The fast all-in-one Node.js toolkit
This report presents the forensic synthetic code analysis of nubjs/nub, a Rust project with 4,131 GitHub stars. SynthScan v2.0 examined 258,477 lines of code across 805 source files, recording 1656 pattern matches distributed across 10 syntactic categories. The overall adjusted score of 8.8 places this repository in the Low AI signal band.
The scanner applied 160+ deterministic lexical heuristics, multi-line block detectors, abstract syntax tree depth profilers, and a cross-file Jaccard similarity matrix to construct a statistically normalised synthetic code estimate. All matches are individually weighted by severity coefficient and contextual multiplier before summation, and the resulting headline score is temporally discounted to account for the repository's development history relative to the commercial emergence of large language model coding tooling (November 2022 onward).
This chart maps the temporal evolution of the adjusted synthetic code score across successive scan runs. An upward trajectory indicates ongoing incorporation of AI-generated code or expanding LLM-assisted scaffolding; a stable or declining trajectory may reflect active human refactoring, code removal, or the adoption of stricter authorship policies. The dashed secondary line (right axis) independently tracks total raw pattern hit count, which can diverge from the normalised score when codebase size changes significantly between scans.
Classifies detected patterns by their diagnostic confidence and structural impact. CRITICAL patterns (coefficient 10) represent definitive synthetic signatures — hallucinated imports, explicit LLM attribution metadata — virtually never produced by human authors. HIGH (5) indicates strong structural tells such as cross-file repetition or cross-linguistic idioms. MEDIUM (2) covers recognisable conversational padding and AI-specific vocabulary. LOW (1) captures subtle indicators like tautological comments and generic boilerplate that require density to carry independent signal.
This horizontal bar chart decomposes the repository's raw synthetic code score by top-level directory, allowing you to pinpoint precisely which modules or components carry the highest AI authorship density. Directories with disproportionately high scores relative to their size warrant targeted manual review: concentrated AI signatures often trace back to mass-generated configuration layers, auto-ported test suites, LLM-scaffolded boilerplate classes, or entire subsystems authored under heavy copilot assistance. Use this view to prioritise your human code-review effort.
The scanner identified 1656 distinct pattern matches across 10 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a statistically significant AI authorship indicator. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the diagnostic confidence level (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — comment-context matches receive a ×1.5 weight because LLMs systematically over-annotate. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier as dense clusters constitute far stronger evidence of synthetic authorship than isolated hits.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | Cargo.toml | 1 | [workspace] | COMMENT |
| LOW | Cargo.toml | 21 | # `[profile.release] panic = "unwind"`, and is excluded here. It is built with | COMMENT |
| LOW | Cargo.toml | 41 | # | COMMENT |
| LOW | Cargo.toml | 121 | # napi 3 (not 2): oxc_napi 0.140.0 and oxc_sourcemap[napi] are built against | COMMENT |
| LOW | Cargo.toml | 141 | rustc-hash = "2" | COMMENT |
| LOW | Cargo.toml | 161 | # unaffected: registries serve .tgz without Content-Encoding. | COMMENT |
| LOW | Cargo.toml | 181 | # Workspace restriction lints, promoted to warn and inherited by every nub crate | COMMENT |
| LOW | Cross.toml | 1 | # cross-rs configuration. | COMMENT |
| LOW | install.sh | 201 | # makes this idempotent across reinstall/upgrade and harmless if a future | COMMENT |
| LOW | hawk.toml | 1 | # hawk (astral-sh/hawk) visibility-lint config. | COMMENT |
