3.0

Adjusted Signal

3.0

Raw Pattern Score

100%

Time Factor

2026-10-31

Last Push

8.9K

Stars

Dart

Language

628.2K

Lines of Code

1.9K

Files

1.9K

Pattern Hits

2026-10-31

Scan Date

0.00

HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 13.7/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 1873 finding(s).

Hallucinated Dependency & Supply Chain Risk 0.2/100 · LOW

Are imports declared and package/API names verified? 9 finding(s).

Agent Over-Engineering Ratio 0.0/100 · LOW

Are wrappers, guards, and repeated structures necessary? 3 finding(s).

PR Review Velocity Impact 14.2/100 · LOW

Which changes need focused human review? 1885 finding(s).

What These Metrics Mean

Adjusted Signal: Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score: Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor: A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits: Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate: High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files: Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 2HIGH 0MEDIUM 11LOW 1872

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 1885 distinct pattern matches across 11 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Over-Commented Block1850 hits · 1798 pts

Severity	File	Line	Snippet	Context
LOW	Cargo.toml	1	# ServerBox monorepo Rust workspace	COMMENT
LOW	Cargo.toml	21	# the stripped result is rejected by the loader:	COMMENT
LOW	Cargo.toml	41	# On the platforms this is for, the shipped artifact is not larger. Gradle's	COMMENT
LOW	Cargo.toml	61	# `monitor/Dockerfile`, and by nothing the app builds.	COMMENT
LOW	pubspec.yaml	201	# The theme catalog's floor: whose repositories the store offers when its	COMMENT
LOW	pubspec.yaml	221	# Only distributions whose logo carries an explicit copyright licence are	COMMENT
LOW	pubspec.yaml	261		COMMENT
LOW	analysis_options.yaml	1	# This file configures the analyzer, which statically analyzes Dart code to	COMMENT
LOW	benchmark/bin/ssh_bench.dart	1	/// Layers 2 and 3 of the SSH throughput investigation, against a real host.	COMMENT
LOW	benchmark/bin/ssh_bench.dart	21	/// Configuration — environment, or a `.env` beside this file or at the repo	COMMENT
LOW	benchmark/bin/cipher_bench.dart	1	/// Layer 1 of the SSH throughput investigation: raw symmetric-crypto cost,	COMMENT
LOW	benchmark/tool/bench_target.sh	1	#!/usr/bin/env bash	COMMENT
LOW	integration_test/ios_bench_test.dart	1	import 'dart:convert';	COMMENT
LOW	integration_test/ios_bench_test.dart	21	/// --target=integration_test/ios_bench_test.dart \	COMMENT
LOW	integration_test/ios_bench_test.dart	121	// Also to a file, because the printed copy needs a harness attached to be	COMMENT
LOW	integration_test/android_rootfs_test.dart	1	import 'dart:io';	COMMENT
LOW	integration_test/sandbox_import_test.dart	1	import 'dart:io';	COMMENT
LOW	integration_test/driver.dart	1	import 'package:integration_test/integration_test_driver.dart';	COMMENT
LOW	integration_test/driver.dart	21	///	COMMENT
LOW	integration_test/ios_load_test.dart	1	import 'dart:io';	COMMENT
LOW	integration_test/local_shell_test.dart	21	/// the suite means "wherever a local shell is offered, it works" — and cannot	COMMENT
LOW	integration_test/rootfs_shell_test.dart	21	/// [AndroidRootfs] finds proot and installs a rootfs, and	COMMENT
LOW	crates/sbm_parser/tests/script_compat.rs	981	// says `No such file or directory` — so what is asserted is that the	COMMENT
LOW	crates/sbm_parser/tests/bench_script.rs	1	//! The benchmark commands, run against a real `/bin/sh`, ported from the app's	COMMENT
