Open Source LLM Gateway 🦚
This report summarizes scanner evidence for mnfst/manifest, a TypeScript project with 7,611 GitHub stars. SynthScan examined 462,197 lines of code across 1690 source files, recording 463 pattern matches distributed across 9 syntactic categories. The legacy adjusted pattern signal is 1.3 (Low pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.
Can maintainers explain intent, assumptions, and trade-offs? 315 finding(s).
Are imports declared and package/API names verified? 98 finding(s).
Are wrappers, guards, and repeated structures necessary? 306 finding(s).
Which changes need focused human review? 463 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 463 distinct pattern matches across 9 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | nodes/Manifest/Manifest.node.ts | 82 | export function withoutRouteManagedStream(body: IDataObject): IDataObject { | CODE |
| LOW | …ons/n8n-nodes-manifest/nodes/Manifest/Manifest.node.ts | 82 | export function withoutRouteManagedStream(body: IDataObject): IDataObject { | CODE |
| LOW | packages/frontend/tests/components/MultiSelect.test.tsx | 124 | function renderSelfDerivedMultiSelect() { | CODE |
| LOW | …rontend/tests/components/DeviceCodeDetailView.test.tsx | 385 | function renderConnectedWithAddKeyOpen() { | CODE |
| LOW | …ckages/frontend/src/components/message-table-cells.tsx | 186 | function resolveMessageProviderName(item: MessageRow): string | undefined { | CODE |
| LOW | packages/frontend/src/components/ProviderKeyForm.tsx | 35 | function baseUrlPlaceholderMatches( | CODE |
| LOW | packages/frontend/src/services/playground-store.ts | 486 | export function getOrCreatePlaygroundStore(agentName: string): PlaygroundStore { | CODE |
| LOW | packages/frontend/src/services/playground-store.ts | 486 | export function getOrCreatePlaygroundStore(agentName: string): PlaygroundStore { | CODE |
| LOW | packages/frontend/src/services/routing-params.ts | 40 | export function parseCustomProviderParams( | CODE |
| LOW | packages/frontend/src/services/billing-display.ts | 26 | export function formatBillingPriceWithInterval( | CODE |
| LOW | packages/frontend/src/services/routing-utils.ts | 21 | export function usedKeyLabelsForModelInTier( | CODE |
| LOW | packages/frontend/src/services/routing-utils.ts | 80 | export function availableRouteKeysForModel( | CODE |
| LOW | packages/frontend/src/services/routing-utils.ts | 103 | export function routeKeySelectionForModel(input: { | CODE |
| LOW | …ckages/frontend/src/services/message-error-taxonomy.ts | 8 | export function isPlanRequestLimitMessage(message: MessageErrorTaxonomySignals): boolean { | CODE |
| LOW⚡ | …s/frontend/src/services/connection-breadcrumb-store.ts | 13 | export function connectionBreadcrumbProviderId(): string | null { | CODE |
| LOW⚡ | …s/frontend/src/services/connection-breadcrumb-store.ts | 17 | export function connectionBreadcrumbLabel(): string | null { | CODE |
| LOW⚡ | …s/frontend/src/services/connection-breadcrumb-store.ts | 21 | export function connectionBreadcrumbBackLink(): string { | CODE |
| LOW⚡ | …s/frontend/src/services/connection-breadcrumb-store.ts | 25 | export function connectionBreadcrumbBackLabel(): string { | CODE |
| LOW | packages/frontend/src/services/discovery.ts | 115 | export function hasDiscoveryBeenDoneLocally(userId: string): boolean { | CODE |
| LOW | packages/frontend/src/services/chart-utils.ts | 88 | export function createFormatLegendTimestamp( | CODE |
| LOW | packages/frontend/src/services/framework-snippets.ts | 127 | function getOpenAIChatPythonSnippet( | CODE |
| LOW | packages/frontend/src/services/framework-snippets.ts | 149 | function getOpenAIChatTypeScriptSnippet( | CODE |
| LOW | packages/frontend/src/services/framework-snippets.ts | 181 | function getAnthropicPythonSnippet( | CODE |
| LOW | packages/frontend/src/services/framework-snippets.ts | 205 | function getAnthropicTypeScriptSnippet( | CODE |