| LOW | .githooks/agents-symlink-check.sh | 1 | #!/bin/sh | COMMENT |
| LOW | tools/pnpm-workspace.yaml | 1 | # pnpm-side soak surface + catalog (pnpm reads minimumReleaseAge in MINUTES | COMMENT |
| LOW | tools/pnpm-workspace.yaml | 21 | # lists, which the gate can't validate); `soak:fix` prunes expired ones. | COMMENT |
| LOW | crates/nub-phantom-scan/src/classify.rs | 21 | HardPhantom, | COMMENT |
| LOW | crates/nub-phantom-scan/src/graph.rs | 1 | //! Walk the module graph reachable from a package's PUBLISHED entry points, | COMMENT |
| LOW | crates/nub-phantom-scan/src/graph.rs | 41 | pub(crate) raw: String, | COMMENT |
| LOW | crates/nub-phantom-scan/src/graph.rs | 61 | pub files_analyzed: usize, | COMMENT |
| LOW | crates/nub-phantom-scan/src/graph.rs | 81 | fn resolve_entry(&self, entry_path: &str, prefer_dts: bool) -> Option<Self::Key>; | COMMENT |
| LOW | crates/nub-phantom-scan/src/graph.rs | 201 | /// back at itself (`"."`/`""`/`"./"`) or a mutual `main` cycle across dirs would | COMMENT |
| LOW | crates/nub-phantom-scan/src/lib.rs | 1 | //! nub-phantom-scan — scan an already-extracted package version's PUBLISHED, | COMMENT |
| LOW | crates/nub-phantom-scan/src/lib.rs | 41 | } | COMMENT |
| LOW | crates/nub-phantom-scan/src/lib.rs | 81 | /// Scan a package straight from its CAS-backed file index — the EXTRACT-TIME | COMMENT |
| LOW | crates/nub-phantom-scan/src/manifest.rs | 1 | //! Parse a package's `package.json` into (a) its DECLARED dependency surface — | COMMENT |
| LOW | crates/nub-phantom-scan/src/manifest.rs | 21 | /// Required peers (`peerDependencies` without an `optional` meta flag). | COMMENT |
| LOW | crates/nub-phantom-scan/src/manifest.rs | 281 | /// Whether a `main`/`module`/`bin`/`exports` target should SEED the reachable | COMMENT |
| LOW | crates/nub-data-formats/Cargo.toml | 1 | # The YAML/TOML/JSON5/JSONC parsers behind Nub's data imports, factored out so | COMMENT |
| LOW | crates/nub-data-formats/src/lib.rs | 1 | //! The data formats Nub's runtime accepts as imports — YAML, TOML, JSON5, JSONC. | COMMENT |
| LOW | crates/nub-data-formats/src/lib.rs | 21 | /// take arbitrary user data — a `.json5` fixture is not a `nub.jsonc` — but far | COMMENT |
| LOW | crates/nub-tsconfig/Cargo.toml | 1 | # tsconfig discovery / parse / `extends` resolution (the get-tsconfig@4.14.0 port), | COMMENT |
| LOW | crates/nub-tsconfig/src/lib.rs | 1 | //! In-process tsconfig discovery / parse / `extends` resolution + a `paths` | COMMENT |
| LOW | crates/nub-tsconfig/src/lib.rs | 21 | //! (the cache-key component) all match get-tsconfig's output so warm transpile | COMMENT |
| LOW | crates/nub-tsconfig/src/lib.rs | 61 | COMMENT | |
| LOW | crates/nub-tsconfig/src/lib.rs | 161 | COMMENT | |
| LOW | crates/nub-tsconfig/src/lib.rs | 181 | /// Problems found parsing the tsconfig governing `dir`, already rendered for a | COMMENT |
| LOW | crates/nub-tsconfig/src/lib.rs | 201 | /// Both processes parse the same tsconfig on an ordinary run, so without this the | COMMENT |
| LOW | crates/nub-tsconfig/src/lib.rs | 561 | Value::Array(arr) => arr | COMMENT |
| LOW | crates/nub-tsconfig/src/lib.rs | 981 | // The `Option` is the deserialization target, not a wrapper the parser adds. | COMMENT |
| LOW | crates/nub-tsconfig/src/lib.rs | 1181 | emit_decorator_metadata: map.get("emitDecoratorMetadata").and_then(Value::as_bool), | COMMENT |
| LOW | crates/nub-phantom/Cargo.toml | 1 | # nub-phantom — an INTERNAL/eval tool, not part of the shipped `nub` binary. | COMMENT |
| LOW | crates/nub-phantom/src/lib.rs | 1 | //! nub-phantom — detect UNDECLARED (phantom) dependencies of an npm package. | COMMENT |
| LOW | crates/nub-phantom/src/main.rs | 241 | struct Totals { | COMMENT |
| LOW | crates/nub-core/Cargo.toml | 1 | # SELF-CONTAINED MANIFEST (no `*.workspace = true`): nub-core is a member of the | COMMENT |
| LOW | crates/nub-core/Cargo.toml | 61 | semver = "1" | COMMENT |
| LOW | crates/nub-core/Cargo.toml | 81 | # shipped binary; the one-time ~tens-of-ms decode is irrelevant. Encode happens | COMMENT |
