The fast all-in-one Node.js toolkit
This report presents the forensic synthetic code analysis of nubjs/nub, a Rust project with 2,903 GitHub stars. SynthScan v2.0 examined 145,143 lines of code across 609 source files, recording 1032 pattern matches distributed across 8 syntactic categories. The overall adjusted score of 11.2 places this repository in the Low AI signal band.
The scanner applied 160+ deterministic lexical heuristics, multi-line block detectors, abstract syntax tree depth profilers, and a cross-file Jaccard similarity matrix to construct a statistically normalised synthetic code estimate. All matches are individually weighted by severity coefficient and contextual multiplier before summation, and the resulting headline score is temporally discounted to account for the repository's development history relative to the commercial emergence of large language model coding tooling (November 2022 onward).
Longitudinal tracking requires multiple scan runs. Once this repository is re-scanned after new commits land, this chart will visualise how the synthetic code signal evolves over time — enabling you to detect whether AI authorship is growing, stabilising, or being actively corrected by human engineers.
Classifies detected patterns by their diagnostic confidence and structural impact. CRITICAL patterns (coefficient 10) represent definitive synthetic signatures — hallucinated imports, explicit LLM attribution metadata — virtually never produced by human authors. HIGH (5) indicates strong structural tells such as cross-file repetition or cross-linguistic idioms. MEDIUM (2) covers recognisable conversational padding and AI-specific vocabulary. LOW (1) captures subtle indicators like tautological comments and generic boilerplate that require density to carry independent signal.
This horizontal bar chart decomposes the repository's raw synthetic code score by top-level directory, allowing you to pinpoint precisely which modules or components carry the highest AI authorship density. Directories with disproportionately high scores relative to their size warrant targeted manual review: concentrated AI signatures often trace back to mass-generated configuration layers, auto-ported test suites, LLM-scaffolded boilerplate classes, or entire subsystems authored under heavy copilot assistance. Use this view to prioritise your human code-review effort.
The scanner identified 1032 distinct pattern matches across 8 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a statistically significant AI authorship indicator. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the diagnostic confidence level (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — comment-context matches receive a ×1.5 weight because LLMs systematically over-annotate. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier as dense clusters constitute far stronger evidence of synthetic authorship than isolated hits.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | crates/nub-core/src/workspace/shell_escape.rs | 203 | // ── POSIX sh (the verified-against-npm path) ────────────────────────── | COMMENT |
| MEDIUM | crates/nub-core/src/workspace/shell_escape.rs | 282 | // ── splice_args (the body+args display/exec string) ─────────────────── | COMMENT |
