/v1/_feeds.ts | 627 | // ── Commodity variant (Mining, Metals, Energy) ───────────────────────────── | COMMENT |
| MEDIUM | …rver/worldmonitor/resilience/v1/_indicator-registry.ts | 78 | // ── macroFiscal (5 sub-metrics) ─────────────────────────────────────────── | COMMENT |
| MEDIUM | …rver/worldmonitor/resilience/v1/_indicator-registry.ts | 156 | // ── currencyExternal ───────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …rver/worldmonitor/resilience/v1/_indicator-registry.ts | 236 | // ── tradePolicy (3 sub-metrics) ─────────────────────────────────────────── | COMMENT |
| MEDIUM | …rver/worldmonitor/resilience/v1/_indicator-registry.ts | 293 | // ── financialSystemExposure (4 sub-metrics) ─────────────────────────────── | COMMENT |
| MEDIUM | …rver/worldmonitor/resilience/v1/_indicator-registry.ts | 404 | // ── cyberDigital (3 sub-metrics) ────────────────────────────────────────── | COMMENT |
| MEDIUM | …rver/worldmonitor/resilience/v1/_indicator-registry.ts | 451 | // ── logisticsSupply (3 sub-metrics) ─────────────────────────────────────── | COMMENT |
| MEDIUM | …rver/worldmonitor/resilience/v1/_indicator-registry.ts | 498 | // ── infrastructure (4 sub-metrics) ──────────────────────────────────────── | COMMENT |
| MEDIUM | …rver/worldmonitor/resilience/v1/_indicator-registry.ts | 560 | // ── energy (active production construct = v2) ───────────────────────────── | COMMENT |
| MEDIUM | …rver/worldmonitor/resilience/v1/_indicator-registry.ts | 673 | // ── energy v2 global inputs ─────────────────────────────────────────────── | COMMENT |
| MEDIUM | …rver/worldmonitor/resilience/v1/_indicator-registry.ts | 738 | // ── governanceInstitutional (6 sub-metrics, equal weight) ───────────────── | COMMENT |
| MEDIUM | …rver/worldmonitor/resilience/v1/_indicator-registry.ts | 830 | // ── socialCohesion (3 sub-metrics) ──────────────────────────────────────── | COMMENT |
| MEDIUM | …rver/worldmonitor/resilience/v1/_indicator-registry.ts | 882 | // ── borderSecurity / "Conflict & Displacement" (2 sub-metrics) ─────────── | COMMENT |
| MEDIUM | …rver/worldmonitor/resilience/v1/_indicator-registry.ts | 923 | // ── informationCognitive (3 sub-metrics) ────────────────────────────────── | COMMENT |
| MEDIUM | …rver/worldmonitor/resilience/v1/_indicator-registry.ts | 975 | // ── education (1 sub-metric) ────────────────────────────────────────────── | COMMENT |
| MEDIUM | …rver/worldmonitor/resilience/v1/_indicator-registry.ts | 1010 | // ── healthPublicService (5 sub-metrics) ─────────────────────────────────── | COMMENT |
| MEDIUM | …rver/worldmonitor/resilience/v1/_indicator-registry.ts | 1087 | // ── foodWater (3 sub-metrics) ───────────────────────────────────────────── | COMMENT |
| MEDIUM | …rver/worldmonitor/resilience/v1/_indicator-registry.ts | 1139 | // ── fiscalSpace (4 sub-metrics) ────────────────────────────────────────── | COMMENT |
| MEDIUM | …rver/worldmonitor/resilience/v1/_indicator-registry.ts | 1212 | // ── reserveAdequacy (RETIRED in PR 2 §3.4) ─────────────────────────────── | COMMENT |
| MEDIUM | …rver/worldmonitor/resilience/v1/_indicator-registry.ts | 1233 | // ── liquidReserveAdequacy (1 sub-metric) ───────────────────────────────── | COMMENT |
| MEDIUM | …rver/worldmonitor/resilience/v1/_indicator-registry.ts | 1258 | // ── sovereignFiscalBuffer (1 sub-metric) ───────────────────────────────── | COMMENT |
| MEDIUM | …rver/worldmonitor/resilience/v1/_indicator-registry.ts | 1302 | // ── externalDebtCoverage (1 sub-metric) ────────────────────────────────── | COMMENT |
| MEDIUM | …rver/worldmonitor/resilience/v1/_indicator-registry.ts | 1326 | // ── importConcentration (1 sub-metric) ─────────────────────────────────── | COMMENT |
| MEDIUM | …rver/worldmonitor/resilience/v1/_indicator-registry.ts | 1343 | // ── stateContinuity (3 sub-metrics, derived from existing keys) ────────── | COMMENT |
| MEDIUM | …rver/worldmonitor/resilience/v1/_indicator-registry.ts | 1390 | // ── fuelStockDays (1 sub-metric) ───────────────────────────────────────── | COMMENT |
| MEDIUM | server/worldmonitor/market/v1/analyze-stock.ts | 580 | // ── Risk analytics ────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/worldmonitor/market/v1/analyze-stock.ts | 671 | // ── US-equity market session (#4922d) ─────────────────────────────────────── | COMMENT |
| MEDIUM | server/worldmonitor/market/v1/analyze-stock.ts | 671 | // ── US-equity market session (#4922d) ─────────────────────────────────────── | COMMENT |
| MEDIUM | …ver/worldmonitor/supply-chain/v1/scenario-templates.ts | 122 | // ─── Runtime types shared between MapContainer and DeckGLMap ───────────────── | COMMENT |
| MEDIUM | …nitor/supply-chain/v1/_route-explorer-static-tables.ts | 16 | // ─── Transit days per TRADE_ROUTES ID ──────────────────────────────────────── | COMMENT |
| MEDIUM | …nitor/supply-chain/v1/_route-explorer-static-tables.ts | 54 | // ─── Freight estimate per cargo type ───────────────────────────────────────── | COMMENT |