| LOW | crates/nub-core/build.rs | 1 | //! Single-binary blob generation (the `embed-runtime` feature only). | COMMENT |
| LOW | crates/nub-core/build.rs | 141 | let mut hasher = Sha256::new(); | COMMENT |
| LOW | crates/nub-core/benches/cache_body_copy.rs | 1 | //! Bench for the warm-hit body-copy reduction in `crates/nub-native/src/cache.rs`. | COMMENT |
| LOW | crates/nub-core/benches/cache_hash.rs | 1 | //! Benches for the transpile-cache hot path. | COMMENT |
| LOW | crates/nub-core/benches/workspace_filter.rs | 1 | //! Baseline benches for the workspace topo-sort hot path. | COMMENT |
| LOW | crates/nub-core/src/lib.rs | 21 | /// standard library exposes no constant for this — only `env::join_paths` / | COMMENT |
| LOW | crates/nub-core/src/config_cache.rs | 1 | //! Per-process, mtime-validated cache for config-file reads. | COMMENT |
| LOW | crates/nub-core/src/config_cache.rs | 21 | //! reports the very same mtime. `size` catches that only when the length also | COMMENT |
| LOW | crates/nub-core/src/config_cache.rs | 41 | COMMENT | |
| LOW | crates/nub-core/src/config_cache.rs | 61 | /// freshness stamp — its `(mtime, size)` pair — changes. Stores `Arc<V>` so a | COMMENT |
| LOW | crates/nub-core/src/config_cache.rs | 81 | COMMENT | |
| LOW | crates/nub-core/src/config_cache.rs | 121 | /// stamp matches the cached one; otherwise run `read` to produce a fresh | COMMENT |
| LOW | crates/nub-core/src/config_cache.rs | 281 | std::fs::write(&path, "v2").unwrap(); | COMMENT |
| LOW | crates/nub-core/src/compile.rs | 1 | //! The `nub compile` payload container — the single source of truth for the | COMMENT |
| LOW | crates/nub-core/src/compile.rs | 21 | //! launcher trusts the payload mapped from its own executable; publisher | COMMENT |
| LOW | crates/nub-core/src/compile.rs | 61 | /// or provisions one at runtime. | COMMENT |
| 1210 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | crates/nub-tsconfig/src/lib.rs | 345 | // ── `${configDir}` (TS 5.5) ───────────────────────────────────────── | COMMENT |
| MEDIUM | crates/nub-tsconfig/src/lib.rs | 1163 | // ── compilerOptions extraction + hash ─────────────────────────────── | COMMENT |
| MEDIUM | crates/nub-tsconfig/src/lib.rs | 1210 | // ── paths matcher (get-tsconfig's `createPathsMatcher`) ───────────── | COMMENT |
| MEDIUM | crates/nub-core/src/workspace/shell_escape.rs | 203 | // ── POSIX sh (the verified-against-npm path) ────────────────────────── | COMMENT |
| MEDIUM | crates/nub-core/src/workspace/shell_escape.rs | 282 | // ── splice_args (the body+args display/exec string) ─────────────────── | COMMENT |
| MEDIUM | crates/nub-core/src/version_management/manage.rs | 66 | // ── install ────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/nub-core/src/version_management/manage.rs | 201 | // ── ls ─────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/nub-core/src/version_management/manage.rs | 230 | // ── uninstall ──────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/nub-core/src/version_management/manage.rs | 269 | // ── pin ────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/nub-core/src/node/version.rs | 452 | // ── Tier boundary cases ──────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/nub-core/src/node/feature_matrix.rs | 156 | // ── vm.Module / vm.SourceTextModule ──────────────────────────────────── | COMMENT |
| MEDIUM | crates/nub-core/src/node/feature_matrix.rs | 191 | // ── EventSource global ────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/nub-core/src/node/feature_matrix.rs | 211 | // ── node:sqlite ───────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/nub-core/src/node/feature_matrix.rs | 232 | // ── Wasm ES-module imports (import of `.wasm`) ────────────────────────── | COMMENT |
| MEDIUM | crates/nub-core/src/node/feature_matrix.rs | 259 | // ── addon-modules (ESM import of native .node addons) ──────────────────── | COMMENT |