| LOW | packages/frontend/src/services/framework-snippets.ts | 329 | export function getOpenClawDisableSnippet(model: string): string { | CODE |
| LOW | packages/frontend/src/services/provider-key-labels.ts | 1 | export function suggestNextProviderKeyLabel(existing: string[]): string { | CODE |
| LOW | packages/frontend/src/services/api/oauth.ts | 36 | export function submitOpenaiOAuthCallback(code: string, state: string) { | CODE |
| LOW | packages/frontend/src/services/api/oauth.ts | 158 | export function submitGeminiOAuthCallback(code: string, state: string) { | CODE |
| LOW | packages/frontend/src/services/api/analytics.ts | 34 | export function getProviderAnalyticsAgents(authType: string): Promise<{ agents: string[] }> { | CODE |
| LOW | packages/frontend/src/services/api/analytics.ts | 61 | export function getConnectionAttemptStatusTimeseries( | CODE |
| LOW | packages/frontend/src/services/api/analytics.ts | 78 | export function getConnectionAttemptHttpStatusTimeseries( | CODE |
| LOW | packages/frontend/src/services/api/analytics.ts | 105 | export function getConnectionAttemptBreakdown( | CODE |
| LOW | packages/frontend/src/services/api/analytics.ts | 122 | export function getConnectionAttemptsByAgentTimeseries( | CODE |
| LOW | packages/frontend/src/services/api/analytics.ts | 138 | export function getPerAgentMessageTimeseries( | CODE |
| LOW | packages/frontend/src/services/api/analytics.ts | 154 | export function getPerAgentCostTimeseries( | CODE |
| LOW⚡ | packages/frontend/src/services/api/analytics.ts | 174 | export function getGlobalPerAgentTimeseries(range = '24h'): PivotedTimeseries { | CODE |
| LOW⚡ | packages/frontend/src/services/api/analytics.ts | 178 | export function getGlobalPerAgentMessageTimeseries(range = '24h'): PivotedTimeseries { | CODE |
| LOW⚡ | packages/frontend/src/services/api/analytics.ts | 182 | export function getGlobalPerAgentCostTimeseries(range = '24h'): PivotedTimeseries { | CODE |
| LOW⚡ | packages/frontend/src/services/api/analytics.ts | 190 | export function getGlobalPerProviderTimeseries(range = '24h'): PivotedTimeseries { | CODE |
| LOW⚡ | packages/frontend/src/services/api/analytics.ts | 194 | export function getGlobalPerProviderMessageTimeseries(range = '24h'): PivotedTimeseries { | CODE |
| LOW⚡ | packages/frontend/src/services/api/analytics.ts | 198 | export function getGlobalPerProviderCostTimeseries(range = '24h'): PivotedTimeseries { | CODE |
| LOW⚡ | packages/frontend/src/services/api/analytics.ts | 206 | export function getGlobalPerModelTimeseries(range = '24h'): PivotedTimeseries { | CODE |
| LOW⚡ | packages/frontend/src/services/api/analytics.ts | 210 | export function getGlobalPerModelMessageTimeseries(range = '24h'): PivotedTimeseries { | CODE |
| LOW⚡ | packages/frontend/src/services/api/analytics.ts | 214 | export function getGlobalPerModelCostTimeseries(range = '24h'): PivotedTimeseries { | CODE |
| LOW | packages/frontend/src/services/api/analytics.ts | 225 | export function getPerProviderMessageTimeseries( | CODE |
| LOW | packages/frontend/src/services/api/analytics.ts | 235 | export function getPerProviderCostTimeseries(agentName: string, range = '24h'): PivotedTimeseries { | CODE |
| LOW | packages/frontend/src/services/api/analytics.ts | 343 | export function getWorkspaceAutofixStatus(): Promise<AutofixStatus> { | CODE |
| LOW | packages/frontend/src/services/api/analytics.ts | 432 | export function getPerProviderReliability( | CODE |
| LOW | packages/frontend/src/services/api/messages.ts | 216 | export function flagMessageMiscategorized(id: string) { | CODE |
| LOW | packages/frontend/src/services/api/messages.ts | 222 | export function clearMessageMiscategorized(id: string) { | CODE |
| LOW | packages/frontend/src/services/api/routing.ts | 422 | export function getAgentProviderDisableImpact(agentName: string, userProviderId: string) { | CODE |