| MEDIUM | crates/nub-core/src/version_management/manage.rs | 66 | // ── install ────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/nub-core/src/version_management/manage.rs | 209 | // ── ls ─────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/nub-core/src/version_management/manage.rs | 238 | // ── uninstall ──────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/nub-core/src/version_management/manage.rs | 277 | // ── pin ────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/nub-core/src/node/version.rs | 408 | // ── Tier boundary cases ──────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/nub-core/src/node/feature_matrix.rs | 139 | // ── vm.Module / vm.SourceTextModule ──────────────────────────────────── | COMMENT |
| MEDIUM | crates/nub-core/src/node/feature_matrix.rs | 174 | // ── EventSource global ────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/nub-core/src/node/feature_matrix.rs | 194 | // ── node:sqlite ───────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/nub-core/src/node/feature_matrix.rs | 215 | // ── Wasm ES-module imports (import of `.wasm`) ────────────────────────── | COMMENT |
| MEDIUM | crates/nub-core/src/node/feature_matrix.rs | 242 | // ── addon-modules (ESM import of native .node addons) ──────────────────── | COMMENT |
| MEDIUM | crates/nub-core/src/node/feature_matrix.rs | 266 | // ── import-text (importing source as text via import attributes) ───────── | COMMENT |
| MEDIUM | crates/nub-core/src/node/feature_matrix.rs | 292 | // ── Module syntax detection (ambiguous ESM `.js`) ──────────────────────── | COMMENT |
| MEDIUM | crates/nub-core/src/node/feature_matrix.rs | 319 | // ── node:ffi (foreign function interface) ──────────────────────────────── | COMMENT |
| MEDIUM | crates/nub-core/src/node/feature_matrix.rs | 338 | // ── node:vfs (virtual file system) ─────────────────────────────────────── | COMMENT |
| MEDIUM | crates/nub-core/src/node/feature_matrix.rs | 352 | // ── node:stream/iter (async-iterator stream adapters) ──────────────────── | COMMENT |
| MEDIUM | crates/nub-core/src/node/feature_matrix.rs | 366 | // ── WebSocket global ──────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/nub-core/src/node/feature_matrix.rs | 382 | // ── Web Storage (localStorage / sessionStorage) ───────────────────────── | COMMENT |
| MEDIUM | crates/nub-core/src/node/feature_matrix.rs | 411 | // ── reportError ───────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/nub-core/src/node/feature_matrix.rs | 426 | // ── URLPattern ────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/nub-core/src/node/feature_matrix.rs | 444 | // ── RegExp.escape ─────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/nub-core/src/node/feature_matrix.rs | 460 | // ── Error.isError ─────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/nub-core/src/node/feature_matrix.rs | 477 | // ── Promise.try ───────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/nub-core/src/node/feature_matrix.rs | 493 | // ── Float16Array ──────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/nub-core/src/node/feature_matrix.rs | 511 | // ── Uint8Array base64/hex ─────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/nub-core/src/node/feature_matrix.rs | 531 | // ── DisposableStack / AsyncDisposableStack / SuppressedError ───────────── | COMMENT |
| MEDIUM | crates/nub-core/src/node/feature_matrix.rs | 580 | // ── Temporal ──────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/nub-core/src/node/feature_matrix.rs | 596 | // ── Worker (browser-shape global) ─────────────────────────────────────── | COMMENT |
| MEDIUM | crates/nub-core/src/node/feature_matrix.rs | 611 | // ── navigator global ──────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/nub-core/src/node/feature_matrix.rs | 632 | // ── navigator.locks (Web Locks API) ───────────────────────────────────── | COMMENT |
| MEDIUM | crates/nub-native/src/tsconfig.rs | 173 | // ── `${configDir}` (TS 5.5) ───────────────────────────────────────── | COMMENT |