| MEDIUM | …nitor/supply-chain/v1/_route-explorer-static-tables.ts | 72 | // ─── Bypass corridor geometry ──────────────────────────────────────────────── | COMMENT |
| MEDIUM | …nitor/supply-chain/v1/_route-explorer-static-tables.ts | 90 | // ── Sea alternatives (use CHOKEPOINT_REGISTRY for endpoints) ─────────── | COMMENT |
| MEDIUM | …nitor/supply-chain/v1/_route-explorer-static-tables.ts | 176 | // ── Land-bridge corridors (hand-curated rail/road endpoints) ────────── | COMMENT |
| MEDIUM | server/__tests__/gateway-user-key-apiaccess.test.ts | 488 | // ── Absent entitlement with a configured backend ⇒ retryable 503 ────────── | COMMENT |
| MEDIUM | server/__tests__/gateway-user-key-apiaccess.test.ts | 506 | // ── The fail-CLOSED half: a RESOLVED row that denies ⇒ 403 ──────────────── | COMMENT |
| MEDIUM | server/__tests__/gateway-user-key-apiaccess.test.ts | 536 | // ── CLOSED GAP, pinned so it cannot silently reopen ─────────────────────── | COMMENT |
| MEDIUM | server/__tests__/gateway-user-key-apiaccess.test.ts | 602 | // ── Recovery path ───────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/__tests__/gateway-user-key-apiaccess.test.ts | 618 | // ── Harness isolation guard ─────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/_shared/brief-carousel-render.ts | 61 | // ── Colour palette (must match magazine's aesthetic) ─────────────────────── | COMMENT |
| MEDIUM | server/_shared/brief-carousel-render.ts | 73 | // ── Layouts ──────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/_shared/brief-carousel-render.ts | 319 | // ── Public API ───────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/_shared/feelgood-classifier.js | 80 | // ── CORROBORATING: feel-good tokens (named capture groups) ────────── | COMMENT |
| MEDIUM | server/_shared/opinion-classifier.js | 26 | // ── STRONG: URL path / feed-section segments ───────────────────────── | COMMENT |
| MEDIUM | server/_shared/opinion-classifier.js | 49 | // ── STRONG: explicit headline prefix ───────────────────────────────── | COMMENT |
| MEDIUM | server/_shared/opinion-classifier.js | 57 | // ── STRONG: source-domain allowlist ────────────────────────────────── | COMMENT |
| 298 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | middleware.ts | 21 | // this list disables the middleware's generic bot gate. | COMMENT |
| LOW | middleware.ts | 321 | // | COMMENT |
| LOW | nixpacks.toml | 1 | # Railway relay build config (root_dir="" — builds from repo root). | COMMENT |
| LOW | docker-compose.yml | 1 | # ============================================================================= | COMMENT |
| LOW | docker-compose.yml | 121 | # Defense-in-depth: the redis service's --requirepass already fails | COMMENT |
| LOW | playwright.config.ts | 61 | fullyParallel: true, | COMMENT |
| LOW | vite.config.ts | 61 | type PanelChunkName = typeof PANEL_CHUNK_NAMES[number]; | COMMENT |
| LOW | vite.config.ts | 361 | return sourceLength >= 100 * 1024; | COMMENT |
| LOW | vite.config.ts | 1001 | // each SW update after a blog deploy. Blog pages fetch their own | COMMENT |
| LOW | vite.config.ts | 1221 | // Military-bases bulk (~48KB MILITARY_BASES_EXPANDED + merged | COMMENT |
| LOW | pro-test/src/routes.ts | 1 | export const DASHBOARD_PATH = '/dashboard'; | COMMENT |
| LOW | pro-test/src/App.tsx | 1381 | const [page, setPage] = useState(() => window.location.hash.startsWith('#enterprise') ? 'enterprise' : 'home'); | COMMENT |
| LOW | pro-test/src/i18n.ts | 81 | // browser to English forever and silently bury the localized copy we ship. | COMMENT |
| LOW | pro-test/src/sentry-filter-policy.ts | 81 | // WKWebView host-app JS bridge timeout — Apple WebKit emits this exact phrase | COMMENT |
| LOW | pro-test/src/sentry-filter-policy.ts | 101 | // rejection always belongs to | COMMENT |
| LOW | pro-test/src/sentry-filter-policy.ts | 121 | // dashboard's. Already suppressed on the dashboard since #4005 | COMMENT |
| LOW | pro-test/src/sentry-filter-policy.ts | 141 | // postMessage` entry above covers the same bridge from the other direction | COMMENT |
| LOW | pro-test/src/sentry-filter-policy.ts | 261 | // (WORLDMONITOR-15). | COMMENT |
| LOW | pro-test/src/sentry-filter-policy.ts | 281 | // is licensed by the masked frame, not by the wording. Requiring BOTH a | COMMENT |
| LOW | pro-test/src/sentry-filter-policy.ts | 301 | // third-party-SDK loader catches, so an unhandled parse rejection from | COMMENT |
| LOW | pro-test/src/sentry-filter-policy.ts | 321 | // same gap that let WORLDMONITOR-15/-102/-108/-10N/-10T through | COMMENT |
| LOW | pro-test/src/services/checkout.ts | 341 | return false; | COMMENT |
| LOW | pro-test/src/services/checkout.ts | 361 | // Unmount is best-effort — the Dodo SDK exposes no "overlay visible" | COMMENT |
| LOW | pro-test/src/services/checkout.ts | 421 | // Token is re-fetched inside onConfirm rather than captured | COMMENT |
| LOW | server/auth-session.ts | 21 | // `exp <= now - tolerance`), while `nbf` is accepted up to and including five | COMMENT |