| LOW | packages/frontend/src/services/api/routing.ts | 492 | export function invalidateCustomProvidersCache(agentName?: string): void { | CODE |
| LOW | packages/frontend/src/services/api/header-tiers.ts | 76 | export function setHeaderTierResponseMode( | CODE |
| LOW | packages/frontend/src/services/api/providers.ts | 78 | export async function ensureManagedFreeProvider( | CODE |
| LOW | packages/frontend/src/services/api/specificity.ts | 17 | export function getSpecificityAssignments(agentName: string) { | CODE |
| LOW | packages/frontend/src/services/api/specificity.ts | 65 | export function setSpecificityResponseMode( | CODE |
| LOW | packages/frontend/src/services/api/specificity.ts | 98 | export function clearSpecificityFallbacks(agentName: string, category: string) { | CODE |
| LOW | packages/frontend/src/services/api/billing.ts | 25 | export function updateBillingEmailPreferences( | CODE |
| LOW | packages/backend/test/helpers.ts | 335 | export function stubProviderDiscoveryFetch(): () => void { | CODE |
| LOW | packages/backend/test/helpers.ts | 360 | function stubOpenRouterPricingFetch(): () => void { | CODE |
| 196 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | …frontend/tests/components/ProviderSelectModal.test.tsx | 4 | // ───────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …frontend/tests/components/ProviderSelectModal.test.tsx | 34 | // ───────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …frontend/tests/components/ProviderSelectModal.test.tsx | 151 | // Helpers ────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …frontend/tests/components/ProviderSelectModal.test.tsx | 229 | // ── Overlay / modal-card behavior (survives on ProviderSelectModal) ────── | COMMENT |
| MEDIUM | …tend/tests/components/ProviderSubscriptionTab.test.tsx | 71 | // ── hasDetailView() branch coverage ───────────────────────────────── | COMMENT |
| MEDIUM | …tend/tests/components/ProviderSubscriptionTab.test.tsx | 105 | // ── connected() / requiresStoredToken() branches ──────────────────── | COMMENT |
| MEDIUM | …tend/tests/components/ProviderSubscriptionTab.test.tsx | 170 | // ── Add connection button ─────────────────────────────────────────── | COMMENT |
| MEDIUM | …tend/tests/components/ProviderSubscriptionTab.test.tsx | 250 | // ── busy / multi-provider rendering ───────────────────────────────── | COMMENT |
| MEDIUM | packages/frontend/tests/pages/Playground.test.tsx | 5 | // ─── API mocks (incl. the streaming primitive the real store calls) ───────── | COMMENT |
| MEDIUM | packages/frontend/tests/pages/Playground.test.tsx | 31 | // ─── Router primitives ────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/frontend/tests/pages/Playground.test.tsx | 45 | // ─── Right sidebar — capture the history-sidebar content ───────────────────── | COMMENT |
| MEDIUM | packages/frontend/tests/pages/Playground.test.tsx | 56 | // ─── Leaf component stubs (keep the page + real store logic exercised) ─────── | COMMENT |
| MEDIUM | packages/frontend/tests/pages/ProviderPages.test.tsx | 928 | // ── Collapsed connections list ────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/frontend/tests/pages/Routing.test.tsx | 4 | // ── API mocks ─────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/frontend/src/pages/Overview.tsx | 258 | // ── Provider breakdown (per-agent, grouped by provider) ───────────── | COMMENT |
| MEDIUM | packages/frontend/src/pages/Overview.tsx | 289 | // ── Autofix resources ───────────────────────────────── | COMMENT |
| MEDIUM | packages/frontend/src/pages/GlobalOverview.tsx | 191 | // ── Range state (persisted in localStorage) ────────────────────────── | COMMENT |
| MEDIUM | packages/frontend/src/pages/GlobalOverview.tsx | 208 | // ── Group by state (persisted in localStorage) ─────────────────────── | COMMENT |