LOW	crates/sbm_parser/tests/dart_compat.rs	481	);	COMMENT
LOW	crates/sbm_parser/tests/alpine_e2e.rs	1	//! Opt-in Alpine container e2e: exercises the busybox branches of the	COMMENT
LOW	crates/sbm_parser/tests/hostile_input.rs	1	//! What a remote host must not be able to do to the process parsing its output.	COMMENT
LOW	crates/sbm_parser/tests/ssh_e2e.rs	1	//! Opt-in end-to-end test over real SSH.	COMMENT
LOW	crates/sbm_parser/tests/ssh_e2e.rs	81	///	COMMENT
LOW	crates/sbm_parser/tests/user_compat.rs	1	//! The users module against the app's own cases.	COMMENT
LOW	crates/sbm_parser/src/snippet.rs	1	//! The snippet macro language: which `${…}` a saved script may contain, and	COMMENT
LOW	crates/sbm_parser/src/snippet.rs	21	//!	COMMENT
LOW	crates/sbm_parser/src/snippet.rs	41		COMMENT
LOW	crates/sbm_parser/src/snippet.rs	61		COMMENT
LOW	crates/sbm_parser/src/snippet.rs	101	/// convention): `{"type":"text","text":"ls"}`,	COMMENT
LOW	crates/sbm_parser/src/snippet.rs	121	/// Wait before the next step.	COMMENT
LOW	crates/sbm_parser/src/types.rs	1	//! Structured status types and diff helpers	COMMENT
LOW	crates/sbm_parser/src/types.rs	21		COMMENT
LOW	crates/sbm_parser/src/types.rs	181	///	COMMENT
LOW	crates/sbm_parser/src/types.rs	241	};	COMMENT
LOW	crates/sbm_parser/src/types.rs	561	/// full while its data volume was at 95%. A container's used space is its size	COMMENT
LOW	crates/sbm_parser/src/cron.rs	1	//! The logged-in account's crontab: the listing script, the document model and	COMMENT
LOW	crates/sbm_parser/src/cron.rs	821	/// empty document the user can add to, not an error. Each implementation says	COMMENT
LOW	crates/sbm_parser/src/tmux.rs	1	//! tmux discovery: finding tmux, listing its sessions and a session's windows,	COMMENT
LOW	crates/sbm_parser/src/tmux.rs	21	pub const FIND_COMMAND: &str =	COMMENT
LOW	crates/sbm_parser/src/tmux.rs	141	/// The rules are tmux's own, not a shell's: both values are quoted before they	COMMENT
LOW	crates/sbm_parser/src/protocol.rs	1	//! The app ↔ agent protocol version: the one number both sides compare.	COMMENT
LOW	crates/sbm_parser/src/users.rs	1	//! The machine's accounts and groups — the passwd and group catalogs, one	COMMENT
LOW	crates/sbm_parser/src/users.rs	21	//! rather than shown a partial answer — `cat /etc/passwd` on macOS prints the	COMMENT
LOW	crates/sbm_parser/src/users.rs	81	///	COMMENT
LOW	crates/sbm_parser/src/users.rs	261	Set,	COMMENT
LOW	crates/sbm_parser/src/users.rs	321	#[serde(default)]	COMMENT
LOW	crates/sbm_parser/src/users.rs	341	/// What a caller wants a group to be.	COMMENT
LOW	crates/sbm_parser/src/users.rs	361	/// translate, and a rule added later would arrive as prose in whichever	COMMENT
LOW	crates/sbm_parser/src/users.rs	421	// ---------------------------------------------------------------------------	COMMENT
LOW	crates/sbm_parser/src/users.rs	801	/// A name `useradd` accepts: lowercase, starting with a letter or underscore,	COMMENT
LOW	crates/sbm_parser/src/lib.rs	1	//! ServerBox shared status parsing library	COMMENT
LOW	crates/sbm_parser/src/lib.rs	61	pub cpu_brand: Vec<(String, u32)>,	COMMENT
LOW	crates/sbm_parser/src/lib.rs	81	/// single clean lines, but this field is not semantically a "hostname	COMMENT
LOW	crates/sbm_parser/src/proc.rs	1	//! The process table — the model, the two parsers and the stop command.	COMMENT
1790 more matches not shown…

Hallucination Indicators2 hits · 20 pts

Severity	File	Line	Snippet	Context
CRITICAL	test/unit/ssh/server_tcp_test.dart	70	await ssh.channels.single.closed.future.timeout(	CODE
CRITICAL	test/unit/ssh/server_tcp_test.dart	116	await ssh.channels.single.closed.future.timeout(	CODE