| LOW | server/gateway.ts | 401 | '/api/intelligence/v1/compute-energy-shock': 'fast', | COMMENT |
| LOW | server/gateway.ts | 461 | '/api/leads/v1/submit-contact', | COMMENT |
| LOW | server/gateway.ts | 1041 | }); | COMMENT |
| LOW | server/gateway.ts | 1061 | const inboundHeaders = request.headers; | COMMENT |
| LOW | server/gateway.ts | 1121 | COMMENT | |
| LOW | server/gateway.ts | 1141 | if (request.headers.has(INTERNAL_MCP_SIG_HEADER)) { | COMMENT |
| LOW | server/gateway.ts | 1261 | JSON.stringify({ error: 'insufficient_entitlement' }), | COMMENT |
| LOW | server/gateway.ts | 1301 | // entirely: we already resolved the userId via HMAC verify and confirmed | COMMENT |
| LOW | server/gateway.ts | 1421 | // Propagate the resolved key-owner identity to downstream route | COMMENT |
| LOW | server/gateway.ts | 1461 | // Clerk session is itself proof of authentication (validated at line 410). | COMMENT |
| LOW | server/gateway.ts | 1481 | // the raw header belongs to a different anonymous principal. | COMMENT |
| LOW | server/gateway.ts | 1501 | // This intentionally does NOT re-validate wm_ keys on any other route class: | COMMENT |
| LOW | server/gateway.ts | 1621 | // would block every paying user on legacy premium endpoints despite | COMMENT |
| LOW | server/gateway.ts | 1701 | } | COMMENT |
| LOW | server/gateway.ts | 1821 | // (compat block above) are already GET here and are skipped. Scope by the | COMMENT |
| LOW | server/gateway.ts | 1881 | 'rate_limit_429_endpoint', | COMMENT |
| LOW | server/worldmonitor/research/v1/list-tech-events.ts | 481 | // bar, so a curated-only payload would otherwise be pinned under the | COMMENT |
| LOW | server/worldmonitor/research/v1/list-tech-events.ts | 521 | // | COMMENT |
| LOW | server/worldmonitor/maritime/v1/get-vessel-snapshot.ts | 21 | chokepoint_congestion: 'AIS_DISRUPTION_TYPE_CHOKEPOINT_CONGESTION', | COMMENT |
| LOW | …r/worldmonitor/intelligence/v1/chat-analyst-context.ts | 1 | import { getCachedJson, readCachedJson } from '../../../_shared/redis'; | COMMENT |
| LOW | …r/worldmonitor/intelligence/v1/chat-analyst-context.ts | 661 | } | COMMENT |
| LOW | …worldmonitor/intelligence/v1/_country-brief-context.ts | 1 | // Shared (anonymous-tier) grounding context for the country intel brief. | COMMENT |
| LOW | server/worldmonitor/intelligence/v1/_risk-config.ts | 1 | // ============================================================================ | COMMENT |
| LOW | …rldmonitor/intelligence/v1/brief-why-matters-prompt.ts | 61 | // the LLM call latency stays under ~6s on typical provider responses. | COMMENT |
| LOW | …rldmonitor/intelligence/v1/brief-why-matters-prompt.ts | 121 | COMMENT | |
| LOW | server/worldmonitor/intelligence/v1/get-risk-scores.ts | 1381 | strategicRisks: response.strategicRisks.filter((risk) => risk.region.toUpperCase() === normalizedRegion), | COMMENT |
| LOW | server/worldmonitor/intelligence/v1/get-risk-scores.ts | 1581 | // fetch by the true in-process leader so /api/health.riskScores | COMMENT |
| LOW | …/worldmonitor/intelligence/v1/get-regional-snapshot.ts | 481 | req: GetRegionalSnapshotRequest, | COMMENT |
| LOW | server/worldmonitor/intelligence/v1/_shared.ts | 1 | /** | COMMENT |
| LOW | server/worldmonitor/intelligence/v1/_shared.ts | 21 | // institutional pages that previously promoted info-keyword titles to | COMMENT |
| LOW | …/worldmonitor/prediction/v1/list-prediction-markets.ts | 101 | // meaning "every market" (#5733). Before the producer's pools were made | COMMENT |
| LOW | server/worldmonitor/military/v1/get-aircraft-details.ts | 21 | ): Promise<GetAircraftDetailsResponse> { | COMMENT |
| LOW | …rver/worldmonitor/military/v1/list-military-flights.ts | 381 | // The dashboard deliberately asks for the full legal world. If only a | COMMENT |
| LOW | …rver/worldmonitor/military/v1/list-military-flights.ts | 461 | // Quantize bbox to a 1° grid so nearby map views share cache entries. | COMMENT |
| LOW | …rver/worldmonitor/military/v1/list-military-flights.ts | 481 | // reopening per-viewer OpenSky recovery here recreates the credit fanout. | COMMENT |
| 796 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | server/worldmonitor/forecast/v1/trigger-simulation.ts | 58 | // Step 1: Pro gate (defense-in-depth). | COMMENT |
| LOW⚡ | server/worldmonitor/forecast/v1/trigger-simulation.ts | 61 | // Step 2: queue-depth backpressure (mirrors run-scenario:50). | COMMENT |
| LOW⚡ | server/worldmonitor/forecast/v1/trigger-simulation.ts | 67 | // Step 3: derive runId from package pointer; no UUID fallback. | COMMENT |
| LOW | server/worldmonitor/forecast/v1/trigger-simulation.ts | 81 | // Step 4: pre-enqueue idempotency fast-path (D5). Authoritative | COMMENT |
| LOW | server/worldmonitor/forecast/v1/trigger-simulation.ts | 104 | // Step 5: enqueue. | COMMENT |
| LOW | …/worldmonitor/intelligence/v1/get-regional-snapshot.ts | 488 | // Step 1: resolve latest pointer -> snapshot_id. | COMMENT |
| LOW⚡ | …/worldmonitor/intelligence/v1/get-regional-snapshot.ts | 505 | // Step 2: resolve snapshot_id -> full snapshot | COMMENT |