| MEDIUM | packages/frontend/src/pages/GlobalOverview.tsx | 228 | // ── Chart view state ───────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/frontend/src/pages/GlobalOverview.tsx | 248 | // ── Data resources (5 parallel) ────────────────────────────────────── | COMMENT |
| MEDIUM | packages/frontend/src/pages/GlobalOverview.tsx | 337 | // ── Autofix resources ───────────────────────────────── | COMMENT |
| MEDIUM | packages/frontend/src/pages/GlobalOverview.tsx | 453 | // ── Harness filter state (sessionStorage) ──────────────────────────── | COMMENT |
| MEDIUM | packages/frontend/src/pages/GlobalOverview.tsx | 584 | // ── Derived data ───────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/frontend/src/pages/Routing.tsx | 123 | // ── Routing deprecation gate ────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/frontend/src/pages/Welcome.tsx | 167 | // ── Shared resources ───────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/frontend/src/pages/Welcome.tsx | 211 | // ── Step: providers ────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/frontend/src/pages/Welcome.tsx | 273 | // ── Step: harness ──────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/frontend/src/pages/Welcome.tsx | 325 | // ── Step: routing — the app's real default-routing card ────────────── | COMMENT |
| MEDIUM | packages/frontend/src/pages/Welcome.tsx | 435 | // ── Step: first real agent request ─────────────────────────────────── | COMMENT |
| MEDIUM | …d/src/otlp/services/api-key.service.edge-cases.spec.ts | 112 | // ────────────────────────────────────────────── | COMMENT |
| MEDIUM | …d/src/otlp/services/api-key.service.edge-cases.spec.ts | 114 | // ────────────────────────────────────────────── | COMMENT |
| MEDIUM | …d/src/otlp/services/api-key.service.edge-cases.spec.ts | 145 | // ────────────────────────────────────────────── | COMMENT |
| MEDIUM | …d/src/otlp/services/api-key.service.edge-cases.spec.ts | 147 | // ────────────────────────────────────────────── | COMMENT |
| MEDIUM | …d/src/otlp/services/api-key.service.edge-cases.spec.ts | 190 | // ────────────────────────────────────────────── | COMMENT |
| MEDIUM | …d/src/otlp/services/api-key.service.edge-cases.spec.ts | 192 | // ────────────────────────────────────────────── | COMMENT |
| MEDIUM | …d/src/otlp/services/api-key.service.edge-cases.spec.ts | 217 | // ────────────────────────────────────────────── | COMMENT |
| MEDIUM | …d/src/otlp/services/api-key.service.edge-cases.spec.ts | 219 | // ────────────────────────────────────────────── | COMMENT |
| MEDIUM | …d/src/otlp/services/api-key.service.edge-cases.spec.ts | 247 | // ────────────────────────────────────────────── | COMMENT |
| MEDIUM | …d/src/otlp/services/api-key.service.edge-cases.spec.ts | 249 | // ────────────────────────────────────────────── | COMMENT |
| MEDIUM | …ages/backend/src/otlp/services/api-key.service.spec.ts | 133 | // ────────────────────────────────────────────── | COMMENT |
| MEDIUM | …ages/backend/src/otlp/services/api-key.service.spec.ts | 135 | // ────────────────────────────────────────────── | COMMENT |
| MEDIUM | …ages/backend/src/otlp/services/api-key.service.spec.ts | 388 | // ────────────────────────────────────────────── | COMMENT |
| MEDIUM | …ages/backend/src/otlp/services/api-key.service.spec.ts | 390 | // ────────────────────────────────────────────── | COMMENT |
| MEDIUM | …ages/backend/src/otlp/services/api-key.service.spec.ts | 474 | // ────────────────────────────────────────────── | COMMENT |
| MEDIUM | …ages/backend/src/otlp/services/api-key.service.spec.ts | 476 | // ────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/backend/src/github/github.controller.spec.ts | 28 | // ── Happy path ──────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/backend/src/github/github.controller.spec.ts | 85 | // ── Error handling ──────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/backend/src/github/github.controller.spec.ts | 137 | // ── Edge cases ──────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | packages/backend/src/github/github.controller.spec.ts | 172 | // ── Concurrency ─────────────────────────────────────────────── | COMMENT |
