A self-hosted travel/trip planner with real-time collaboration, interactive maps, PWA support, SSO, budgets, packing lists, and more.
This report presents the forensic synthetic code analysis of mauriceboe/TREK, a TypeScript project with 12,934 GitHub stars. SynthScan v2.0 examined 783,410 lines of code across 3989 source files, recording 2296 pattern matches distributed across 11 syntactic categories. The overall adjusted score of 7.6 places this repository in the Low AI signal band.
The scanner applied 160+ deterministic lexical heuristics, multi-line block detectors, abstract syntax tree depth profilers, and a cross-file Jaccard similarity matrix to construct a statistically normalised synthetic code estimate. All matches are individually weighted by severity coefficient and contextual multiplier before summation, and the resulting headline score is temporally discounted to account for the repository's development history relative to the commercial emergence of large language model coding tooling (November 2022 onward).
This chart maps the temporal evolution of the adjusted synthetic code score across successive scan runs. An upward trajectory indicates ongoing incorporation of AI-generated code or expanding LLM-assisted scaffolding; a stable or declining trajectory may reflect active human refactoring, code removal, or the adoption of stricter authorship policies. The dashed secondary line (right axis) independently tracks total raw pattern hit count, which can diverge from the normalised score when codebase size changes significantly between scans.
Classifies detected patterns by their diagnostic confidence and structural impact. CRITICAL patterns (coefficient 10) represent definitive synthetic signatures — hallucinated imports, explicit LLM attribution metadata — virtually never produced by human authors. HIGH (5) indicates strong structural tells such as cross-file repetition or cross-linguistic idioms. MEDIUM (2) covers recognisable conversational padding and AI-specific vocabulary. LOW (1) captures subtle indicators like tautological comments and generic boilerplate that require density to carry independent signal.
This horizontal bar chart decomposes the repository's raw synthetic code score by top-level directory, allowing you to pinpoint precisely which modules or components carry the highest AI authorship density. Directories with disproportionately high scores relative to their size warrant targeted manual review: concentrated AI signatures often trace back to mass-generated configuration layers, auto-ported test suites, LLM-scaffolded boilerplate classes, or entire subsystems authored under heavy copilot assistance. Use this view to prioritise your human code-review effort.
The scanner identified 2296 distinct pattern matches across 11 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a statistically significant AI authorship indicator. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the diagnostic confidence level (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — comment-context matches receive a ×1.5 weight because LLMs systematically over-annotate. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier as dense clusters constitute far stronger evidence of synthetic authorship than isolated hits.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | plugin-sdk/test/checks-parity.test.ts | 51 | // ── 1. the README gate's constants ──────────────────────────────────────────── | COMMENT |
| MEDIUM | plugin-sdk/test/checks-parity.test.ts | 80 | // ── 2. the registry's real validator, run against an entry we built ─────────── | COMMENT |
| MEDIUM | plugin-sdk/src/index.ts | 384 | // ── integration hook interfaces ────────────────────────────────────────────── | COMMENT |
| MEDIUM | plugin-sdk/src/cli/ui.ts | 39 | // ── decoration ───────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | plugin-sdk/src/cli/ui.ts | 50 | // ── cancellation ───────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | plugin-sdk/src/cli/ui.ts | 61 | // ── prompts (cancel-checked, stderr-rendered) ──────────────────────────────── | COMMENT |
| MEDIUM | plugin-sdk/src/cli/ui.ts | 85 | // ── permissions ────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | plugin-sdk/src/cli/ui.ts | 286 | // ── flag helpers ────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | plugin-sdk/src/cli/checks/network.ts | 71 | // ── 1. the tag resolves to the pinned commit ──────────────────────────────────── | COMMENT |
| MEDIUM | plugin-sdk/src/cli/checks/network.ts | 111 | // ── 2. the manifest at the pinned commit matches the entry ────────────────────── | COMMENT |
| MEDIUM | plugin-sdk/src/cli/checks/network.ts | 160 | // ── 3. the released artifact ──────────────────────────────────────────────────── | COMMENT |
| MEDIUM | plugin-sdk/src/cli/checks/network.ts | 222 | // ── 4. the README at the pinned commit ────────────────────────────────────────── | COMMENT |
| MEDIUM | plugin-sdk/src/cli/checks/network.ts | 300 | // ── 5. owner binding (NEW — the registry has always enforced this) ─────────────── | COMMENT |