| LOW⚡ | …/worldmonitor/intelligence/v1/get-regional-snapshot.ts | 512 | // Step 3: adapt snake_case -> camelCase | COMMENT |
| LOW⚡ | server/_shared/feelgood-classifier.js | 156 | // Step 1: HARD-NEWS VETO. Runs FIRST. Overrides every classification | COMMENT |
| LOW⚡ | server/_shared/feelgood-classifier.js | 164 | // Step 2: STRONG URL pathname segment. | COMMENT |
| LOW⚡ | server/_shared/feelgood-classifier.js | 169 | // Step 3: STRONG headline prefix. | COMMENT |
| LOW⚡ | server/_shared/feelgood-classifier.js | 172 | // Step 4: CORROBORATING ≥3 DISTINCT named-group labels across all | COMMENT |
| LOW⚡ | server/_shared/pro-mcp-token.ts | 264 | // Step 1: negative-cache short-circuit. | COMMENT |
| LOW⚡ | server/_shared/pro-mcp-token.ts | 267 | // Step 2: Convex round-trip. | COMMENT |
| LOW⚡ | server/_shared/pro-mcp-token.ts | 316 | // Step 3: positive — return WITHOUT caching. | COMMENT |
| LOW⚡ | server/_shared/pro-mcp-token.ts | 320 | // Step 4: negative — write sentinel and return revoked. | COMMENT |
| LOW⚡ | docs/climate-variant-full.md | 26 | // Step 1: Fetch current 7-day mean for zone | COMMENT |
| LOW⚡ | docs/climate-variant-full.md | 27 | // Step 2: Fetch historical 30-year monthly mean for same month | COMMENT |
| LOW⚡ | docs/climate-variant-full.md | 29 | // Step 3: anomaly = current - historical_mean | COMMENT |
| LOW | docs/Docs_To_Review/PANELS.md | 732 | ### Step 1: Define the Panel Config | COMMENT |
| LOW | docs/Docs_To_Review/PANELS.md | 743 | ### Step 2: Create the Component Class | COMMENT |
| LOW | docs/Docs_To_Review/PANELS.md | 782 | ### Step 3: Register in App.ts | COMMENT |
| LOW | docs/Docs_To_Review/PANELS.md | 794 | ### Step 4: Wire Data Loading | COMMENT |
| LOW⚡ | docs/Docs_To_Review/PANELS.md | 805 | ### Step 5: Add Refresh Interval (Optional) | COMMENT |
| LOW⚡ | docs/Docs_To_Review/PANELS.md | 809 | ### Step 6: Add Map Layer (Optional) | COMMENT |
| LOW⚡ | docs/Docs_To_Review/PANELS.md | 817 | ### Step 7: Add i18n Key | COMMENT |
| LOW | docs/Docs_To_Review/PANELS.md | 829 | ### Step 8: Register in Variant Configs | COMMENT |
| LOW⚡ | convex/notificationChannels.ts | 277 | // Step 1: find the current user's row before cross-account endpoint | COMMENT |
| LOW⚡ | convex/notificationChannels.ts | 287 | // Step 2: scan for rows with this endpoint across other users and delete | COMMENT |
| LOW | convex/notificationChannels.ts | 307 | // Step 3: upsert the current-user row by (userId, channelType). | COMMENT |
| LOW⚡ | convex/followedCountries.ts | 495 | // Step 2: empty-input guard. | COMMENT |
| LOW⚡ | convex/followedCountries.ts | 500 | // Step 3: defensive upper-bound on input length. | COMMENT |
| LOW⚡ | convex/followedCountries.ts | 509 | // Step 4: ISO-2 registry filter; collect droppedInvalid in input order. | COMMENT |
| LOW | convex/followedCountries.ts | 520 | // Step 5: canonicalize — dedupe in first-seen order. Without this, a | COMMENT |
| LOW⚡ | convex/followedCountries.ts | 541 | // Step 6: read existing rows; build existingSet. Still required for | COMMENT |
| LOW⚡ | convex/followedCountries.ts | 550 | // Step 7: filter against existing. | COMMENT |
| LOW | convex/followedCountries.ts | 568 | // Step 10: insert accepted rows + atomic counter +1 each. | COMMENT |
| LOW | convex/followedCountries.ts | 589 | // Step 12: structured warning when free users overflow cap. No | COMMENT |
| LOW | convex/followedCountries.ts | 604 | // Step 11: return shape. | COMMENT |
| LOW⚡ | convex/__tests__/checkout.test.ts | 120 | // Step 1: Seed product plans + customer mapping | COMMENT |
| LOW⚡ | convex/__tests__/checkout.test.ts | 126 | // Step 2: Simulate subscription.active webhook (with wm_user_id metadata) | COMMENT |
| LOW⚡ | convex/__tests__/checkout.test.ts | 135 | // Step 3: Query entitlements for the real user (not fallback) | COMMENT |
| LOW⚡ | convex/__tests__/checkout.test.ts | 141 | // Step 4: Assert pro_monthly entitlements | COMMENT |
| LOW⚡ | convex/__tests__/checkout.test.ts | 151 | // Step 1: Seed product plans + customer mapping | COMMENT |
| LOW⚡ | convex/__tests__/checkout.test.ts | 157 | // Step 2: Simulate subscription.active webhook | COMMENT |
| LOW⚡ | convex/__tests__/checkout.test.ts | 166 | // Step 3: Query entitlements | COMMENT |
| LOW⚡ | convex/__tests__/checkout.test.ts | 172 | // Step 4: Assert api_starter entitlements | COMMENT |
| LOW⚡ | convex/__tests__/checkout.test.ts | 184 | // Step 1: Seed product plans + customer mapping | COMMENT |
| LOW⚡ | convex/__tests__/checkout.test.ts | 190 | // Step 2: Simulate webhook with billing dates both in the past (expired) | COMMENT |
| LOW⚡ | convex/__tests__/checkout.test.ts | 202 | // Step 3: Query entitlements -- should return free tier (expired) | COMMENT |
| LOW⚡ | convex/__tests__/checkout.test.ts | 208 | // Step 4: Assert free tier defaults | COMMENT |
| LOW | convex/broadcast/waveRuns.ts | 711 | // Step 1: claim lease + insert waveRuns row. | COMMENT |