| MEDIUM | crates/nub-core/src/node/feature_matrix.rs | 283 | // ── import-text (importing source as text via import attributes) ───────── | COMMENT |
| MEDIUM | crates/nub-core/src/node/feature_matrix.rs | 319 | // ── Deferred module evaluation (`import defer`) ────────────────────────── | COMMENT |
| MEDIUM | crates/nub-core/src/node/feature_matrix.rs | 372 | // ── Module syntax detection (ambiguous ESM `.js`) ──────────────────────── | COMMENT |
| MEDIUM | crates/nub-core/src/node/feature_matrix.rs | 399 | // ── node:ffi (foreign function interface) ──────────────────────────────── | COMMENT |
| MEDIUM | crates/nub-core/src/node/feature_matrix.rs | 418 | // ── node:vfs (virtual file system) ─────────────────────────────────────── | COMMENT |
| MEDIUM | crates/nub-core/src/node/feature_matrix.rs | 432 | // ── node:stream/iter (async-iterator stream adapters) ──────────────────── | COMMENT |
| MEDIUM | crates/nub-core/src/node/feature_matrix.rs | 446 | // ── WebSocket global ──────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/nub-core/src/node/feature_matrix.rs | 462 | // ── Web Storage (localStorage / sessionStorage) ───────────────────────── | COMMENT |
| MEDIUM | crates/nub-core/src/node/feature_matrix.rs | 491 | // ── reportError ───────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/nub-core/src/node/feature_matrix.rs | 506 | // ── URLPattern ────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/nub-core/src/node/feature_matrix.rs | 524 | // ── RegExp.escape ─────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/nub-core/src/node/feature_matrix.rs | 540 | // ── Error.isError ─────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/nub-core/src/node/feature_matrix.rs | 557 | // ── Promise.try ───────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/nub-core/src/node/feature_matrix.rs | 573 | // ── Stage 3+ library surfaces ─────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/nub-core/src/node/feature_matrix.rs | 714 | // ── Shipped-standard builtins missing below their Node line ───────────── | COMMENT |
| MEDIUM | crates/nub-core/src/node/feature_matrix.rs | 833 | // ── Promise.withResolvers ─────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/nub-core/src/node/feature_matrix.rs | 852 | // ── Promise.allKeyed / Promise.allSettledKeyed ────────────────────────── | COMMENT |
| MEDIUM | crates/nub-core/src/node/feature_matrix.rs | 879 | // ── Float16Array ──────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/nub-core/src/node/feature_matrix.rs | 897 | // ── Uint8Array base64/hex ─────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/nub-core/src/node/feature_matrix.rs | 917 | // ── DisposableStack / AsyncDisposableStack / SuppressedError ───────────── | COMMENT |
| MEDIUM | crates/nub-core/src/node/feature_matrix.rs | 966 | // ── Temporal ──────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/nub-core/src/node/feature_matrix.rs | 982 | // ── Worker (browser-shape global) ─────────────────────────────────────── | COMMENT |
| MEDIUM | crates/nub-core/src/node/feature_matrix.rs | 997 | // ── navigator global ──────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/nub-core/src/node/feature_matrix.rs | 1018 | // ── navigator.locks (Web Locks API) ───────────────────────────────────── | COMMENT |
| MEDIUM | crates/nub-cli/tests/cli_grammar_parity.rs | 111 | // ───────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/nub-cli/tests/cli_grammar_parity.rs | 115 | // ───────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/nub-cli/tests/cli_grammar_parity.rs | 343 | // ───────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/nub-cli/tests/cli_grammar_parity.rs | 347 | // ───────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/nub-cli/tests/cli_grammar_parity.rs | 463 | // ───────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/nub-cli/tests/cli_grammar_parity.rs | 468 | // ───────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/nub-cli/tests/integration.rs | 1293 | // ── Version-gated tests ───────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/nub-cli/tests/integration.rs | 1503 | // ── Project-source plain JS (.js/.mjs/.cjs) transpile ─────────────── | COMMENT |