| MEDIUM | plugin-sdk/src/cli/checks/offline.ts | 39 | // ── manifest ──────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | plugin-sdk/src/cli/checks/offline.ts | 240 | // ── code ──────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | plugin-sdk/src/cli/checks/offline.ts | 340 | // ── docs ──────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | plugin-sdk/src/cli/checks/offline.ts | 472 | // ── release ───────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/tests/unit/plugins/egress-policy.test.ts | 126 | // ───────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/tests/unit/plugins/egress-policy.test.ts | 128 | // ───────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/tests/unit/plugins/safe-extract.test.ts | 13 | // ── tiny archive builders ──────────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | server/tests/unit/mcp/tools-prompts.test.ts | 205 | // ───────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | server/tests/unit/mcp/tools-prompts.test.ts | 207 | // ───────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | server/tests/unit/mcp/tools-prompts.test.ts | 214 | // ───────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | server/tests/unit/mcp/tools-prompts.test.ts | 216 | // ───────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/tests/unit/mcp/tools-prompts.test.ts | 237 | // ───────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/tests/unit/mcp/tools-prompts.test.ts | 239 | // ───────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/tests/unit/mcp/tools-prompts.test.ts | 313 | // ───────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/tests/unit/mcp/tools-prompts.test.ts | 315 | // ───────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/tests/unit/mcp/tools-prompts.test.ts | 384 | // ───────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/tests/unit/mcp/tools-prompts.test.ts | 386 | // ───────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/tests/unit/db/migration-hygiene.test.ts | 85 | // ── table rebuilds (data preserved) ────────────────────────────────────── | COMMENT |
| MEDIUM | server/tests/unit/db/migration-hygiene.test.ts | 97 | // ── photo/journey table rebuilds (data preserved) ──────────────────────── | COMMENT |
| MEDIUM⚡ | server/tests/unit/db/migration-hygiene.test.ts | 119 | // ── template/cache scaffolding drops (no user content lost) ────────────── | COMMENT |
| MEDIUM⚡ | server/tests/unit/db/migration-hygiene.test.ts | 125 | // ── guarded column drop ────────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | server/tests/unit/db/migration-hygiene.test.ts | 129 | // ── targeted, bounded DELETEs ──────────────────────────────────────────── | COMMENT |
| MEDIUM | server/tests/unit/nest/memories.controller.test.ts | 50 | // ───────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/tests/unit/nest/memories.controller.test.ts | 217 | // ───────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/tests/unit/nest/memories.controller.test.ts | 523 | // ───────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/tests/unit/nest/feeds.service.test.ts | 16 | // ── DB setup ────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/tests/unit/nest/feeds.service.test.ts | 72 | // ── Calendar parts the stub hands back ──────────────────────────────────────── | COMMENT |
| MEDIUM | server/tests/unit/nest/feeds.service.test.ts | 118 | // ── Trip feed token ─────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/tests/unit/nest/feeds.service.test.ts | 218 | // ── User (all-trips) feed token ─────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/tests/unit/nest/feeds.service.test.ts | 264 | // ── buildTripIcs ────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/tests/unit/nest/feeds.service.test.ts | 314 | // ── buildUserIcs ────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/tests/unit/nest/audit.service.test.ts | 13 | // ── DB setup ────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/tests/unit/nest/audit.service.test.ts | 77 | // ── getClientIp (pure, moved 1:1) ───────────────────────────────────────────── | COMMENT |
| MEDIUM | server/tests/unit/nest/audit.service.test.ts | 114 | // ── writeAudit (real DB) ────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/tests/unit/nest/share.service.test.ts | 12 | // ── DB setup ────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/tests/unit/nest/share.service.test.ts | 96 | // ── verifyTripAccess / canManage ────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/tests/unit/nest/share.service.test.ts | 122 | // ── createOrUpdate ──────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/tests/unit/nest/share.service.test.ts | 183 | // ── get / remove ────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/tests/unit/nest/share.service.test.ts | 218 | // ── getSharedTripData ───────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/tests/unit/nest/share.service.test.ts | 389 | // ── getSharedPlacePhotoKey ─────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …sts/unit/nest/notification-preferences.service.test.ts | 76 | // ───────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …sts/unit/nest/notification-preferences.service.test.ts | 78 | // ───────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …sts/unit/nest/notification-preferences.service.test.ts | 101 | // ───────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …sts/unit/nest/notification-preferences.service.test.ts | 103 | // ───────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …sts/unit/nest/notification-preferences.service.test.ts | 183 | // ───────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …sts/unit/nest/notification-preferences.service.test.ts | 185 | // ───────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …sts/unit/nest/notification-preferences.service.test.ts | 229 | // ───────────────────────────────────────────────────────────────────────────── | COMMENT |
| 1957 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | docker-compose.minio-test.yml | 1 | # Manual, license-gated live-provider test for the env-gated S3 driver | COMMENT |
| LOW | docker-compose.minio-test.yml | 21 | # argument, so `command: minio server /data --license /minio.license` | COMMENT |
| LOW | docker-compose.yml | 21 | - ENCRYPTION_KEY=${ENCRYPTION_KEY:-} # Recommended. Generate with: openssl rand -hex 32. If unset, falls back to d | COMMENT |
| LOW | docker-compose.yml | 41 | # - OIDC_DISPLAY_NAME=SSO # Label shown on the SSO login button | COMMENT |
| LOW | charts/trek/values.yaml | 21 | NODE_ENV: production | COMMENT |
| LOW | charts/trek/values.yaml | 41 | # Also used as the base URL for links in email notifications and other external links. | COMMENT |
| LOW | charts/trek/values.yaml | 61 | # OIDC_DISPLAY_NAME: "SSO" | COMMENT |
| LOW | charts/trek/values.yaml | 81 | # OVERPASS_URL: "" | COMMENT |
| LOW | wiki/Install-Helm.md | 101 | port: 3000 | COMMENT |
| LOW | wiki/Plugin-Development.md | 1401 | # your repo. It refuses a plugin that could not LOAD, but deliberately does not | COMMENT |
| LOW | plugin-sdk/examples/koffi/client/index.html | 61 | #puffS, #squint { transform-box: view-box; } | COMMENT |
| LOW | plugin-sdk/examples/trip-doctor/server/index.js | 1 | // Trip Doctor — a hooks-only TREK plugin that showcases the #1429 capabilities. | COMMENT |
| LOW | plugin-sdk/src/cli/create.ts | 141 | // Floor 4.0.0: the host surface this scaffold is written against — the enforced | COMMENT |
| LOW | plugin-sdk/src/cli/create.ts | 161 | // A notification channel usually targets a SELF-HOSTED service, whose hostname the | COMMENT |
| LOW | server/vitest.config.ts | 41 | // module runs in-process and is unit-tested. | COMMENT |
| LOW | server/tests/setup.console-noise.ts | 1 | // Filters *expected* noise off the test console so real failures stay visible | COMMENT |
| LOW | server/tests/setup.ts | 1 | // Global test setup — runs before every test file. | COMMENT |
| LOW | server/tests/setup.ts | 41 | // Nominatim's rate limit is a property of the real service, not of the code | COMMENT |
| LOW | server/tests/unit/plugins/egress-policy.test.ts | 121 | expect(dgramConnectTarget([53])).toBeNull(); | COMMENT |
| LOW | server/tests/unit/nest/storage/storage.service.test.ts | 301 | const res = Object.assign(sink, { | COMMENT |
| LOW | server/tests/unit/services/passwordPolicy.test.ts | 41 | }); | COMMENT |
| LOW | server/tests/integration/storage-stream-abort.test.ts | 201 | .on('error', reject); | COMMENT |
| LOW | server/scripts/migrate-encryption.ts | 341 | } | COMMENT |
| LOW | server/src/index.ts | 1 | import 'reflect-metadata'; | COMMENT |
| LOW | server/src/index.ts | 81 | let server: http.Server; | COMMENT |
| LOW | server/src/config.ts | 1 | import crypto from 'node:crypto'; | COMMENT |
| LOW | server/src/bootstrap.ts | 81 | app.useWebSocketAdapter(new TrekWsAdapter(boundHttpServer)); | COMMENT |
| LOW | server/src/bootstrap.ts | 101 | // '100kb' and stopped doing it when the Nest instance took over parsing, which | COMMENT |
| LOW | server/src/middleware/globalMiddleware.ts | 121 | // HSTS is worth enabling any time we're serving production traffic, | COMMENT |
| LOW | server/src/middleware/globalMiddleware.ts | 141 | // answer OPTIONS without Access-Control-Allow-Origin before the SDK's own cors() runs. | COMMENT |
| LOW | server/src/utils/ssrfGuard.ts | 141 | /** Link-local / cloud-metadata addresses — never a legitimate model host. */ | COMMENT |
| LOW | server/src/db/migrations.ts | 2781 | del.run(minLat, maxLat, minLng, maxLng); | COMMENT |
| LOW | server/src/db/migrations.ts | 2881 | created_at DATETIME DEFAULT CURRENT_TIMESTAMP | COMMENT |
| LOW | server/src/db/migrations.ts | 3361 | // runtime health (`status`). A crash used to flip status to 'error', which | COMMENT |
| LOW | server/src/db/migrations.ts | 3921 | // admin who has one — into that row, so an install that upgrades keeps the | COMMENT |
| LOW | server/src/db/migrations.ts | 4081 | // | COMMENT |