| LOW | convex/broadcast/waveRuns.ts | 729 | // Step 2: stream registrations + filter (per-page) + reservoir-sample. | COMMENT |
| LOW | convex/broadcast/waveRuns.ts | 852 | // Step 3: create the Resend segment. | COMMENT |
| LOW | convex/broadcast/waveRuns.ts | 866 | // Step 4: chunk-persist picked rows. Each chunk is its own mutation so | COMMENT |
| LOW | convex/broadcast/waveRuns.ts | 885 | // Step 5: mark pick complete + schedule first push batch. | COMMENT |
| LOW | convex/broadcast/audienceWaveExport.ts | 293 | // Step 1: refuse to overlap with an existing wave. | COMMENT |
| LOW | convex/broadcast/audienceWaveExport.ts | 304 | // Step 2: stream registrations, dedup, reservoir-sample N. | COMMENT |
| LOW⚡ | convex/broadcast/audienceWaveExport.ts | 355 | // Step 3: create the Resend segment FIRST so we never stamp a | COMMENT |
| LOW⚡ | convex/broadcast/audienceWaveExport.ts | 363 | // Step 4: push picked contacts to the segment, then stamp ONLY on | COMMENT |
| 37 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | server/worldmonitor/forecast/v1/trigger-simulation.ts | 58 | // Step 1: Pro gate (defense-in-depth). | COMMENT |
| LOW⚡ | server/worldmonitor/forecast/v1/trigger-simulation.ts | 61 | // Step 2: queue-depth backpressure (mirrors run-scenario:50). | COMMENT |
| LOW⚡ | server/worldmonitor/forecast/v1/trigger-simulation.ts | 67 | // Step 3: derive runId from package pointer; no UUID fallback. | COMMENT |
| LOW | server/worldmonitor/forecast/v1/trigger-simulation.ts | 81 | // Step 4: pre-enqueue idempotency fast-path (D5). Authoritative | COMMENT |
| LOW | server/worldmonitor/forecast/v1/trigger-simulation.ts | 104 | // Step 5: enqueue. | COMMENT |
| LOW | …/worldmonitor/intelligence/v1/get-regional-snapshot.ts | 488 | // Step 1: resolve latest pointer -> snapshot_id. | COMMENT |
| LOW⚡ | …/worldmonitor/intelligence/v1/get-regional-snapshot.ts | 505 | // Step 2: resolve snapshot_id -> full snapshot | COMMENT |
| LOW⚡ | …/worldmonitor/intelligence/v1/get-regional-snapshot.ts | 512 | // Step 3: adapt snake_case -> camelCase | COMMENT |
| LOW⚡ | server/_shared/feelgood-classifier.js | 156 | // Step 1: HARD-NEWS VETO. Runs FIRST. Overrides every classification | COMMENT |
| LOW⚡ | server/_shared/feelgood-classifier.js | 164 | // Step 2: STRONG URL pathname segment. | COMMENT |
| LOW⚡ | server/_shared/feelgood-classifier.js | 169 | // Step 3: STRONG headline prefix. | COMMENT |
| LOW⚡ | server/_shared/feelgood-classifier.js | 172 | // Step 4: CORROBORATING ≥3 DISTINCT named-group labels across all | COMMENT |
| LOW⚡ | server/_shared/pro-mcp-token.ts | 264 | // Step 1: negative-cache short-circuit. | COMMENT |
| LOW⚡ | server/_shared/pro-mcp-token.ts | 267 | // Step 2: Convex round-trip. | COMMENT |
| LOW⚡ | server/_shared/pro-mcp-token.ts | 316 | // Step 3: positive — return WITHOUT caching. | COMMENT |
| LOW⚡ | server/_shared/pro-mcp-token.ts | 320 | // Step 4: negative — write sentinel and return revoked. | COMMENT |
| LOW⚡ | convex/notificationChannels.ts | 277 | // Step 1: find the current user's row before cross-account endpoint | COMMENT |
| LOW⚡ | convex/notificationChannels.ts | 287 | // Step 2: scan for rows with this endpoint across other users and delete | COMMENT |
| LOW | convex/notificationChannels.ts | 307 | // Step 3: upsert the current-user row by (userId, channelType). | COMMENT |
| LOW⚡ | convex/followedCountries.ts | 495 | // Step 2: empty-input guard. | COMMENT |
| LOW⚡ | convex/followedCountries.ts | 500 | // Step 3: defensive upper-bound on input length. | COMMENT |
| LOW⚡ | convex/followedCountries.ts | 509 | // Step 4: ISO-2 registry filter; collect droppedInvalid in input order. | COMMENT |
| LOW | convex/followedCountries.ts | 520 | // Step 5: canonicalize — dedupe in first-seen order. Without this, a | COMMENT |
| LOW⚡ | convex/followedCountries.ts | 541 | // Step 6: read existing rows; build existingSet. Still required for | COMMENT |
| LOW⚡ | convex/followedCountries.ts | 550 | // Step 7: filter against existing. | COMMENT |
| LOW | convex/followedCountries.ts | 568 | // Step 10: insert accepted rows + atomic counter +1 each. | COMMENT |
| LOW | convex/followedCountries.ts | 589 | // Step 12: structured warning when free users overflow cap. No | COMMENT |
| LOW | convex/followedCountries.ts | 604 | // Step 11: return shape. | COMMENT |
| LOW⚡ | convex/__tests__/checkout.test.ts | 120 | // Step 1: Seed product plans + customer mapping | COMMENT |
| LOW⚡ | convex/__tests__/checkout.test.ts | 126 | // Step 2: Simulate subscription.active webhook (with wm_user_id metadata) | COMMENT |
| LOW⚡ | convex/__tests__/checkout.test.ts | 135 | // Step 3: Query entitlements for the real user (not fallback) | COMMENT |
| LOW⚡ | convex/__tests__/checkout.test.ts | 141 | // Step 4: Assert pro_monthly entitlements | COMMENT |
| LOW⚡ | convex/__tests__/checkout.test.ts | 151 | // Step 1: Seed product plans + customer mapping | COMMENT |
| LOW⚡ | convex/__tests__/checkout.test.ts | 157 | // Step 2: Simulate subscription.active webhook | COMMENT |