| MEDIUM | crates/nub-cli/tests/integration.rs | 3697 | // ── Parallel run ────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/nub-cli/tests/integration.rs | 3738 | // ── Serial control run (concurrency=1) ─────────────────────────────────── | COMMENT |
| MEDIUM | crates/nub-cli/tests/integration.rs | 3978 | // ── Section 4: Missing integration tests (v0.1-quality) ────────── | COMMENT |
| MEDIUM | crates/nub-cli/tests/integration.rs | 7875 | // ── Section 7: pnpm workspace behavior tests ──────────────────── | COMMENT |
| MEDIUM | crates/nub-cli/tests/integration.rs | 8343 | // ── `nub run` full flag set (run.md) ──────────────────────────────────────── | COMMENT |
| MEDIUM | crates/nub-cli/tests/integration.rs | 9155 | // ── PM-management verbs (A2 passthrough disabled) ──────────────────────────── | COMMENT |
| MEDIUM | crates/nub-cli/tests/integration.rs | 9489 | // ── `nub pm` / `nub node` UX-message fixes ─────────────────────────────────── | COMMENT |
| MEDIUM | crates/nub-cli/src/project_config.rs | 85 | // ───────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/nub-cli/src/project_config.rs | 87 | // ───────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/nub-cli/src/project_config.rs | 197 | // ───────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/nub-cli/src/project_config.rs | 199 | // ───────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/nub-cli/src/project_config.rs | 1018 | // ───────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/nub-cli/src/project_config.rs | 1022 | // ───────────────────────────────────────────────────────────────────────────── | COMMENT |
| 200 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | Cargo.toml | 108 | # Benchmark harness (dev-only). `harness = false` benches drive criterion's own | COMMENT |
| MEDIUM | crates/nub-core/src/version_management/mod.rs | 182 | /// selector keys on Node's `glibcVersionRuntime` (the robust detect-libc signal), | COMMENT |
| MEDIUM | crates/nub-cache-key/Cargo.toml | 3 | # resolved by the Node host at dlopen, so a `cargo test` harness for that crate | COMMENT |
| MEDIUM | crates/nub-json-guard/Cargo.toml | 4 | # `test = false` (a `cargo test` harness cannot link them) — a copy of this | COMMENT |
| MEDIUM | crates/nub-native/Cargo.toml | 118 | # allowed), but a `cargo test` harness is a normal executable and CANNOT link those | COMMENT |
| MEDIUM | crates/nub-cli/tests/integration.rs | 2798 | // Dual-channel doubling regression, tier-robust. On the `nub <file>` path the | COMMENT |
| MEDIUM | crates/nub-cli/tests/integration.rs | 8535 | /// fake shell that prints a marker before delegating to `/bin/sh` — robust across | COMMENT |
| MEDIUM | crates/nub-cli/tests/integration.rs | 8828 | // loading is the robust augmentation discriminator here — flag/preload | COMMENT |
| MEDIUM | tests/bench/install/run-warm-gvs.sh | 106 | # $$ here is the harness PID (constant); $RANDOM varies per --prepare eval. | COMMENT |
| MEDIUM | tests/bench/install/gen-fixtures.sh | 7 | # each bench harness installs from nub.lock — its native lockfile — not the | COMMENT |
| MEDIUM | tests/bench/script-runner/run-vs-node.sh | 20 | # This is a canonical checked-in benchmark harness. By default, result JSON is | COMMENT |
| MEDIUM | tests/bench/bin-runner/run-pure.sh | 10 | # bin-runner sibling of run-script-runner-pure.sh and uses the same harness. | COMMENT |
| MEDIUM | tests/launcher/make-fixture.sh | 59 | # (the harness exercises the RUNTIME heal, independent of postinstall). | COMMENT |
| MEDIUM | tests/launcher/make-fixture.sh | 185 | # failure this harness exists to prevent. | COMMENT |
| MEDIUM | tests/pnpm-conformance/run.sh | 2 | # pnpm conformance harness — run pnpm's OWN black-box CLI test suite against nub. | COMMENT |
| MEDIUM | tests/pnpm-conformance/run.sh | 210 | # Substituting them into the file is the robust seam. `#` is the sed delimiter | COMMENT |