| LOW | server/src/systemNotices/registry.ts | 141 | // Desktop-only: the support modal is suppressed on small/mobile viewports. | COMMENT |
| LOW | server/src/nest/app.module.ts | 81 | // @OptionalAuth(), or declares its own @UseGuards chain. Protection used to | COMMENT |
| LOW | server/src/nest/maps/maps.service.ts | 421 | // True when the requested viewport was too large and got shrunk to a centred | COMMENT |
| LOW | server/src/nest/settings/settings.service.ts | 181 | } | COMMENT |
| LOW | server/src/nest/calendar/calendar.service.ts | 301 | } | COMMENT |
| LOW | server/src/nest/calendar/calendar.service.ts | 441 | COMMENT | |
| LOW | server/src/nest/auth/auth.service.ts | 581 | return { error: 'Cannot delete the last admin account', status: 400 }; | COMMENT |
| LOW | server/src/nest/llm-parse/llm-config.resolver.ts | 61 | const settings = this.settings.getUserSettings(userId); | COMMENT |
| LOW | server/src/nest/plugins/plugin-runtime.service.ts | 181 | private get db() { | COMMENT |
| LOW | server/src/nest/plugins/plugin-runtime.service.ts | 201 | if (applied.length) console.log(`[plugins] applied staged restore: ${applied.join(', ')}`); | COMMENT |
| LOW | server/src/nest/plugins/plugin-frame.controller.ts | 81 | res.setHeader('Content-Type', MIME[ext] ?? 'application/octet-stream'); | COMMENT |
| LOW | server/src/nest/plugins/plugin-frame.controller.ts | 101 | // added post-install for an operatorEgress plugin (plugin-runtime.service: activate()). | COMMENT |
| LOW | server/src/nest/plugins/host/plugin-data.service.ts | 21 | // the (capped) data size — a `WITH RECURSIVE …` can spin the synchronous host | COMMENT |
| LOW | server/src/nest/plugins/runtime/plugin-host-entry.ts | 321 | lock(process, 'send', () => { | COMMENT |
| LOW | server/src/nest/places/places.service.ts | 1161 | void this.enrichImportedList(tripId, created as EnrichablePlace[], opts); | COMMENT |
| LOW | server/src/nest/platform/platform.routes.ts | 121 | } | COMMENT |
| LOW | server/src/nest/platform/platform.routes.ts | 141 | // - Journey public-share pages (/public/journey/:token) | COMMENT |
| LOW | server/src/nest/storage/storage.service.ts | 201 | // fail after a successful stat — a delete that raced it, a backend blip — | COMMENT |
| LOW | server/src/nest/storage/storage.service.ts | 221 | try { | COMMENT |
| LOW | server/src/nest/storage/drivers/s3.driver.ts | 301 | // Dropping ContentType here means multipart objects are stored without | COMMENT |
| LOW | server/src/nest/atlas/atlas-geo.ts | 1 | import { Place } from '../../types'; | COMMENT |
| LOW | server/src/nest/atlas/atlas-geo.ts | 21 | // | COMMENT |
| LOW | server/src/nest/atlas/atlas-geo.ts | 221 | // Territories that have their own ISO code but no admin0 polygon in the bundle. | COMMENT |
| LOW | server/src/nest/atlas/atlas-geo.ts | 581 | boxes.push([minLng, minLat, maxLng, maxLat]); | COMMENT |
| 47 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | plugin-sdk/src/manifest.ts | 420 | function validatePluginDependencies(raw: unknown, selfId: string, errors: string[]): PluginDependency[] { | CODE |
| LOW | server/tests/unit/db/migration-hygiene.test.ts | 52 | function findDestructiveStatements(src: string): DestructiveHit[] { | CODE |
| LOW | server/tests/unit/systemNotices/registry.test.ts | 9 | function collectRegisteredActionIds(): Set<string> { | CODE |
| LOW⚡ | server/tests/unit/nest/travel-stats.service.test.ts | 166 | function splitChainThroughHelsinki(tripId: number, onwardDate: string, onwardTime: string) { | CODE |
| LOW⚡ | …rver/tests/unit/nest/notifications.inapp-prefs.test.ts | 220 | function insertBooleanNotification(recipientId: number, senderId: number | null = null): number { | CODE |
| LOW | server/tests/unit/nest/atlas.service.test.ts | 51 | function insertReservationEndpoint( | CODE |
| LOW | server/tests/unit/nest/backup.impl.test.ts | 1036 | function setupSuccessfulExtraction() { | CODE |
| LOW | server/tests/unit/nest/storage/storage.service.test.ts | 91 | function makeGhostLocalPathFixture(contents: string): Fixture & { driverCalls: string[] } { | CODE |
| LOW | server/tests/unit/nest/storage/storage.service.test.ts | 464 | function makeAbortingStreamFixture(err: { code?: string; syscall?: string; message?: string }) { | CODE |
| LOW | …r/tests/unit/nest/storage/storage-jobs.service.test.ts | 117 | function makePhotosGoogleMigrationWorld() { | CODE |
| LOW | …r/tests/unit/nest/storage/storage-jobs.service.test.ts | 139 | function makeMigrationBackfillWorld() { | CODE |
| LOW⚡ | server/tests/integration/notifications.test.ts | 418 | function insertBooleanNotification(recipientId: number): number { | CODE |
| LOW | server/tests/integration/share.test.ts | 556 | async function setupSharedPlaceWithPhoto() { | CODE |
| LOW | server/tests/helpers/plugin-host.ts | 86 | export function createPluginRpcHostFactory(dbs: DatabaseService): PluginRpcHostFactory { | CODE |
| LOW | server/tests/helpers/notifications.ts | 29 | export function makeNotificationPreferencesService(dbs: DatabaseService): NotificationPreferencesService { | CODE |