| LOW⚡ | convex/__tests__/checkout.test.ts | 166 | // Step 3: Query entitlements | COMMENT |
| LOW⚡ | convex/__tests__/checkout.test.ts | 172 | // Step 4: Assert api_starter entitlements | COMMENT |
| LOW⚡ | convex/__tests__/checkout.test.ts | 184 | // Step 1: Seed product plans + customer mapping | COMMENT |
| LOW⚡ | convex/__tests__/checkout.test.ts | 190 | // Step 2: Simulate webhook with billing dates both in the past (expired) | COMMENT |
| LOW⚡ | convex/__tests__/checkout.test.ts | 202 | // Step 3: Query entitlements -- should return free tier (expired) | COMMENT |
| LOW⚡ | convex/__tests__/checkout.test.ts | 208 | // Step 4: Assert free tier defaults | COMMENT |
| LOW | convex/broadcast/waveRuns.ts | 711 | // Step 1: claim lease + insert waveRuns row. | COMMENT |
| LOW | convex/broadcast/waveRuns.ts | 729 | // Step 2: stream registrations + filter (per-page) + reservoir-sample. | COMMENT |
| LOW | convex/broadcast/waveRuns.ts | 852 | // Step 3: create the Resend segment. | COMMENT |
| LOW | convex/broadcast/waveRuns.ts | 866 | // Step 4: chunk-persist picked rows. Each chunk is its own mutation so | COMMENT |
| LOW | convex/broadcast/waveRuns.ts | 885 | // Step 5: mark pick complete + schedule first push batch. | COMMENT |
| LOW | convex/broadcast/audienceWaveExport.ts | 293 | // Step 1: refuse to overlap with an existing wave. | COMMENT |
| LOW | convex/broadcast/audienceWaveExport.ts | 304 | // Step 2: stream registrations, dedup, reservoir-sample N. | COMMENT |
| LOW⚡ | convex/broadcast/audienceWaveExport.ts | 355 | // Step 3: create the Resend segment FIRST so we never stamp a | COMMENT |
| LOW⚡ | convex/broadcast/audienceWaveExport.ts | 363 | // Step 4: push picked contacts to the segment, then stamp ONLY on | COMMENT |
| LOW | api/brief/public/[hash].ts | 137 | // Step 1: resolve pointer → {userId, issueSlot}. | COMMENT |
| LOW | api/brief/public/[hash].ts | 170 | // Step 2: resolve the actual brief envelope. | COMMENT |
| LOW | src/components/InsightsPanel.ts | 315 | // Step 1: Signal aggregation (client-side, depends on real-time map data) | COMMENT |
| LOW | src/components/InsightsPanel.ts | 337 | // Step 2: Re-sort server stories by ISQ (shallow copy to avoid mutating cache) | COMMENT |
| LOW | src/components/InsightsPanel.ts | 408 | // Step 1: Signal aggregation + focal point detection (must run BEFORE ranking) | COMMENT |
| LOW⚡ | src/components/InsightsPanel.ts | 482 | // Step 2: Analyze sentiment (browser-based, fast) | COMMENT |
| LOW⚡ | src/components/InsightsPanel.ts | 491 | // Step 3: Generate World Brief (with cooldown) | COMMENT |
| LOW | src/components/InsightsPanel.ts | 537 | // Step 4: Wait for parallel analysis to complete | COMMENT |
| LOW | src/services/followed-countries.ts | 738 | // Step 1: parse localStorage (corruption recovery is unconditional). | COMMENT |
| LOW | src/services/followed-countries.ts | 762 | // Step 2: call mergeAnonymousLocal. | COMMENT |
| LOW⚡ | src/services/followed-countries.ts | 821 | // Step 3: auth-generation guard AFTER await — drop silently on stale. | COMMENT |
| 4 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | mcp-grant.html | 46 | <div id="loading"><span class="spinner" aria-hidden="true"></span><span class="placeholder" id="loadingBody">Loadi | CODE |
| LOW | convex/broadcast/sendBroadcast.ts | 79 | PRO_LAUNCH_PHYSICAL_ADDRESS.includes("placeholder") | CODE |
| LOW | src/locales/zh.json | 525 | "placeholder": "搜索或输入命令...", | CODE |
| LOW | src/locales/zh.json | 660 | "placeholder": { | CODE |
| LOW | src/locales/zh.json | 692 | "placeholder": "wm_xxxxxxxxxxxxxxxxxxxxxxxx", | CODE |
| LOW | src/locales/zh.json | 815 | "placeholder": "关键词（逗号分隔）", | CODE |
| LOW | src/locales/tr.json | 527 | "placeholder": "Ara veya komut yaz...", | CODE |
| LOW | src/locales/tr.json | 663 | "placeholder": { | CODE |
| LOW | src/locales/tr.json | 695 | "placeholder": "wm_xxxxxxxxxxxxxxxxxxxxxxxx", | CODE |
| LOW | src/locales/tr.json | 818 | "placeholder": "Anahtar kelimeler (virgul ile ayirin)", | CODE |
| LOW | src/locales/hu.json | 596 | "placeholder": "Keresés vagy parancs begépelése...", | CODE |
| LOW | src/locales/hu.json | 733 | "placeholder": { | CODE |
| LOW | src/locales/hu.json | 770 | "placeholder": "wm_xxxxxxxxxxxxxxxxxxxxxxxx", | CODE |
| LOW | src/locales/hu.json | 910 | "placeholder": "Kulcsszavak (vesszővel elválasztva)", | CODE |
| LOW | src/locales/nl.json | 212 | "placeholder": "Zoeken of commando typen...", | CODE |
| LOW | src/locales/nl.json | 333 | "placeholder": { | CODE |
| LOW | src/locales/nl.json | 457 | "placeholder": "wm_xxxxxxxxxxxxxxxxxxxxxxxx", | CODE |
| LOW | src/locales/nl.json | 477 | "placeholder": "Trefwoorden (door komma's gescheiden)", | CODE |
| LOW | src/locales/ja.json | 525 | "placeholder": "検索またはコマンドを入力...", | CODE |
| LOW | src/locales/ja.json | 660 | "placeholder": { | CODE |
| LOW | src/locales/ja.json | 692 | "placeholder": "wm_xxxxxxxxxxxxxxxxxxxxxxxx", | CODE |