| MEDIUM | tests/pnpm-conformance/run.sh | 258 | # First integer run of `jest --version` (robust to a leading v / extra text). | COMMENT |
| MEDIUM | tests/brand-global/run.sh | 60 | # clean too, then print a single PASS/FAIL line the harness greps. A TS annotation | COMMENT |
| MEDIUM | tests/aube-conformance/run.sh | 2 | # Lockfile conformance harness — nub's embedded aube engine writes each | COMMENT |
| MEDIUM | tests/mutation/run-mutations.sh | 2 | # Lockfile MUTATION differential harness — the write-path counterpart to the | COMMENT |
| MEDIUM | tests/mutation/run-mutations.sh | 111 | # spec file, which is harness metadata, not project content. | COMMENT |
| MEDIUM | tests/native-deps/run.sh | 2 | # Native-dependency floor end-to-end harness. | COMMENT |
| MEDIUM | tests/native-deps/run.sh | 76 | # Copy only the fixture files — not the harness scripts — to avoid | COMMENT |
| MEDIUM | tests/parcel-gvs/make-fixture.sh | 7 | # over-split this harness regression-tests). | COMMENT |
| MEDIUM | tests/parcel-gvs/run.sh | 2 | # Regression harness for the GVS @parcel/core store-dir over-split. | COMMENT |
| MEDIUM | tests/daily-driver/run.sh | 2 | # Real-app daily-loop smoke harness. | COMMENT |
| MEDIUM | tests/registry-stall/run-stall-matrix.sh | 34 | # A binary that predates the stall bound is the failure mode this harness is | COMMENT |
| MEDIUM | tests/vite-compat/driver.sh | 25 | # Fidelity note: this harness asserts at the HTTP layer — it fetches the REAL | COMMENT |
| MEDIUM | tests/vite-compat/driver.sh | 43 | # the next run then binds a DIFFERENT port while the harness curls the stale | COMMENT |
| MEDIUM | tests/vite-compat/driver.sh | 44 | # (unpatched) server → false 403s. The robust fix is a process GROUP: the dev | COMMENT |
| MEDIUM | tests/conversion/run.sh | 2 | # Cross-format lockfile conversion harness — proves `nub pm use <target>` produces | COMMENT |
| MEDIUM | tests/conversion/run.sh | 10 | # For each (source, target) pair the harness: | COMMENT |
| MEDIUM | tests/compile-corpus/layouts.sh | 185 | # defect for as long as the harness existed: the shared chunks were emitted as | COMMENT |
| MEDIUM | tests/cross-runtime/pty-spawn.py | 7 | # exits with the child's status, because the harness reads exit codes; and it | COMMENT |
| MEDIUM | tests/cross-runtime/pty-spawn.py | 8 | # resolves the command through PATH (execvpe, not execve), because the harness | COMMENT |
| MEDIUM | tests/global-install/run.sh | 49 | # fail, the harness is broken, not the code. `git worktree add` at the | COMMENT |
| MEDIUM | tests/aube-bats/run.sh | 5 | # registry. This harness runs a CURATED subset of those suites with nub's PM | COMMENT |
| MEDIUM | tests/aube-bats/run.sh | 9 | # that exec's nub — so the harness's own PATH prepend resolves straight to | COMMENT |
| MEDIUM | tests/aube-bats/run.sh | 51 | # nothing else is guaranteed to survive the harness's env isolation); | COMMENT |
| MEDIUM | tests/aube-bats/run.sh | 52 | # 2. translate the harness's AUBE_* knobs to their npm_config_* spellings. | COMMENT |
| MEDIUM | tests/installer/run.sh | 6 | # Local end-to-end harness for install.sh. Each case runs the REAL installer | COMMENT |
| MEDIUM | tests/conformance/run.sh | 2 | # Drop-in PM conformance harness — proves nub is a true drop-in package manager | COMMENT |
| MEDIUM | tests/conformance/run-pnpm11.sh | 2 | # pnpm-11 conformance leg for the drop-in PM conformance harness. | COMMENT |
| MEDIUM | tests/conformance/frontdoor/run.sh | 9 | # DISTINCT from its two siblings (README.md): the lockfile harness verifies | COMMENT |
| MEDIUM | tests/conformance/frontdoor/run.sh | 10 | # round-trip fidelity; the cmdflag harness verifies every verb runs on one repo; | COMMENT |
| MEDIUM | tests/conformance/frontdoor/run.sh | 23 | set -uo pipefail # NOT -e: a failing cell is data, not a harness abort. | CODE |
| MEDIUM⚡ | tests/conformance/cmdflag/run.sh | 2 | # Command×flag conformance harness — exercise nub's FULL CLI surface against a | COMMENT |