Modern AI Meta-Vocabulary6 hits · 18 pts

Severity	File	Line	Snippet	Context
MEDIUM	test/widget/home_rail_tabs_test.dart	614	/// A rail beside an empty tab, on a page whose scaffold is [scaffold], with	COMMENT
MEDIUM	test/widget/home_rail_tabs_test.dart	699	// A background image makes the scaffold transparent on purpose, so every	COMMENT
MEDIUM	test/widget/home_rail_tabs_test.dart	724	// No background, so the scaffold's colour is a real one and there is	COMMENT
MEDIUM	test/widget/snippet_list_test.dart	22	/// for it. An early return that answers the emptiness before the scaffold is	COMMENT
MEDIUM	lib/view/page/ssh/tab.dart	156	/// A scaffold of its own so the button belongs to the page it acts on,	COMMENT
MEDIUM	lib/view/page/setting/app_page.dart	153	/// else: no bar, no background, no scaffold.	COMMENT

Unused Imports7 hits · 7 pts

Severity	File	Line	Context
LOW	.claude/skills/serverbox-theme/scripts/pack.py	16	CODE
LOW	.claude/skills/serverbox-theme/scripts/validate.py	23	CODE
LOW	.claude/skills/serverbox-theme/scripts/publish.py	54	CODE
LOW	.claude/skills/serverbox-theme/scripts/port_vscode.py	14	CODE
LOW	ios/scripts/add_watch_widget_target.py	21	CODE
LOW	scripts/build_land_asset.py	34	CODE
LOW	scripts/theme-icons.py	19	CODE

Deep Nesting7 hits · 7 pts

Severity	File	Line	Context
LOW	.claude/skills/serverbox-theme/scripts/validate.py	70	CODE
LOW	.claude/skills/serverbox-theme/scripts/validate.py	288	CODE
LOW	.claude/skills/serverbox-theme/scripts/publish.py	152	CODE
LOW	.claude/skills/serverbox-theme/scripts/port_vscode.py	24	CODE
LOW	.claude/skills/serverbox-theme/scripts/port_vscode.py	111	CODE
LOW	.claude/skills/serverbox-theme/scripts/port_vscode.py	132	CODE
LOW	scripts/build_land_asset.py	78	CODE

Verbosity Indicators3 hits · 7 pts

Severity	File	Line	Snippet	Context
LOW⚡	test/unit/server/server_dedup_test.dart	380	// Step 1: Remove duplicates	COMMENT
LOW⚡	test/unit/server/server_dedup_test.dart	388	// Step 2: Resolve name conflicts	COMMENT
LOW⚡	test/unit/server/server_dedup_test.dart	398	// Step 3: Get summary	COMMENT

Structural Annotation Overuse3 hits · 7 pts

Severity	File	Line	Snippet	Context
LOW⚡	test/unit/server/server_dedup_test.dart	380	// Step 1: Remove duplicates	COMMENT
LOW⚡	test/unit/server/server_dedup_test.dart	388	// Step 2: Resolve name conflicts	COMMENT
LOW⚡	test/unit/server/server_dedup_test.dart	398	// Step 3: Get summary	COMMENT

AI Slop Vocabulary2 hits · 6 pts

Severity	File	Line	Snippet	Context
MEDIUM	monitor/frontend/src/lib/terminal.svelte.ts	10	/// networks rejoins the same shell. Getting that to feel seamless rather than	COMMENT
MEDIUM	monitor/src/api/ws/session.rs	17	//! Reattaching aims to be seamless rather than merely possible: see	COMMENT

Excessive Try-Catch Wrapping3 hits · 5 pts

Severity	File	Line	Snippet	Context
LOW	crates/sbm_parser/src/proc.rs	1180	except Exception:	CODE
MEDIUM	lib/view/page/server/edit/actions.dart	915	dprint('Error checking SSH config: $e');	CODE
MEDIUM	lib/view/page/setting/entries/ssh.dart	137	dprint('Error importing SSH config: $e');	CODE

Self-Referential Comments1 hit · 3 pts

Severity	File	Line	Snippet	Context
MEDIUM	scripts/release/android-build-env.sh	3	# This file is sourced by the preparation and offline build entry points.	COMMENT

Example Usage Blocks1 hit · 2 pts

Severity	File	Line	Snippet	Context
LOW	scripts/update-yabs.sh	9	# Usage:	COMMENT

lollipopkit/flutter_server_box

Open-Source Code Quality, Security and Technical Debt Review