| MEDIUM | crates/nub-native/src/tsconfig.rs | 959 | // ── compilerOptions extraction + hash ─────────────────────────────── | COMMENT |
| MEDIUM | crates/nub-native/src/tsconfig.rs | 1006 | // ── paths matcher (get-tsconfig's `createPathsMatcher`) ───────────── | COMMENT |
| MEDIUM | crates/nub-cli/tests/cli_grammar_parity.rs | 111 | // ───────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/nub-cli/tests/cli_grammar_parity.rs | 115 | // ───────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/nub-cli/tests/cli_grammar_parity.rs | 343 | // ───────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/nub-cli/tests/cli_grammar_parity.rs | 347 | // ───────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/nub-cli/tests/cli_grammar_parity.rs | 463 | // ───────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/nub-cli/tests/cli_grammar_parity.rs | 468 | // ───────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/nub-cli/tests/integration.rs | 135 | // ── Version-gated tests ───────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/nub-cli/tests/integration.rs | 311 | // ── Project-source plain JS (.js/.mjs/.cjs) transpile ─────────────── | COMMENT |
| MEDIUM | crates/nub-cli/tests/integration.rs | 2212 | // ── Parallel run ────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/nub-cli/tests/integration.rs | 2253 | // ── Serial control run (concurrency=1) ─────────────────────────────────── | COMMENT |
| MEDIUM | crates/nub-cli/tests/integration.rs | 2493 | // ── Section 4: Missing integration tests (v0.1-quality) ────────── | COMMENT |
| MEDIUM | crates/nub-cli/tests/integration.rs | 5824 | // ── Section 7: pnpm workspace behavior tests ──────────────────── | COMMENT |
| MEDIUM | crates/nub-cli/tests/integration.rs | 6251 | // ── `nub run` full flag set (run.md) ──────────────────────────────────────── | COMMENT |
| MEDIUM | crates/nub-cli/tests/integration.rs | 7004 | // ── PM-management verbs (A2 passthrough disabled) ──────────────────────────── | COMMENT |
| MEDIUM | crates/nub-cli/tests/integration.rs | 7338 | // ── `nub pm` / `nub node` UX-message fixes ─────────────────────────────────── | COMMENT |
| MEDIUM | crates/nub-cli/src/cli.rs | 2612 | // ── Subcommand implementations ─────────────────────────────────────── | COMMENT |
| MEDIUM | crates/nub-cli/src/cli.rs | 7489 | // ── PM shims (`nub pm shim` / `unshim` + the argv0 dispatch) ────────── | COMMENT |
| MEDIUM | crates/nub-cli/src/cli.rs | 9690 | // ── nub pm verbs + PM-verb redirect ───────────────────────────────── | COMMENT |
| MEDIUM | crates/nub-cli/src/cli.rs | 10283 | // ── PM shim: plan / provenance / dynamic default ───────────────────── | COMMENT |
| MEDIUM | crates/nub-cli/src/cli.rs | 10665 | // ── nubx argv0 dispatch ───────────────────────────────────────── | COMMENT |
| MEDIUM | crates/nub-cli/src/cli.rs | 10801 | // ── .bin launcher resolution (the node-vs-shim decision) ───────────── | COMMENT |
| MEDIUM | crates/nub-cli/src/nubx_consent.rs | 183 | // ─────────────────────────── ledger storage ─────────────────────────── | COMMENT |
| MEDIUM | crates/nub-cli/src/nubx_consent.rs | 252 | // ─────────────────────────── classification ─────────────────────────── | COMMENT |
| MEDIUM | crates/nub-cli/src/nubx_consent.rs | 313 | // ─────────────────────────── context probes ─────────────────────────── | COMMENT |
| MEDIUM | crates/nub-cli/src/pm_engine/info_family.rs | 136 | // ── per-verb wrappers ─────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/nub-cli/src/pm_engine/info_family.rs | 292 | // ── wired verbs ───────────────────────────────────────────────────────────── | COMMENT |