| LOW | server/tests/helpers/module-providers.ts | 24 | export function expectRegisteredController(moduleClass: object, controller: object): void { | CODE |
| LOW | server/src/mcp/sessionManager.ts | 39 | export function revokeUserSessionsForClient(userId: number, clientId: string): void { | CODE |
| LOW | server/src/mcp/sessionManager.ts | 55 | export function evictOldestSessionForUser(userId: number): string | null { | CODE |
| LOW | server/src/nest/auth/ephemeral-tokens.ts | 55 | export function consumeEphemeralTokenWithMeta( | CODE |
| LOW | server/src/nest/llm-parse/llm-config.ts | 44 | export function prepareLlmAddonConfigForWrite( | CODE |
| LOW | server/src/nest/llm-parse/clients/nuextract.ts | 257 | export function nuExtractToKiReservations(parsed: unknown): Record<string, unknown>[] { | CODE |
| LOW | server/src/nest/plugins/plugin-backup.ts | 39 | export function stageExtractedPluginTrees(extractDir: string): boolean { | CODE |
| LOW | server/src/nest/plugins/host/plugin-data.service.ts | 53 | export function checkpointAllPluginDataDbs(): void { | CODE |
| LOW | server/src/nest/places/places.helpers.ts | 214 | export function googleMapsFeatureIdFromItem(item: unknown): string | null { | CODE |
| LOW | server/src/nest/places/kml-import.helpers.ts | 102 | export function parseKmlLineStringCoordinates(value: unknown): Array<{ lat: number; lng: number; ele: number | null }> | | CODE |
| LOW | server/src/nest/places/kml-import.helpers.ts | 159 | export function resolveCategoryIdForFolder(folderName: string | null, lookup: Map<string, number>): number | null { | CODE |
| LOW | server/src/nest/platform/mcp-metadata.middleware.ts | 22 | export function createMcpMetadataMiddleware( | CODE |
| LOW | server/src/nest/permissions/permissions-cache.ts | 25 | export function invalidatePermissionsCache(): void { | CODE |
| LOW | server/src/nest/transit/transit-itinerary.helpers.ts | 180 | export function cleanTransitItineraryNames( | CODE |
| LOW | server/src/nest/transit/transit-itinerary.helpers.ts | 208 | export function buildTransitReservationParts( | CODE |
| LOW | server/src/nest/storage/storage-upload.factory.ts | 43 | export function buildStorageUploadOptions(storage: StorageService, opts: StorageUploadOptions) { | CODE |
| LOW | server/src/nest/storage/drivers/s3.driver.ts | 153 | function zeroByteChecksumWorkaround(size: number): { ApplyChecksum: true } | Record<string, never> { | CODE |
| LOW | server/src/nest/integrations/airtrail.mapper.ts | 178 | export function mapFlightsToMultiLegReservation( | CODE |
| LOW | server/src/nest/common/idempotency-cleanup.ts | 21 | export function purgeExpiredIdempotencyKeys( | CODE |
| LOW | server/src/nest/common/rowShape.ts | 12 | export function formatAssignmentWithPlace(a: AssignmentRow, tags: Partial<Tag>[], participants: Participant[]) { | CODE |
| LOW | server/src/nest/atlas/atlas.service.ts | 61 | function countryCodeFromRegionCode(regionCode: string): string { | CODE |
| LOW | shared/src/book/book.schema.ts | 811 | function withoutUnreadableElements(raw: unknown): unknown { | CODE |
| LOW | client/tests/unit/sync/mutationQueue.conflict.test.ts | 43 | function conflictThenAcceptHandler(serverName = 'Theirs') { | CODE |
| LOW | client/src/vacay/schoolHolidayCountries.ts | 24 | export function isSchoolHolidayCountrySupported(country: string): boolean { | CODE |
| LOW | client/src/utils/touchDragPolyfill.ts | 15 | export function maybeInstallTouchDragPolyfill(): Promise<unknown> | void { | CODE |
| LOW | client/src/utils/dayMerge.ts | 59 | export function getTransportRouteEndpoints( | CODE |
| LOW | client/src/utils/connectionsVisibility.ts | 54 | export function resolveEffectiveConnections(stored: StoredConnections | null, alwaysShowRoutesDefault: boolean): StoredC | CODE |
| LOW | client/src/utils/connectionsVisibility.ts | 60 | export function resolveVisibleConnectionIds(effective: StoredConnections, routableIds: number[]): number[] { | CODE |
| LOW | client/src/utils/globalErrorHandlers.ts | 48 | export function installGlobalErrorHandlers(): () => void { | CODE |
| LOW | …/src/components/Settings/AirTrailConnectionSection.tsx | 15 | export default function AirTrailConnectionSection(): React.ReactElement { | CODE |
| LOW | client/src/components/Vacay/holidayRegions.ts | 78 | export async function fetchSchoolHolidayRegionOptions(country: string, lang = activeLanguage()): Promise<{ value: string | CODE |
| LOW | client/src/components/Plugins/PluginFrame.tsx | 270 | function createPluginSessionStorageKeys( | CODE |
| LOW | client/src/components/Plugins/PluginContributions.tsx | 24 | export function usePluginViewContributions(view: ViewName, tripId: string | number | null | undefined) { | CODE |
| LOW | …/components/Planner/DayPlanSidebarTimeConfirmModal.tsx | 22 | export function DayPlanSidebarTimeConfirmModal({ timeConfirm, setTimeConfirm, confirmTimeRemoval, t }: DayPlanSidebarTim | CODE |
| LOW | …ponents/Planner/DayPlanSidebarTransportDetailModal.tsx | 24 | export function DayPlanSidebarTransportDetailModal({ | CODE |