| LOW | src/locales/ja.json | 815 | "placeholder": "キーワード（カンマ区切り）", | CODE |
| LOW | src/locales/de.json | 527 | "placeholder": "Suchen oder Befehl eingeben...", | CODE |
| LOW | src/locales/de.json | 663 | "placeholder": { | CODE |
| LOW | src/locales/de.json | 772 | "placeholder": "wm_xxxxxxxxxxxxxxxxxxxxxxxx", | CODE |
| LOW | src/locales/de.json | 792 | "placeholder": "Schlüsselwörter (durch Kommas getrennt)", | CODE |
| LOW | src/locales/ru.json | 531 | "placeholder": "Поиск или введите команду...", | CODE |
| LOW | src/locales/ru.json | 669 | "placeholder": { | CODE |
| LOW | src/locales/ru.json | 701 | "placeholder": "wm_xxxxxxxxxxxxxxxxxxxxxxxx", | CODE |
| LOW | src/locales/ru.json | 824 | "placeholder": "Ключевые слова (через запятую)", | CODE |
| LOW | src/locales/pl.json | 531 | "placeholder": "Szukaj lub wpisz polecenie...", | CODE |
| LOW | src/locales/pl.json | 668 | "placeholder": { | CODE |
| LOW | src/locales/pl.json | 778 | "placeholder": "wm_xxxxxxxxxxxxxxxxxxxxxxxx", | CODE |
| LOW | src/locales/pl.json | 798 | "placeholder": "Słowa kluczowe (oddzielone przecinkami)", | CODE |
| LOW | src/locales/uk.json | 600 | "placeholder": "Search or type a command...", | CODE |
| LOW | src/locales/uk.json | 739 | "placeholder": { | CODE |
| LOW | src/locales/uk.json | 776 | "placeholder": "wm_xxxxxxxxxxxxxxxxxxxxxxxx", | CODE |
| LOW | src/locales/uk.json | 916 | "placeholder": "Keywords (comma separated)", | CODE |
| LOW | src/locales/pt.json | 212 | "placeholder": "Pesquisar ou digitar um comando...", | CODE |
| LOW | src/locales/pt.json | 334 | "placeholder": { | CODE |
| LOW | src/locales/pt.json | 458 | "placeholder": "wm_xxxxxxxxxxxxxxxxxxxxxxxx", | CODE |
| LOW | src/locales/pt.json | 478 | "placeholder": "Palavras-chave (separadas por vírgula)", | CODE |
| LOW | src/locales/en.json | 596 | "placeholder": "Search or type a command...", | CODE |
| LOW | src/locales/en.json | 733 | "placeholder": { | CODE |
| LOW | src/locales/en.json | 770 | "placeholder": "wm_xxxxxxxxxxxxxxxxxxxxxxxx", | CODE |
| LOW | src/locales/en.json | 910 | "placeholder": "Keywords (comma separated)", | CODE |
| LOW | src/locales/it.json | 529 | "placeholder": "Cerca o digita un comando...", | CODE |
| LOW | src/locales/it.json | 666 | "placeholder": { | CODE |
| LOW | src/locales/it.json | 775 | "placeholder": "wm_xxxxxxxxxxxxxxxxxxxxxxxx", | CODE |
| LOW | src/locales/it.json | 795 | "placeholder": "Parole chiave (separate da virgole)", | CODE |
| LOW | src/locales/hr.json | 599 | "placeholder": "Pretraži ili unesite naredbu...", | CODE |
| LOW | src/locales/hr.json | 737 | "placeholder": { | CODE |
| LOW | src/locales/hr.json | 774 | "placeholder": "wm_xxxxxxxxxxxxxxxxxxxxxxxx", | CODE |
| LOW | src/locales/hr.json | 917 | "placeholder": "Ključne riječi (odvojene zarezom)", | CODE |
| LOW | src/locales/en.shell.json | 807 | "placeholder": { | CODE |
| LOW | src/locales/en.shell.json | 857 | "placeholder": "wm_xxxxxxxxxxxxxxxxxxxxxxxx", | CODE |
| LOW | src/locales/fr.json | 529 | "placeholder": "Rechercher ou saisir une commande...", | CODE |
| LOW | src/locales/fr.json | 665 | "placeholder": { | CODE |
| LOW | src/locales/fr.json | 705 | "placeholder": "wm_xxxxxxxxxxxxxxxxxxxxxxxx", | CODE |
| LOW | src/locales/fr.json | 795 | "placeholder": "Mots-clés (séparés par virgule)", | CODE |
| 57 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| CRITICAL | docs/railway-seed-consolidation-runbook.md | 1430 | .then(r=>r.json()).then(d=>d.data.project.services.edges.forEach(e=>{ | CODE |
| CRITICAL⚡ | src/app/country-intel.ts | 1389 | protests = this.ctx.intelligenceCache.protests.events.filter((e) => | CODE |
| CRITICAL⚡ | src/app/country-intel.ts | 1399 | militaryFlights = this.ctx.intelligenceCache.military.flights.filter((f) => | CODE |
| CRITICAL⚡ | src/app/country-intel.ts | 1402 | militaryVessels = this.ctx.intelligenceCache.military.vessels.filter((v) => | CODE |
| CRITICAL⚡ | src/app/country-intel.ts | 1405 | militaryFlightsInCountry = this.ctx.intelligenceCache.military.flights.filter((f) => | CODE |
| CRITICAL⚡ | src/app/country-intel.ts | 1408 | militaryVesselsInCountry = this.ctx.intelligenceCache.military.vessels.filter((v) => | CODE |
| CRITICAL | src/app/country-intel.ts | 1471 | thermalEscalations = this.ctx.intelligenceCache.thermalEscalation.clusters.filter( | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | package-lock.json | 20107 | "resolved": "https://registry.npmjs.org/robust-predicates/-/robust-predicates-3.0.3.tgz", | CODE |
| MEDIUM | server/worldmonitor/economic/v1/_bis-shared.ts | 45 | // Parse BIS CSV using papaparse — robust handling of quoted fields & metadata | COMMENT |
| MEDIUM | server/worldmonitor/resilience/v1/_dimension-scorers.ts | 2039 | // #6459 — comprehensive-embargo cap. | COMMENT |
| MEDIUM | server/worldmonitor/resilience/v1/_dimension-scorers.ts | 2289 | // #6459 comprehensive-embargo cap. Applied POST-blend so it constrains the | COMMENT |
| MEDIUM | server/worldmonitor/market/v1/analyze-stock.ts | 176 | // Quality / growth / leverage fundamentals parsed from Yahoo's financialData | COMMENT |