| 179 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | Cargo.toml | 1 | [workspace] | COMMENT |
| LOW | Cargo.toml | 21 | # `[profile.release] panic = "unwind"`, and is excluded here. It is built | COMMENT |
| LOW | Cargo.toml | 41 | # reachable-graph phantom scanner, and crates/nub-phantom-core (also a MEMBER) | COMMENT |
| LOW | Cargo.toml | 61 | panic = "abort" | COMMENT |
| LOW | Cargo.toml | 101 | # Benchmark harness (dev-only). `harness = false` benches drive criterion's own | COMMENT |
| LOW | Cargo.toml | 141 | serde_json = "1" | COMMENT |
| LOW | Cargo.toml | 161 | # DEFLATE, so we skip bzip2/zstd/lzma/aes backends and their C deps. Keeps the | COMMENT |
| LOW | Cross.toml | 1 | # cross-rs configuration. | COMMENT |
| LOW | crates/nub-phantom-scan/src/graph.rs | 1 | //! Walk the module graph reachable from a package's PUBLISHED entry points, | COMMENT |
| LOW | crates/nub-phantom-scan/src/graph.rs | 61 | COMMENT | |
| LOW | crates/nub-phantom-scan/src/graph.rs | 401 | /// Join `from_dir` + `spec` as POSIX relpaths and collapse `.`/`..`. Returns | COMMENT |
| LOW | crates/nub-phantom-scan/src/lib.rs | 1 | //! nub-phantom-scan — scan an already-extracted package version's PUBLISHED, | COMMENT |
| LOW | crates/nub-phantom-scan/src/lib.rs | 41 | pub from_subpath: bool, | COMMENT |
| LOW | crates/nub-phantom-scan/src/manifest.rs | 1 | //! Parse a package's `package.json` into (a) its DECLARED dependency surface — | COMMENT |
| LOW | crates/nub-phantom-scan/src/manifest.rs | 21 | /// Required peers (`peerDependencies` without an `optional` meta flag). | COMMENT |
| LOW | crates/nub-phantom/Cargo.toml | 1 | # nub-phantom — an INTERNAL/eval tool, not part of the shipped `nub` binary. | COMMENT |
| LOW | crates/nub-phantom/src/lib.rs | 1 | //! nub-phantom — detect UNDECLARED (phantom) dependencies of an npm package. | COMMENT |
| LOW | crates/nub-phantom/src/main.rs | 241 | struct Totals { | COMMENT |
| LOW | crates/nub-core/Cargo.toml | 41 | # must not alphabetize the user's keys (a pin write that reorders the manifest | COMMENT |
| LOW | crates/nub-core/build.rs | 1 | //! Single-binary blob generation (the `embed-runtime` feature only). | COMMENT |
| LOW | crates/nub-core/build.rs | 101 | // `dlopen`s — as compile-time consts. `runtime_cache::verify_entrypoints` | COMMENT |
| LOW | crates/nub-core/benches/cache_body_copy.rs | 1 | //! Bench for the warm-hit body-copy reduction in `crates/nub-native/src/cache.rs`. | COMMENT |
| LOW | crates/nub-core/benches/cache_hash.rs | 1 | //! Benches for the transpile-cache hot path. | COMMENT |
| LOW | crates/nub-core/benches/workspace_filter.rs | 1 | //! Baseline benches for the workspace topo-sort hot path. | COMMENT |
| LOW | crates/nub-core/src/lib.rs | 21 | /// Strip a leading UTF-8 BOM (U+FEFF, bytes `EF BB BF`) so `serde_json` accepts | COMMENT |
| LOW | crates/nub-core/src/config_cache.rs | 1 | //! Per-process, mtime-validated cache for config-file reads. | COMMENT |
| LOW | crates/nub-core/src/config_cache.rs | 21 | //! pre-cache code on those paths. | COMMENT |
| LOW | crates/nub-core/src/pm/registry.rs | 1 | //! Registry metadata lookup for PM provisioning: dynamic version resolution | COMMENT |
| LOW | crates/nub-core/src/pm/registry.rs | 41 | Sha512(String), | COMMENT |
| LOW | crates/nub-core/src/pm/registry.rs | 61 | } | COMMENT |
| LOW | crates/nub-core/src/pm/registry.rs | 81 | /// `.npmrc` host auth). | COMMENT |
| LOW | crates/nub-core/src/pm/registry.rs | 321 | return tarball.to_string(); // already on the mirror | COMMENT |