| LOW | client/src/components/Planner/placeOpenStreetMap.ts | 9 | export function getOpenStreetMapUrlForPlace(place: PlaceLike | null | undefined): string | null { | CODE |
| LOW | client/src/components/Planner/PlaceInspector.tsx | 823 | function PlaceReservationParticipants({ selectedAssignmentId, reservations, assignments, selectedDayId, | CODE |
| LOW | client/src/components/Admin/storage/storageModel.ts | 408 | export function computeMigrationCandidates(draft: StorageConfig, state: StorageAdminState): MigrationCandidate[] { | CODE |
| LOW | client/src/components/Map/glProviders.ts | 43 | export function normalizeStyleForProvider(provider: GlMapProvider, style?: string | null): string { | CODE |
| LOW | client/src/components/Map/MapViewGL.tsx | 294 | function createPluginMarkerElement(tone: PluginMapMarker['tone']): HTMLDivElement { | CODE |
| LOW | …c/components/Collections/AddPlaceToCollectionModal.tsx | 39 | export default function AddPlaceToCollectionModal({ isOpen, collectionId, collectionName, categories, onClose, onAdded, | CODE |
| LOW | …c/components/Collections/SaveTripPlacesToListModal.tsx | 24 | export default function SaveTripPlacesToListModal({ isOpen, tripId, placeIds, onClose, onDone }: SaveTripPlacesToListMod | CODE |
| LOW | …mobile/screens/settings/MAirTrailConnectionSection.tsx | 15 | export default function MAirTrailConnectionSection(): React.ReactElement { | CODE |
| LOW | …rc/mobile/screens/admin/MAdminNotificationsSection.tsx | 24 | export default function MAdminNotificationsSection({ admin, t }: MAdminNotificationsSectionProps) { | CODE |
| LOW | …/mobile/screens/admin/MAdminPackingTemplateManager.tsx | 58 | export default function MAdminPackingTemplateManager() { | CODE |
| 10 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | plugin-sdk/test/checks.test.ts | 20 | author: 'Jane Doe', | CODE |
| LOW⚡ | server/tests/unit/nest/oidc.service.test.ts | 770 | const userInfoData = { sub: 'user-sub', email: 'user@example.com', name: 'User Name' }; | CODE |
| LOW⚡ | server/tests/unit/nest/oidc.service.test.ts | 779 | expect(result.email).toBe('user@example.com'); | CODE |
| LOW | server/tests/unit/nest/oidc.service.test.ts | 816 | { sub: 'user-sub', email: 'user@example.com', ...overrides }, | CODE |
| LOW | server/tests/unit/nest/notifications.service.test.ts | 41 | sendMailMock: vi.fn().mockResolvedValue({ accepted: ['test@test.com'] }), | CODE |
| LOW⚡ | server/tests/integration/auth.test.ts | 137 | email: 'admin@example.com', | CODE |
| LOW | shared/src/maps/maps.schema.spec.ts | 94 | attribution: 'Jane Doe', | CODE |
| LOW | client/tests/unit/stores/authStore.test.ts | 218 | const result = await useAuthStore.getState().login('user@example.com', 'password'); | CODE |
| LOW | …nt/tests/unit/mobile/admin/MAdminUsersSection.test.tsx | 53 | const ME = buildAdminUser({ id: 1, username: 'admin', email: 'admin@example.com', role: 'admin' }); | CODE |
| LOW | …unit/mobile/admin/MAdminDevNotificationsPanel.test.tsx | 13 | const ADMIN = buildAdmin({ id: 7, username: 'testadmin', email: 'admin@example.com' }); | CODE |
| LOW | …unit/mobile/admin/MAdminDevNotificationsPanel.test.tsx | 181 | params: { actor: 'testadmin', invitee: 'admin@example.com' }, | CODE |
| LOW | client/tests/unit/mobile/trip/ImpListStep.test.tsx | 44 | expect(screen.getByRole('textbox')).toHaveAttribute('placeholder', 'https://maps.app.goo.gl/…') | CODE |
| LOW | client/tests/unit/mobile/trip/ImpListStep.test.tsx | 52 | expect(screen.getByRole('textbox')).toHaveAttribute('placeholder', 'https://naver.me/…') | CODE |
| LOW⚡ | client/tests/integration/api/client.test.ts | 857 | await expect(notificationsApi.testSmtp('user@example.com')).resolves.toMatchObject({ ok: true }); | CODE |
| LOW | client/tests/helpers/mobileAdmin.ts | 20 | email: 'admin@example.com', | CODE |
| LOW | client/tests/helpers/msw/handlers/admin.ts | 7 | const admin1 = buildAdmin({ username: 'admin', email: 'admin@example.com' }); | CODE |
| LOW | …ient/src/components/Settings/NotificationsTab.test.tsx | 350 | expect(input).toHaveAttribute('placeholder', '••••••••'); | CODE |
| LOW | …ient/src/components/Settings/NotificationsTab.test.tsx | 956 | expect(tokenInput()).toHaveAttribute('placeholder', '••••••••'); | CODE |
| LOW | …ient/src/components/Settings/NotificationsTab.test.tsx | 1124 | expect(input).toHaveAttribute('placeholder', '••••••••'); | CODE |
| LOW | …ient/src/components/Settings/NotificationsTab.test.tsx | 1130 | expect(screen.getByRole('textbox')).toHaveAttribute('placeholder', 'https://discord.com/api/webhooks/...'), | CODE |
| LOW | client/src/components/Studio/bookTemplates.data.ts | 316 | "text": "Lorem ipsum dolor sit amet", | CODE |
| LOW | client/src/components/Studio/bookTemplates.data.ts | 316 | "text": "Lorem ipsum dolor sit amet", | CODE |
| LOW | client/src/components/Studio/bookTemplates.data.ts | 343 | "text": "Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt | CODE |
| LOW | client/src/components/Studio/bookTemplates.data.ts | 343 | "text": "Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt | CODE |