| MEDIUM | …ackend/src/routing/proxy/provider-client-converters.ts | 102 | // ─── OpenAI wire normalization (used by ProviderClient.forward) ───────────── | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …ges/frontend/tests/components/ProviderKeyForm.test.tsx | 239 | describe('placeholder', () => { | CODE |
| LOW | …ges/frontend/tests/components/ProviderKeyForm.test.tsx | 244 | expect(input!.getAttribute('placeholder')).toBe('sk-xxx'); | CODE |
| LOW | …ges/frontend/tests/components/ProviderKeyForm.test.tsx | 257 | expect(input!.getAttribute('placeholder')).toBe('Paste your Ollama Cloud API key'); | CODE |
| LOW | …ges/frontend/tests/components/ProviderKeyForm.test.tsx | 268 | expect(input!.getAttribute('placeholder')).toBe('Paste token'); | CODE |
| LOW | packages/frontend/tests/pages/ResetPassword.test.tsx | 80 | fireEvent.input(emailInput, { target: { value: "test@test.com" } }); | CODE |
| LOW | packages/frontend/tests/pages/ResetPassword.test.tsx | 102 | fireEvent.input(emailInput, { target: { value: "test@test.com" } }); | CODE |
| LOW | …ges/frontend/tests/pages/GlobalOverviewFilter.test.tsx | 140 | data: { user: { id: 'u1', name: 'Test User', email: 'test@test.com' } }, | CODE |
| LOW | packages/frontend/tests/pages/Login-validation.test.tsx | 74 | fireEvent.input(emailInput, { target: { value: "user@example.com" } }); | CODE |
| LOW | packages/frontend/tests/pages/Login-validation.test.tsx | 87 | fireEvent.input(emailInput, { target: { value: "user@example.com" } }); | CODE |
| LOW | packages/frontend/tests/pages/Login-validation.test.tsx | 116 | fireEvent.input(emailInput, { target: { value: "user@example.com" } }); | CODE |
| LOW | packages/frontend/tests/pages/Login-validation.test.tsx | 128 | expect(call.email).toBe("user@example.com"); | CODE |
| LOW | packages/frontend/tests/pages/Login-validation.test.tsx | 143 | fireEvent.input(emailInput, { target: { value: "user@example.com" } }); | CODE |
| LOW | packages/frontend/tests/pages/Login-validation.test.tsx | 174 | target: { value: "user@example.com" }, | CODE |
| LOW | packages/frontend/tests/pages/Limits.test.tsx | 92 | useSession: () => () => ({ data: { user: { email: "user@example.com" } } }), | CODE |
| LOW | packages/frontend/tests/pages/Limits.test.tsx | 187 | expect(container.textContent).toContain("user@example.com"); | CODE |
| LOW | packages/frontend/tests/pages/Register.test.tsx | 35 | data: { user: { id: 'u1', name: 'Test User', email: 'test@test.com' } }, | CODE |
| LOW | packages/frontend/tests/pages/Register.test.tsx | 118 | target: { value: 'test@test.com' }, | CODE |
| LOW | packages/frontend/tests/pages/Register.test.tsx | 134 | target: { value: 'test@test.com' }, | CODE |
| LOW | packages/frontend/tests/pages/Register.test.tsx | 143 | email: 'test@test.com', | CODE |
| LOW | packages/frontend/tests/pages/Register.test.tsx | 155 | target: { value: 'test@test.com' }, | CODE |
| LOW | packages/frontend/tests/pages/Register.test.tsx | 240 | target: { value: 'test@test.com' }, | CODE |
| LOW | packages/frontend/tests/pages/Register.test.tsx | 249 | email: 'test@test.com', | CODE |
| LOW | packages/frontend/tests/pages/Register.test.tsx | 405 | target: { value: 'test@test.com' }, | CODE |
| LOW | packages/frontend/tests/pages/Register.test.tsx | 428 | target: { value: 'test@test.com' }, | CODE |
| LOW | packages/frontend/tests/pages/Register.test.tsx | 446 | email: 'test@test.com', | CODE |
| LOW | packages/frontend/tests/pages/Register.test.tsx | 461 | target: { value: 'test@test.com' }, | CODE |
| LOW | packages/frontend/tests/pages/Register.test.tsx | 488 | target: { value: 'test@test.com' }, | CODE |