| MEDIUM⚡ | tests/conformance/cmdflag/run.sh | 8 | # DISTINCT from the lockfile harness one level up (tests/conformance/run.sh), | COMMENT |
| MEDIUM⚡ | tests/conformance/cmdflag/run.sh | 17 | # harness operates on COPIES — the fixture is never | COMMENT |
| MEDIUM | tests/conformance/cmdflag/run.sh | 32 | set -uo pipefail # NOT -e: a failing cell is data, not a harness abort. | CODE |
| MEDIUM | tests/conformance/cmdflag/run.sh | 68 | # point of the harness is to cover REAL machine state, not a pristine void. | COMMENT |
| MEDIUM | scripts/check-docs-links.ts | 144 | // Markdown link target: ](...) — the simplest robust form; docs use plain | COMMENT |
| MEDIUM | scripts/ci-watch.ts | 3 | // terminal, then exit with a status the orchestrator can trust. The robust | COMMENT |
| MEDIUM | scripts/remote-build.ts | 850 | # why a run could not fit the driving harness's ceiling and the tool never completed a job. | COMMENT |
| MEDIUM | .github/workflows/release.yml | 561 | # harness exercises the PM engine (install/add/pm use), not the data-format | COMMENT |
| MEDIUM | .github/workflows/verb-dispatch.yml | 8 | # harness in tests/launcher/ — the two platforms take different paths and only one of | COMMENT |
| MEDIUM | .github/workflows/native-deps.yml | 15 | # Why separate workflow: the harness does a real npm registry install of esbuild | COMMENT |
| MEDIUM | .github/workflows/test-install.yml | 4 | # comprehensive battery the release pipeline runs post-publish, but decoupled from a | COMMENT |
| MEDIUM | .github/workflows/compile-native.yml | 145 | # Tree SHAPES, as opposed to the islands harness above, which varies the | COMMENT |
| MEDIUM | .github/workflows/compile-native.yml | 151 | # Linux only, and only because it is cheap: the whole harness is ~80s and | COMMENT |
| 14 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | crates/nub-cli/tests/init_cmd.rs | 1 | //! `nub init` through the real binary — scaffold contents, refuse-don't- | COMMENT |
| MEDIUM | crates/nub-cli/tests/init_cmd.rs | 3 | //! is offline by construction: scaffold-only cases use `--no-install`, while | COMMENT |
| MEDIUM | crates/nub-cli/tests/init_cmd.rs | 394 | /// `git check-ignore` is the only honest test of a `.gitignore`: the scaffold's | COMMENT |
| MEDIUM | crates/nub-cli/tests/pm_verbs.rs | 910 | /// The scaffold contract itself lives in tests/init_cmd.rs. | COMMENT |
| MEDIUM | crates/nub-cli/src/init.rs | 1 | //! `nub init` — scaffold a minimal modern-TS project (nub's own project init, | COMMENT |
| MEDIUM | crates/nub-cli/src/init.rs | 3 | //! from ENGINE_VERBS). Design record: internal/commands/init.md. The scaffold is | COMMENT |
| MEDIUM⚡ | crates/nub-cli/src/init.rs | 16 | /// `@types/node` range written into the scaffold. Tracks the docs' latest-major | COMMENT |
| MEDIUM⚡ | crates/nub-cli/src/init.rs | 21 | /// Oldest declarations that cover the scaffold's `Worker`-era ambient surface. | COMMENT |
| MEDIUM⚡ | crates/nub-cli/src/init.rs | 27 | /// `typescript` range written into the scaffold. Nub transpiles TS itself, so | COMMENT |
| MEDIUM | crates/nub-cli/src/init.rs | 361 | /// Best-effort `git init` — a missing/failing git degrades the scaffold, it | COMMENT |
| MEDIUM | crates/nub-cli/src/cli.rs | 2837 | // Self-update, the scaffold, and the help pages consume no project | COMMENT |
| MEDIUM | crates/nub-cli/src/cli.rs | 2841 | // scaffold's final cwd. | COMMENT |
| MEDIUM | crates/nub-cli/src/cli.rs | 9779 | // (the same never-scaffold rule write_declared_pm enforces — but only | COMMENT |
| MEDIUM | crates/nub-cli/src/pm_engine/install_family.rs | 1400 | // refuses to scaffold one); the install already succeeded, so this is a | COMMENT |
| MEDIUM | crates/nub-cli/src/pm_engine/install_family.rs | 2394 | /// or scaffold one — the stamp is best-effort and silently no-ops (nub never | COMMENT |
| MEDIUM | crates/nub-cli/src/pm_engine/mod.rs | 256 | // own project scaffold (src/init.rs, a clap subcommand), not the engine's | COMMENT |