| LOW | client/src/components/Studio/bookTemplates.data.ts | 403 | "text": "Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt | CODE |
| LOW | client/src/components/Studio/bookTemplates.data.ts | 403 | "text": "Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt | CODE |
| LOW | client/src/components/Studio/bookTemplates.data.ts | 577 | "text": "Lorem ipsum dolor sit amet", | CODE |
| LOW | client/src/components/Studio/bookTemplates.data.ts | 577 | "text": "Lorem ipsum dolor sit amet", | CODE |
| LOW | client/src/components/Studio/bookTemplates.data.ts | 604 | "text": "Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt | CODE |
| LOW | client/src/components/Studio/bookTemplates.data.ts | 604 | "text": "Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt | CODE |
| LOW | client/src/components/Studio/bookTemplates.data.ts | 748 | "text": "Lorem ipsum dolor sit amet", | CODE |
| LOW | client/src/components/Studio/bookTemplates.data.ts | 748 | "text": "Lorem ipsum dolor sit amet", | CODE |
| LOW | client/src/components/Studio/bookTemplates.data.ts | 775 | "text": "Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt | CODE |
| LOW | client/src/components/Studio/bookTemplates.data.ts | 775 | "text": "Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt | CODE |
| LOW | client/src/components/Studio/bookTemplates.data.ts | 890 | "text": "Lorem ipsum dolor sit amet", | CODE |
| LOW | client/src/components/Studio/bookTemplates.data.ts | 890 | "text": "Lorem ipsum dolor sit amet", | CODE |
| LOW | client/src/components/Studio/bookTemplates.data.ts | 937 | "text": "Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt | CODE |
| LOW | client/src/components/Studio/bookTemplates.data.ts | 937 | "text": "Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt | CODE |
| LOW | client/src/components/Studio/bookTemplates.data.ts | 1202 | "text": "Lorem ipsum dolor sit amet", | CODE |
| LOW | client/src/components/Studio/bookTemplates.data.ts | 1202 | "text": "Lorem ipsum dolor sit amet", | CODE |
| LOW | client/src/components/Studio/bookTemplates.data.ts | 1229 | "text": "Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt | CODE |
| LOW | client/src/components/Studio/bookTemplates.data.ts | 1229 | "text": "Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt | CODE |
| LOW⚡ | client/src/components/Planner/PlaceInspector.test.tsx | 795 | const longText = 'Lorem ipsum dolor sit amet. '.repeat(200); | CODE |
| LOW⚡ | client/src/components/Planner/PlaceInspector.test.tsx | 795 | const longText = 'Lorem ipsum dolor sit amet. '.repeat(200); | CODE |
| LOW | client/src/components/Planner/PlaceInspector.test.tsx | 817 | const longText = 'Lorem ipsum dolor sit amet. '.repeat(200); | CODE |
| LOW | client/src/components/Planner/PlaceInspector.test.tsx | 817 | const longText = 'Lorem ipsum dolor sit amet. '.repeat(200); | CODE |
| LOW | client/src/components/Planner/PlaceFormModal.test.tsx | 111 | const place = buildPlace({ name: 'Test', address: '123 Main St' }); | CODE |
| LOW | client/src/components/Planner/PlaceFormModal.test.tsx | 113 | expect(screen.getByDisplayValue('123 Main St')).toBeInTheDocument(); | CODE |
| LOW⚡ | …ient/src/components/Admin/storage/BackendForm.test.tsx | 45 | expect(screen.getByLabelText(/Region/)).toHaveAttribute('placeholder', 'us-east-1'); | CODE |
| LOW⚡ | …ient/src/components/Admin/storage/BackendForm.test.tsx | 47 | expect(screen.getByLabelText(/Retries/)).toHaveAttribute('placeholder', '1'); | CODE |
| LOW⚡ | …ient/src/components/Admin/storage/BackendForm.test.tsx | 48 | expect(screen.getByLabelText(/Timeout \(ms\)/)).toHaveAttribute('placeholder', '30000'); | CODE |
| LOW | client/src/components/shared/CustomTimePicker.test.tsx | 539 | expect(screen.getByRole('textbox')).toHaveProperty('placeholder', '00:00'); | CODE |
| LOW | client/src/components/shared/CustomTimePicker.test.tsx | 544 | expect(screen.getByRole('textbox')).toHaveProperty('placeholder', '2:30 PM'); | CODE |
| LOW | client/src/pages/LoginPage.test.tsx | 39 | await user.type(screen.getByPlaceholderText(EMAIL_PLACEHOLDER), 'user@example.com'); | CODE |
| LOW | client/src/pages/LoginPage.test.tsx | 94 | await user.type(screen.getByPlaceholderText(EMAIL_PLACEHOLDER), 'user@example.com'); | CODE |
| LOW | client/src/pages/LoginPage.test.tsx | 126 | await user.type(screen.getByPlaceholderText(EMAIL_PLACEHOLDER), 'user@example.com'); | CODE |
| LOW | client/src/pages/LoginPage.test.tsx | 248 | await user.type(screen.getByPlaceholderText(EMAIL_PLACEHOLDER), 'user@example.com'); | CODE |
| LOW | client/src/pages/LoginPage.test.tsx | 271 | await user.type(screen.getByPlaceholderText(EMAIL_PLACEHOLDER), 'user@example.com'); | CODE |
| LOW | client/src/pages/LoginPage.test.tsx | 299 | await user.type(screen.getByPlaceholderText(EMAIL_PLACEHOLDER), 'user@example.com'); | CODE |
| LOW | client/src/pages/LoginPage.test.tsx | 327 | await user.type(screen.getByPlaceholderText(EMAIL_PLACEHOLDER), 'user@example.com'); | CODE |