| LOW | packages/frontend/tests/pages/Register.test.tsx | 521 | target: { value: 'test@test.com' }, | CODE |
| LOW | packages/frontend/tests/pages/Register.test.tsx | 568 | target: { value: 'test@test.com' }, | CODE |
| LOW | …ages/frontend/tests/pages/Limits-interactions.test.tsx | 55 | useSession: () => () => ({ data: { user: { email: "user@example.com" } } }), | CODE |
| LOW | packages/frontend/tests/pages/Discovery.test.tsx | 26 | data: { user: { id: 'u1', name: 'Test User', email: 'test@test.com' } }, | CODE |
| LOW | packages/frontend/tests/pages/Account.test.tsx | 33 | data: { user: { id: 'u1', name: 'Test User', email: 'test@test.com' } }, | CODE |
| LOW | packages/frontend/tests/pages/Account.test.tsx | 148 | expect(input.value).toBe('test@test.com'); | CODE |
| LOW | packages/frontend/tests/pages/Login.test.tsx | 130 | fireEvent.input(emailInput, { target: { value: 'test@test.com' } }); | CODE |
| LOW | packages/frontend/tests/pages/Login.test.tsx | 136 | email: 'test@test.com', | CODE |
| LOW | packages/frontend/tests/services/providers.test.ts | 1055 | expect(p).not.toHaveProperty('placeholder'); | CODE |
| LOW⚡ | …ages/frontend/tests/services/api/notifications.test.ts | 99 | notificationEmail: 'admin@example.com', | CODE |
| LOW⚡ | …ages/frontend/tests/services/api/notifications.test.ts | 107 | notificationEmail: 'admin@example.com', | CODE |
| LOW⚡ | …ages/frontend/tests/services/api/notifications.test.ts | 117 | notificationEmail: 'admin@example.com', | CODE |
| LOW⚡ | …ages/frontend/tests/services/api/notifications.test.ts | 126 | notificationEmail: 'admin@example.com', | CODE |
| LOW⚡ | …ages/frontend/tests/services/api/notifications.test.ts | 144 | to: 'foo@bar.com', | CODE |
| LOW⚡ | …ages/frontend/tests/services/api/notifications.test.ts | 154 | const out = await notifications.testSavedEmailProvider('foo@bar.com'); | CODE |
| LOW⚡ | …ages/frontend/tests/services/api/notifications.test.ts | 159 | expect(JSON.parse((init as RequestInit).body as string)).toEqual({ to: 'foo@bar.com' }); | CODE |
| LOW | packages/backend/test/helpers.ts | 202 | request.user = { id: userId, email: 'test@test.com', name: 'Test' }; | CODE |
| LOW | packages/backend/test/setup.e2e-spec.ts | 69 | 'admin@example.com', | CODE |
| LOW | packages/backend/test/setup.e2e-spec.ts | 150 | 'admin@example.com', | CODE |
| LOW | packages/backend/src/auth/auth.instance.spec.ts | 306 | const mockUser = { name: 'Jane Doe', email: 'jane@example.com' }; | CODE |
| LOW | packages/backend/src/auth/auth.instance.spec.ts | 312 | userName: 'Jane Doe', | CODE |
| LOW | packages/backend/src/auth/auth.instance.spec.ts | 345 | const mockUser = { name: 'John Doe', email: 'john@example.com' }; | CODE |
| LOW | packages/backend/src/auth/auth.instance.spec.ts | 351 | userName: 'John Doe', | CODE |
| LOW | packages/backend/src/auth/session.guard.spec.ts | 90 | user: { id: 'user-1', name: 'Test', email: 'test@test.com' }, | CODE |
| LOW | packages/backend/src/auth/session.guard.spec.ts | 107 | user: { id: 'user-1', name: 'Test', email: 'test@test.com' }, | CODE |
| LOW | packages/backend/src/auth/session.guard.spec.ts | 136 | user: { id: 'user-1', name: 'Test', email: 'test@test.com' }, | CODE |
| LOW | …ckend/src/discovery/dto/complete-discovery.dto.spec.ts | 14 | name: 'Jane Doe', | CODE |
| LOW | …ages/backend/src/otlp/services/api-key.service.spec.ts | 275 | organizationName: 'Acme Corp', | CODE |
| LOW | …ages/backend/src/otlp/services/api-key.service.spec.ts | 281 | organization_name: 'Acme Corp', | CODE |
| LOW | …free-provider/managed-free-provider.controller.spec.ts | 33 | { id: 'user-1', email: 'user@example.com' }, | CODE |
| LOW | …free-provider/managed-free-provider.controller.spec.ts | 41 | userEmail: 'user@example.com', | CODE |
| LOW | …free-provider/managed-free-provider.controller.spec.ts | 53 | { id: 'user-1', email: 'user@example.com' }, | CODE |