| LOW | crates/nub-core/src/pm/registry.rs | 361 | /// Resolve `spec` against an already-fetched packument. PURE — no network, no env | COMMENT |
| LOW | crates/nub-core/src/pm/registry.rs | 421 | } | COMMENT |
| LOW | crates/nub-core/src/pm/registry.rs | 521 | } | COMMENT |
| LOW | crates/nub-core/src/pm/resolve.rs | 1 | //! The single PM pin reader. Every consumer that needs to know "which package | COMMENT |
| LOW | crates/nub-core/src/pm/resolve.rs | 21 | /// A resolved PM pin: which manager, and the version spec if one was stated. | COMMENT |
| LOW | crates/nub-core/src/pm/resolve.rs | 41 | /// Berry release, so the engine surfaces a clear error. | COMMENT |
| LOW | crates/nub-core/src/pm/resolve.rs | 221 | } | COMMENT |
| LOW | crates/nub-core/src/pm/resolve.rs | 401 | /// probe (wiki/commands/pm/identity-policy.md, Axiom 1: declaration outranks | COMMENT |
| LOW | crates/nub-core/src/pm/resolve.rs | 561 | /// | COMMENT |
| LOW | crates/nub-core/src/pm/resolve.rs | 601 | /// version bump behind `nub pm update`). Per the PM identity policy | COMMENT |
| LOW | crates/nub-core/src/pm/resolve.rs | 621 | /// they cannot drift. `onFail: "warn"` is load-bearing: npm 11 enforces | COMMENT |
| LOW | crates/nub-core/src/pm/resolve.rs | 701 | /// itself writes — `^<exact>` (a caret over a full semver, e.g. `^9.1.0`, | COMMENT |
| LOW | crates/nub-core/src/pm/resolve.rs | 741 | crlf, | COMMENT |
| LOW | crates/nub-core/src/pm/resolve.rs | 861 | // A URL/git reference in place of a version (`pnpm@https://…`, `pnpm@git+…`) | COMMENT |
| LOW | crates/nub-core/src/pm/resolve.rs | 921 | /// - no usable version → fall back to the `.yarnrc.yml` presence signal | COMMENT |
| LOW | crates/nub-core/src/pm/resolve.rs | 941 | /// leading run of digits before the first `.`, `+`, or `-`. | COMMENT |
| LOW | crates/nub-core/src/pm/lockfile_version.rs | 1 | //! Lockfile-format-version → PM-version-range inference. | COMMENT |
| LOW | crates/nub-core/src/pm/lockfile_version.rs | 21 | pub pm: Pm, | COMMENT |
| LOW | crates/nub-core/src/pm/extract.rs | 1 | //! PM tarball extraction. npm publishes `.tgz` (gzip + tar) with everything under | COMMENT |
| LOW | crates/nub-core/src/pm/extract.rs | 21 | }; | COMMENT |
| LOW | crates/nub-core/src/pm/shim.rs | 1 | //! The PM-shim library core: everything `nub pm shim` / `nub pm unshim` and the | COMMENT |
| LOW | crates/nub-core/src/pm/shim.rs | 101 | pub const TRANSPARENT_VERBS: [&str; 4] = ["init", "create", "dlx", "exec"]; | COMMENT |
| LOW | crates/nub-core/src/pm/shim.rs | 181 | /// never provision a competing PM (the resolve layer can't classify `nub` | COMMENT |
| LOW | crates/nub-core/src/pm/shim.rs | 201 | Refuse { | COMMENT |
| LOW | crates/nub-core/src/pm/shim.rs | 221 | /// - unpinned → fall through, always (transparency is irrelevant); | COMMENT |
| LOW | crates/nub-core/src/pm/shim.rs | 301 | match invoked { | COMMENT |
| LOW | crates/nub-core/src/pm/shim.rs | 321 | COMMENT | |
| LOW | crates/nub-core/src/pm/shim.rs | 341 | Pm::Npm => false, | COMMENT |
| 642 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | Cargo.toml | 101 | # Benchmark harness (dev-only). `harness = false` benches drive criterion's own | COMMENT |
| MEDIUM | crates/nub-cache-key/Cargo.toml | 3 | # resolved by the Node host at dlopen, so a `cargo test` harness for that crate | COMMENT |
| MEDIUM | crates/nub-native/Cargo.toml | 118 | # allowed), but a `cargo test` harness is a normal executable and CANNOT link those | COMMENT |
| MEDIUM | crates/nub-cli/tests/integration.rs | 1314 | // Dual-channel doubling regression, tier-robust. On the `nub <file>` path the | COMMENT |