| 8 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | plugin-sdk/test/publish.test.ts | 64 | // publish now gates on the registry's checks BEFORE it packs or releases, so a bare scaffold | COMMENT |
| MEDIUM | plugin-sdk/test/publish.test.ts | 127 | // Deliberately NOT made publishable: this is a fresh scaffold, exactly what a first-time | COMMENT |
| MEDIUM | plugin-sdk/test/sdk.test.ts | 527 | // is how a scaffold could sail through `validate` and then be rejected by the registry. | COMMENT |
| MEDIUM | plugin-sdk/test/sdk.test.ts | 531 | // The scaffold's README references ./docs/screenshot.png and never creates it. The old check | COMMENT |
| MEDIUM | plugin-sdk/test/sdk.test.ts | 655 | // A scaffold-shaped CJS entry that requires the SDK without any node_modules. | COMMENT |
| MEDIUM | plugin-sdk/test/cli.test.ts | 26 | // The scaffold must NOT invent a placeholder — it declares operatorEgress instead, which | COMMENT |
| MEDIUM | plugin-sdk/src/cli/dev.ts | 197 | // one-arg calls work on a fresh scaffold — without this, a fixtures file that omits | COMMENT |
| MEDIUM | plugin-sdk/src/cli/dev.ts | 452 | // hard-coded to 42 while the scaffold seeds trip 1, so the widget's first | COMMENT |
| MEDIUM | plugin-sdk/src/cli/create.ts | 141 | // Floor 4.0.0: the host surface this scaffold is written against — the enforced | COMMENT |
| MEDIUM | plugin-sdk/src/cli/create.ts | 158 | // grey square in the store, so the scaffold picks a real one rather than leaving it out. | COMMENT |
| MEDIUM | plugin-sdk/src/cli/create.ts | 235 | // The README has always linked ./docs/screenshot.png, and the scaffold has never created the | COMMENT |
| MEDIUM | plugin-sdk/src/cli/create.ts | 533 | // The scaffold turns each host into a matching http:outbound:<host> grant. Leaving it | COMMENT |
| MEDIUM | server/CLAUDE.md | 51 | ## Direction (post-migration guardrails, from the 2026 audit) | COMMENT |
| MEDIUM | server/src/db/migrations.ts | 3297 | // Migration 155: plugin system scaffold (#plugins). A plugin is a row here; | COMMENT |
| MEDIUM | server/src/nest/plugins/plugins.service.ts | 20 | * Read side of the plugin system (#plugins), M0 scaffold. Lists installed | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| CRITICAL | server/tests/unit/places/places.rpc.test.ts | 138 | expect(f.realtime.broadcast.mock.calls.map((c) => c[1])).toEqual(['place:created', 'place:updated', 'place:deleted'] | CODE |
| CRITICAL | server/tests/unit/todo/todo.rpc.test.ts | 92 | expect(f.realtime.broadcast.mock.calls.map((c) => c[1])).toEqual(['todo:created', 'todo:updated', 'todo:deleted']); | CODE |
| CRITICAL | server/tests/unit/days/days-itinerary.rpc.test.ts | 84 | expect(f.realtime.broadcast.mock.calls.map((c) => c[1])).toEqual(['day:created', 'day:updated', 'day:deleted']); | CODE |
| CRITICAL | server/tests/unit/budget/costs.rpc.test.ts | 142 | expect(f.realtime.broadcast.mock.calls.map((c) => c[1])).toEqual(['budget:created', 'budget:updated', 'budget:delete | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | server/tests/integration/auth.test.ts | 14 | // Step 1: Bare in-memory DB — schema applied in beforeAll after mocks register | COMMENT |
| LOW⚡ | server/tests/integration/auth.test.ts | 566 | // Step 1: login to get mfa_token | COMMENT |
| LOW⚡ | server/tests/integration/auth.test.ts | 573 | // Step 2: verify with a backup code | COMMENT |
| LOW⚡ | server/tests/integration/auth.test.ts | 580 | // Step 3: same backup code is now consumed — second login attempt fails | COMMENT |
| LOW⚡ | server/tests/integration/journey.test.ts | 11 | // Step 1: Bare in-memory DB — schema applied in beforeAll after mocks register | COMMENT |
| LOW⚡ | server/tests/integration/trips.test.ts | 11 | // Step 1: Bare in-memory DB — schema applied in beforeAll after mocks register | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | server/tests/integration/auth.test.ts | 14 | // Step 1: Bare in-memory DB — schema applied in beforeAll after mocks register | COMMENT |
| LOW⚡ | server/tests/integration/auth.test.ts | 566 | // Step 1: login to get mfa_token | COMMENT |
| LOW⚡ | server/tests/integration/auth.test.ts | 573 | // Step 2: verify with a backup code | COMMENT |
| LOW⚡ | server/tests/integration/auth.test.ts | 580 | // Step 3: same backup code is now consumed — second login attempt fails | COMMENT |
| LOW⚡ | server/tests/integration/journey.test.ts | 11 | // Step 1: Bare in-memory DB — schema applied in beforeAll after mocks register | COMMENT |
| LOW⚡ | server/tests/integration/trips.test.ts | 11 | // Step 1: Bare in-memory DB — schema applied in beforeAll after mocks register | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | wiki/Troubleshooting.md | 368 | -H "X-Goog-Api-Key: YOUR_API_KEY" \ | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | docker-compose.yml | 42 | # - OIDC_ONLY=false # Set true to force SSO-only mode: disables password login and registration, overrides Admin > | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | client/e2e/screenshots/seed.ts | 317 | ['admin', "It's included — kaiseki, 18:30. Added it to the to-dos so we don't forget to confirm."], | CODE |