| LOW | …free-provider/managed-free-provider.controller.spec.ts | 61 | userEmail: 'user@example.com', | CODE |
| 37 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | railway.toml | 1 | [build] | COMMENT |
| LOW | docker/install.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | docker/install.sh | 21 | # Re-running against an existing install directory resumes it: the compose | COMMENT |
| LOW | docker/docker-compose.yml | 1 | # Managed by Manifest's installer. Keep local settings in `.env` or | COMMENT |
| LOW | docker/docker-compose.yml | 21 | # - To harden the database password, set BOTH `POSTGRES_PASSWORD` AND | COMMENT |
| LOW | docker/docker-compose.yml | 81 | # Per-tenant (M201) and per-IP (M202) requests/minute for this backend process. | COMMENT |
| LOW | docker/docker-compose.yml | 141 | - RUN_MIGRATIONS_ON_BOOT=${RUN_MIGRATIONS_ON_BOOT:-true} | COMMENT |
| LOW | deploy/apple-containers/start.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | scripts/db-reindex-bloated.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | scripts/check-changesets.js | 1 | const fs = require('fs'); | COMMENT |
| LOW | packages/frontend/vite.config.ts | 1 | import { readFileSync } from 'node:fs'; | COMMENT |
| LOW | …s/components/ProviderSelectModal-subscription.test.tsx | 1 | import { describe, it, expect, vi, beforeEach } from "vitest"; | COMMENT |
| LOW | …frontend/tests/components/ProviderSelectModal.test.tsx | 1 | import { describe, it, expect, vi, beforeEach } from 'vitest'; | COMMENT |
| LOW | …frontend/tests/components/ProviderSelectModal.test.tsx | 21 | // | COMMENT |
| LOW | …ntend/tests/components/MessageDetails.autofix.test.tsx | 21 | getModelDisplayName: (slug: string) => slug, | COMMENT |
| LOW | packages/frontend/src/components/AddAgentModal.tsx | 41 | // Where the logs live depends on the deployment: self-hosted keeps them in | COMMENT |
| LOW | packages/frontend/src/pages/Routing.tsx | 121 | const complexityEnabled = () => complexityStatus()?.enabled ?? true; | COMMENT |
| LOW | packages/frontend/src/services/api/cache.ts | 41 | // Module-level cache keyed by fully-qualified request URL (path + query string). | COMMENT |
| LOW | packages/backend/test/messages.isolation.e2e-spec.ts | 1 | import { INestApplication } from '@nestjs/common'; | COMMENT |
| LOW | packages/backend/test/proxy.e2e-spec.ts | 241 | COMMENT | |
| LOW | packages/backend/src/main.ts | 81 | // tokens and wrecks streaming time-to-first-token. All other responses use | COMMENT |
| LOW | packages/backend/src/main.ts | 101 | // Newer Chrome replaced PNA with Local Network Access, a user permission that | COMMENT |
| LOW | packages/backend/src/main.ts | 141 | expressApp.use(httpErrorLogger); | COMMENT |
| LOW | packages/backend/src/cors-csp-config.ts | 141 | // LEGACY — kept for old browsers only. Do not reach for this when debugging a | COMMENT |
| LOW | …backend/src/database/pricing-sync.service.edge.spec.ts | 41 | }); | COMMENT |
| LOW | packages/backend/src/database/database.module.ts | 41 | // single instance (dev, self-hosted) must boot with the schema applied | COMMENT |
| LOW | packages/backend/src/playground/playground.service.ts | 381 | isSubscription: authType === 'subscription', | COMMENT |
| LOW | packages/backend/src/config/app.config.ts | 41 | // to skip (e.g. a managed Postgres where the role lacks ALTER ROLE on itself). | COMMENT |
| LOW | packages/backend/src/config/app.config.ts | 81 | // Shared secret guarding the internal CRM metrics feed | COMMENT |
| LOW | …backend/src/model-discovery/model-discovery.service.ts | 721 | return this.computeScore(this.applyCapabilities(model, providerId)); | COMMENT |
| LOW | packages/backend/src/common/utils/secret-scrub.ts | 1 | // Best-effort redaction of provider credentials that may appear in upstream | COMMENT |
| LOW | packages/backend/src/scoring/specificity-signals.ts | 21 | * URL alone is intentionally not enough to activate web_browsing — a URL | COMMENT |