| MEDIUM | crates/nub-cli/tests/integration.rs | 6443 | /// fake shell that prints a marker before delegating to `/bin/sh` — robust across | COMMENT |
| MEDIUM | crates/nub-cli/tests/integration.rs | 6678 | // loading is the robust augmentation discriminator here — flag/preload | COMMENT |
| MEDIUM | tests/bench/install/run-warm-gvs.sh | 106 | # $$ here is the harness PID (constant); $RANDOM varies per --prepare eval. | COMMENT |
| MEDIUM | tests/bench/install/gen-fixtures.sh | 7 | # each bench harness installs from nub.lock — its native lockfile — not the | COMMENT |
| MEDIUM | tests/bench/install/run-4way.sh | 97 | # CI=1 = off (the harness's existing GVS-pin mechanism). | COMMENT |
| MEDIUM | tests/bench/install/run-4way.sh | 104 | # Confirm the two nub modes take the paths we label them. The robust cross-platform | COMMENT |
| MEDIUM | tests/bench/script-runner/run-vs-node.sh | 20 | # This is a canonical checked-in benchmark harness. By default, result JSON is | COMMENT |
| MEDIUM | tests/bench/bin-runner/run-pure.sh | 10 | # bin-runner sibling of run-script-runner-pure.sh and uses the same harness. | COMMENT |
| MEDIUM | tests/launcher/make-fixture.sh | 44 | # (the harness exercises the RUNTIME heal, independent of postinstall). | COMMENT |
| MEDIUM | tests/pnpm-conformance/run.sh | 2 | # pnpm conformance harness — run pnpm's OWN black-box CLI test suite against nub. | COMMENT |
| MEDIUM | tests/pnpm-conformance/run.sh | 210 | # Substituting them into the file is the robust seam. `#` is the sed delimiter | COMMENT |
| MEDIUM | tests/pnpm-conformance/run.sh | 258 | # First integer run of `jest --version` (robust to a leading v / extra text). | COMMENT |
| MEDIUM | tests/brand-global/run.sh | 60 | # clean too, then print a single PASS/FAIL line the harness greps. A TS annotation | COMMENT |
| MEDIUM | tests/aube-conformance/run.sh | 2 | # Lockfile conformance harness — nub's embedded aube engine writes each | COMMENT |
| MEDIUM | tests/mutation/run-mutations.sh | 2 | # Lockfile MUTATION differential harness — the write-path counterpart to the | COMMENT |
| MEDIUM | tests/mutation/run-mutations.sh | 111 | # spec file, which is harness metadata, not project content. | COMMENT |
| MEDIUM | tests/native-deps/run.sh | 2 | # Native-dependency floor end-to-end harness. | COMMENT |
| MEDIUM | tests/native-deps/run.sh | 76 | # Copy only the fixture files — not the harness scripts — to avoid | COMMENT |
| MEDIUM | tests/parcel-gvs/make-fixture.sh | 7 | # over-split this harness regression-tests). | COMMENT |
| MEDIUM | tests/parcel-gvs/run.sh | 2 | # Regression harness for the GVS @parcel/core store-dir over-split. | COMMENT |
| MEDIUM | tests/daily-driver/run.sh | 2 | # Real-app daily-loop smoke harness. | COMMENT |
| MEDIUM | tests/vite-compat/driver.sh | 25 | # Fidelity note: this harness asserts at the HTTP layer — it fetches the REAL | COMMENT |
| MEDIUM | tests/vite-compat/driver.sh | 43 | # the next run then binds a DIFFERENT port while the harness curls the stale | COMMENT |
| MEDIUM | tests/vite-compat/driver.sh | 44 | # (unpatched) server → false 403s. The robust fix is a process GROUP: the dev | COMMENT |
| MEDIUM | tests/conversion/run.sh | 2 | # Cross-format lockfile conversion harness — proves `nub pm use <target>` produces | COMMENT |
| MEDIUM | tests/conversion/run.sh | 10 | # For each (source, target) pair the harness: | COMMENT |
| MEDIUM | tests/aube-bats/run.sh | 5 | # registry. This harness runs a CURATED subset of those suites with nub's PM | COMMENT |
| MEDIUM | tests/aube-bats/run.sh | 9 | # that exec's nub — so the harness's own PATH prepend resolves straight to | COMMENT |