| MEDIUM | server/worldmonitor/market/v1/analyze-stock.ts | 364 | // recent >= 3 → trust interval (robust to calendar-boundary drift) | COMMENT |
| MEDIUM | server/worldmonitor/market/v1/analyze-stock.ts | 1084 | // Quality/growth/leverage fundamentals from the same financialData module. | COMMENT |
| MEDIUM | docs/api/MarketService.openapi.json | 1 | {"components":{"schemas":{"AnalystConsensus":{"properties":{"buy":{"format":"int32","type":"integer"},"hold":{"format":" | CODE |
| MEDIUM | convex/__tests__/billing.test.ts | 3733 | // Date.now() call) trips before any row is attempted — robust to however | COMMENT |
| MEDIUM | .github/workflows/perf-style-layout-budget.yml | 8 | # Scheduled rather than per-PR on purpose. The harness needs a real browser | COMMENT |
| MEDIUM | .github/workflows/perf-style-layout-budget.yml | 56 | # cpu 1 matches the committed baseline capture. A crashed harness must | COMMENT |
| MEDIUM | .github/workflows/perf-style-layout-budget.yml | 68 | # harness warning, implausibly low attribution) — nonzero, never green. | COMMENT |
| MEDIUM | api/a2a.ts | 141 | // Documented robust (never throws meaningfully; degrades to | COMMENT |
| MEDIUM | api/mcp/types.ts | 495 | // `read` returns the wire-ready `content[0].text` and MUST be robust: | COMMENT |
| MEDIUM | api/mcp/resources/index.ts | 433 | // `read()` is documented "MUST be robust", but enforce it at the boundary so | COMMENT |
| MEDIUM | e2e/pro-activation.spec.ts | 987 | // #5600: every per-step write in this harness fails (authFetch throws with | COMMENT |
| MEDIUM | src/components/BreakthroughsTickerPanel.ts | 66 | // Double the content for seamless infinite scroll | COMMENT |
| MEDIUM | src/e2e/map-harness.ts | 150 | throw new Error('Missing #app container for map harness'); | CODE |
| MEDIUM | src/e2e/mobile-map-harness.ts | 33 | throw new Error('Missing #app container for mobile popup harness'); | CODE |
| MEDIUM | src/e2e/mobile-map-integration-harness.ts | 55 | throw new Error('Missing #app container for mobile map integration harness'); | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | docs/railway-seed-consolidation-runbook.md | 27 | ## Deployment safety guardrails | COMMENT |
| MEDIUM | …of-hormuz-transit-report-2026-07/distribution-brief.md | 5 | from the repository owner before sending (per #5668 guardrails), and nothing | CODE |
| MEDIUM | docs/methodology/indicator-sources.yaml | 1 | # Resilience scorer indicator-source manifest (PR 0 scaffold, 2026-04-22). | COMMENT |
| MEDIUM | docs/architecture/pro-monetization.md | 116 | ├── checkout.ts # Dodo overlay orchestration | CODE |
| MEDIUM | .github/workflows/feed-validation.yml | 17 | # The --ci flag enforces three guardrails inside scripts/validate-rss-feeds.mjs: | COMMENT |
| MEDIUM | .github/workflows/deploy-gate.yml | 9 | # (#5479): event-driven evaluation alone can strand a PR — the check-runs API | COMMENT |
| MEDIUM | .github/workflows/deploy-gate.yml | 206 | # re-evaluated. A failed event-driven run normally posts pending | COMMENT |
| MEDIUM | workers/api-cors-preflight/src/index.js | 14 | // the Worker visible to code review, greptile, and CI guardrails. | COMMENT |
| MEDIUM | …tent/blog/ai-powered-intelligence-without-the-cloud.md | 70 | ### Semantic Search (RAG) | COMMENT |
| MEDIUM | src/app/panel-layout.ts | 216 | // it honest: `tests/panel-config-guardrails.test.mjs` fails CI on drift, and | COMMENT |
| MEDIUM | src/app/panel-layout.ts | 280 | // it in the app (CI also catches drift via panel-config-guardrails). | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | docs/api/IntelligenceService.openapi.json | 1 | {"components":{"schemas":{"ActorState":{"description":"ActorState is one geopolitical actor's leverage score in the regi | CODE |
| HIGH | docs/api/IntelligenceService.openapi.json | 1 | {"components":{"schemas":{"ActorState":{"description":"ActorState is one geopolitical actor's leverage score in the regi | CODE |
| HIGH | api/mcp/ui/forecasts-app.ts | 3 | // AI-generated geopolitical/economic forecasts as probability cards (title, | COMMENT |
| HIGH | api/mcp/skill-extension/generated.ts | 406 | "text": "---\nname: fetch-country-brief\nversion: 1\ndescription: Retrieve the current AI-generated strategic intell | CODE |
| HIGH | api/mcp/skill-extension/generated.ts | 406 | "text": "---\nname: fetch-country-brief\nversion: 1\ndescription: Retrieve the current AI-generated strategic intell | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | src/utils/export-report.ts | 309 | print(): void; | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | scripts/prepush-attest.sh | 26 | # Usage: | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | sdk/python/src/worldmonitor_sdk/__init__.py | 308 | __all__ = [ | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | scripts/convert-zh-tw.py | 54 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | scripts/_gem-geojson-to-canonical.py | 135 | CODE |