| LOW | packages/backend/src/scoring/keywords/web-browsing.ts | 1 | // Only unambiguous browse-intent phrases. Generic web-dev vocabulary | COMMENT |
| LOW | packages/backend/src/routing/proxy/provider-client.ts | 781 | if (shouldApplyAnthropicAutomaticCacheControl(endpointKey)) { | COMMENT |
| LOW | …ckages/backend/src/routing/proxy/provider-endpoints.ts | 481 | buildHeaders: (apiKey: string) => ({ | COMMENT |
| LOW | …ckages/backend/src/routing/proxy/provider-endpoints.ts | 621 | // models (Qwen, GLM, Kimi, MiniMax, …) on a single Bearer-auth route. | COMMENT |
| LOW | …ackend/src/routing/proxy/anthropic-messages-adapter.ts | 521 | if (!choice) continue; | COMMENT |
| LOW | …es/backend/src/routing/proxy/proxy-fallback.service.ts | 1001 | // every request even when the caller sent no x-session-key. NUL-joined so | COMMENT |
| LOW | …outing/proxy/__tests__/provider-client.timeout.spec.ts | 1 | // Tests that the PROVIDER_TIMEOUT_MS abort signal actually fires and | COMMENT |
| LOW | …src/routing/custom-provider/custom-provider.service.ts | 321 | name: dto.name, | COMMENT |
| LOW | packages/backend/src/routing/autofix/autofix.service.ts | 421 | // A patch to apply: reached on `patched` (already verified) or `unverified` | COMMENT |
| LOW | packages/backend/src/routing/autofix/autofix.module.ts | 41 | const nodeEnv = config.get<string>('NODE_ENV'); | COMMENT |
| LOW | …ckages/backend/src/analytics/services/query-helpers.ts | 181 | export function sqlExcludePlayground(alias: string): string { | COMMENT |
| LOW | …ckages/backend/src/analytics/services/query-helpers.ts | 201 | // matching across tenants is identical to matching within one, and | COMMENT |
| LOW | .github/workflows/db-diagram-comment.yml | 1 | name: DB Diagram Comment | COMMENT |
| LOW | .github/workflows/release.yml | 61 | - name: Detect version bump | COMMENT |
| LOW | .github/workflows/publish-cli.yml | 1 | name: Publish CLI | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| CRITICAL | …ckend/src/routing/proxy/__tests__/kiro-adapter.spec.ts | 429 | request.conversationState.currentMessage.userInputMessage.userInputMessageContext.tools.map( | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | packages/backend/src/github/github.controller.spec.ts | 175 | // Step 1: prime the cache with a known value so we can exercise the | COMMENT |
| LOW⚡ | packages/backend/src/github/github.controller.spec.ts | 184 | // Step 2: expire the cache by advancing Date.now past the 10-minute TTL. | COMMENT |
| LOW⚡ | packages/backend/src/github/github.controller.spec.ts | 187 | // Step 3: fire 10 concurrent calls while a single fetch is in flight. | COMMENT |
| LOW | packages/backend/src/github/github.controller.spec.ts | 215 | // Step 4: release the gated fetch and verify all 10 concurrent callers | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | packages/backend/src/github/github.controller.spec.ts | 175 | // Step 1: prime the cache with a known value so we can exercise the | COMMENT |
| LOW⚡ | packages/backend/src/github/github.controller.spec.ts | 184 | // Step 2: expire the cache by advancing Date.now past the 10-minute TTL. | COMMENT |
| LOW⚡ | packages/backend/src/github/github.controller.spec.ts | 187 | // Step 3: fire 10 concurrent calls while a single fetch is in flight. | COMMENT |
| LOW | packages/backend/src/github/github.controller.spec.ts | 215 | // Step 4: release the gated fetch and verify all 10 concurrent callers | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | docker/install.sh | 12 | # Usage: | COMMENT |
| LOW | deploy/apple-containers/start.sh | 19 | # Usage: | COMMENT |
| LOW | scripts/db-reindex-bloated.sh | 14 | # Usage: | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | CLAUDE.md | 171 | │ │ │ ├── Limits.tsx # Alert rule management — mounted at /harnesses/:agentName/guardrails ("Gua | CODE |