| MEDIUM | tests/aube-bats/run.sh | 51 | # nothing else is guaranteed to survive the harness's env isolation); | COMMENT |
| MEDIUM | tests/aube-bats/run.sh | 52 | # 2. translate the harness's AUBE_* knobs to their npm_config_* spellings. | COMMENT |
| MEDIUM | tests/installer/run.sh | 6 | # Local end-to-end harness for install.sh. Each case runs the REAL installer | COMMENT |
| MEDIUM | tests/conformance/run.sh | 2 | # Drop-in PM conformance harness — proves nub is a true drop-in package manager | COMMENT |
| MEDIUM | tests/conformance/run-pnpm11.sh | 2 | # pnpm-11 conformance leg for the drop-in PM conformance harness. | COMMENT |
| MEDIUM | tests/conformance/frontdoor/run.sh | 9 | # DISTINCT from its two siblings (README.md): the lockfile harness verifies | COMMENT |
| MEDIUM | tests/conformance/frontdoor/run.sh | 10 | # round-trip fidelity; the cmdflag harness verifies every verb runs on one repo; | COMMENT |
| MEDIUM | tests/conformance/frontdoor/run.sh | 23 | set -uo pipefail # NOT -e: a failing cell is data, not a harness abort. | CODE |
| MEDIUM⚡ | tests/conformance/cmdflag/run.sh | 2 | # Command×flag conformance harness — exercise nub's FULL CLI surface against a | COMMENT |
| MEDIUM⚡ | tests/conformance/cmdflag/run.sh | 8 | # DISTINCT from the lockfile harness one level up (tests/conformance/run.sh), | COMMENT |
| MEDIUM⚡ | tests/conformance/cmdflag/run.sh | 17 | # harness operates on COPIES — the fixture is never | COMMENT |
| MEDIUM | tests/conformance/cmdflag/run.sh | 32 | set -uo pipefail # NOT -e: a failing cell is data, not a harness abort. | CODE |
| MEDIUM | tests/conformance/cmdflag/run.sh | 68 | # point of the harness is to cover REAL machine state, not a pristine void. | COMMENT |
| MEDIUM | scripts/check-docs-links.ts | 144 | // Markdown link target: ](...) — the simplest robust form; docs use plain | COMMENT |
| MEDIUM | scripts/ci-watch.ts | 3 | // terminal, then exit with a status the orchestrator can trust. The robust | COMMENT |
| MEDIUM | .github/workflows/release.yml | 309 | # harness exercises the PM engine (install/add/pm use), not the data-format | COMMENT |
| MEDIUM | .github/workflows/native-deps.yml | 15 | # Why separate workflow: the harness does a real npm registry install of esbuild | COMMENT |
| MEDIUM | .github/workflows/test-install.yml | 4 | # comprehensive battery the release pipeline runs post-publish, but decoupled from a | COMMENT |
| MEDIUM | .github/workflows/verify-install.yml | 237 | # The harness's install.sh authenticates the releases/latest API call to | COMMENT |
| MEDIUM | .github/workflows/pnpm-conformance.yml | 7 | # pnpm/test/utils/execPnpm.ts). The harness (tests/pnpm-conformance/) clones pnpm | COMMENT |
| MEDIUM | .github/workflows/pnpm-conformance.yml | 39 | # keeps version-string assertions from false-failing — the harness README's | COMMENT |
| MEDIUM | .github/workflows/aube-parity.yml | 29 | # tests/aube-bats/** is the nub-adapted harness (shim + skip lists) the | COMMENT |
| MEDIUM | .github/workflows/aube-parity.yml | 31 | # lockfile conformance harness the aube-conformance job runs. | COMMENT |
| MEDIUM | .github/workflows/aube-parity.yml | 142 | # nub round-trip legs stay ubuntu-only; the harness itself runs under | COMMENT |
| MEDIUM | .github/workflows/aube-parity.yml | 149 | # bash harness and the committed fixtures at checkout. Must precede | COMMENT |
| MEDIUM⚡ | .github/workflows/lockfile-roundtrip.yml | 21 | # in sync with the tool/version matrices documented in each harness README and | COMMENT |
| MEDIUM⚡ | .github/workflows/lockfile-roundtrip.yml | 25 | # per-PR — the conformance harness on a TIGHT, fast fixture set, so it doesn't | COMMENT |
| MEDIUM⚡ | .github/workflows/lockfile-roundtrip.yml | 32 | # each harness's expected-failures.txt and must shrink (a stale entry fails the | COMMENT |
| 1 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | crates/nub-cli/src/cli.rs | 1684 | // engine's npm-style manifest scaffold) — deliberately absent | COMMENT |
| MEDIUM | crates/nub-cli/src/cli.rs | 7020 | // (the same never-scaffold rule write_declared_pm enforces — but only | COMMENT |
| MEDIUM | crates/nub-cli/src/pm_engine/install_family.rs | 1194 | // refuses to scaffold one); the install already succeeded, so this is a | COMMENT |
| MEDIUM | crates/nub-cli/src/pm_engine/install_family.rs | 2125 | /// or scaffold one — the stamp is best-effort and silently no-ops (nub never | COMMENT |
| MEDIUM | crates/nub-cli/src/pm_engine/mod.rs | 253 | // npm-style manifest scaffold. cli.rs answers `nub init` with a | COMMENT |
| MEDIUM | tests/daily-driver/README.md | 35 | # Reuse an existing fixture (skip the scaffold + install for iteration) | COMMENT |
| MEDIUM⚡ | tests/vite-compat/scaffold.sh | 2 | # scaffold.sh — non-interactively scaffold a real Vite-powered project for the | COMMENT |
| MEDIUM⚡ | tests/vite-compat/scaffold.sh | 7 | # Usage: scaffold.sh <case> <dest-dir> | COMMENT |
| MEDIUM⚡ | tests/vite-compat/scaffold.sh | 8 | # Cases print, after scaffolding, two lines the runner consumes: | COMMENT |
| MEDIUM | tests/framework-matrix/frameworks.sh | 10 | # Usage: frameworks.sh scaffold <name> <dest> # scaffolds into <dest>, prints DEV=/BUILD=/PREVIEW=/PROBE=/GVS= | COMMENT |
| MEDIUM | tests/framework-matrix/matrix.sh | 3 | # scaffold it via its OFFICIAL create-* generator (frameworks.sh), then drive the | COMMENT |
| MEDIUM | benchmarks/README.md | 32 | # Script runner overhead (pure orchestration) | COMMENT |
| MEDIUM | site/public/skill.md | 76 | nub run --node test # nub's CLI orchestration, runtime augmentation off | CODE |
| MEDIUM | skills/nub/SKILL.md | 76 | nub run --node test # nub's CLI orchestration, runtime augmentation off | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/bench/install/cold-cas.sh | 34 | # Usage: | COMMENT |
| LOW | tests/bench/install/run.sh | 5 | # Usage: | COMMENT |
| LOW | tests/bench/install/run-4way.sh | 14 | # Usage: | COMMENT |
| LOW | tests/pnpm-conformance/run.sh | 11 | # Usage: | COMMENT |
| LOW | tests/vm/tart-vm.sh | 13 | # Usage: | COMMENT |
| LOW | tests/pnp/run-pnp-matrix.sh | 17 | # Usage: | COMMENT |
| LOW | tests/conformance/run-pnpm11.sh | 23 | # Usage: | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/worker-wpt/wpt/resources/testharness.js | 338 | function DedicatedWorkerTestEnvironment() { | CODE |
| LOW | tests/worker-wpt/wpt/resources/testharness.js | 361 | function SharedWorkerTestEnvironment() { | CODE |
| LOW | tests/worker-wpt/wpt/resources/testharness.js | 387 | function ServiceWorkerTestEnvironment() { | CODE |
| LOW | tests/worker-wpt/wpt/resources/testharness.js | 439 | function ShadowRealmTestEnvironment() { | CODE |
| LOW | tests/worker-wpt/wpt/resources/testharness.js | 4839 | function OptionalFeatureUnsupportedError(message) | CODE |
| LOW | …red-clone/structured-clone-battery-of-tests-harness.js | 16 | function runStructuredCloneBatteryOfTests(runner) { | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | install.sh | 246 | # Check if already in PATH | COMMENT |
| LOW | site/public/install.sh | 246 | # Check if already in PATH | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | crates/nub-core/src/pm/lockfile_version.rs | 256 | let berry = "# This file is generated by running \"yarn install\".\n\n\ | CODE |