| MEDIUM | tests/daily-driver/README.md | 35 | # Reuse an existing fixture (skip the scaffold + install for iteration) | COMMENT |
| MEDIUM⚡ | tests/vite-compat/scaffold.sh | 2 | # scaffold.sh — non-interactively scaffold a real Vite-powered project for the | COMMENT |
| MEDIUM⚡ | tests/vite-compat/scaffold.sh | 7 | # Usage: scaffold.sh <case> <dest-dir> | COMMENT |
| MEDIUM⚡ | tests/vite-compat/scaffold.sh | 8 | # Cases print, after scaffolding, two lines the runner consumes: | COMMENT |
| MEDIUM | tests/framework-matrix/frameworks.sh | 10 | # Usage: frameworks.sh scaffold <name> <dest> # scaffolds into <dest>, prints DEV=/BUILD=/PREVIEW=/PROBE=/GVS= | COMMENT |
| MEDIUM | tests/framework-matrix/matrix.sh | 3 | # scaffold it via its OFFICIAL create-* generator (frameworks.sh), then drive the | COMMENT |
| MEDIUM | wiki/research/upstream-cpp-resolver-prs.md | 30 | - **#61548** (joyeecheung, merged Feb 2026) — "src: initial support for ESM in embedder API." Adds `ModuleData`, `Module | CODE |
| MEDIUM | wiki/research/gvs-in-ci.md | 52 | So the divergence question inverts: Nub is not diverging from the norm by gating GVS in CI — Nub diverged by making GVS | CODE |
| MEDIUM | wiki/research/workspace-discovery-walk-up.md | 19 | ## (1) Test scaffold | COMMENT |
| MEDIUM | benchmarks/README.md | 32 | # Script runner overhead (pure orchestration) | COMMENT |
| MEDIUM | .github/workflows/release.yml | 863 | # writes both literals into the `nub init` scaffold, so they sit in every | COMMENT |
| MEDIUM | site/public/skill.md | 76 | nub run --node test # nub's CLI orchestration, runtime augmentation off | CODE |
| MEDIUM | skills/nub/SKILL.md | 76 | nub run --node test # nub's CLI orchestration, runtime augmentation off | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/bench/install/cold-cas.sh | 34 | # Usage: | COMMENT |
| LOW | tests/bench/install/run.sh | 5 | # Usage: | COMMENT |
| LOW | tests/bench/install/run-4way.sh | 10 | # Usage: | COMMENT |
| LOW | tests/pnpm-conformance/run.sh | 11 | # Usage: | COMMENT |
| LOW | tests/vm/tart-vm.sh | 13 | # Usage: | COMMENT |
| LOW | tests/pnp/run-pnp-matrix.sh | 17 | # Usage: | COMMENT |
| LOW | tests/conformance/run-pnpm11.sh | 23 | # Usage: | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/worker-wpt/wpt/resources/testharness.js | 338 | function DedicatedWorkerTestEnvironment() { | CODE |
| LOW | tests/worker-wpt/wpt/resources/testharness.js | 361 | function SharedWorkerTestEnvironment() { | CODE |
| LOW | tests/worker-wpt/wpt/resources/testharness.js | 387 | function ServiceWorkerTestEnvironment() { | CODE |
| LOW | tests/worker-wpt/wpt/resources/testharness.js | 439 | function ShadowRealmTestEnvironment() { | CODE |
| LOW | tests/worker-wpt/wpt/resources/testharness.js | 4839 | function OptionalFeatureUnsupportedError(message) | CODE |
| LOW | …red-clone/structured-clone-battery-of-tests-harness.js | 16 | function runStructuredCloneBatteryOfTests(runner) { | CODE |
| LOW | …skills/cpu-reduction/scripts/clean-worktree-targets.py | 100 | def owns_installed_dev_binary(path: Path, binaries: list[Path]) -> bool: | CODE |
| LOW | wiki/research/store-marker-hardcoding.md | 18 | function getProjectRootDirectoryFromNodeModules(projectPath) { | CODE |
| LOW | wiki/research/node-strip-types-interaction.md | 29 | function initializeExtensionFormatMap() { | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | crates/nub-core/src/pm/lockfile_version.rs | 256 | let berry = "# This file is generated by running \"yarn install\".\n\n\ | CODE |
| MEDIUM | .github/workflows/release.yml | 409 | # This file is what makes the corpus DOWNLOAD-RANKED rather than the | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | install.sh | 328 | # Check if already in PATH | COMMENT |
| LOW | site/public/install.sh | 328 | # Check if already in PATH | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | scripts/remote-build.ts | 436 | [ -s runtime/addons/nub-native.node ] || printf 'placeholder' > runtime/addons/nub-native.node | CODE |
| LOW | scripts/remote-build.ts | 827 | mkdir -p runtime/addons && printf 'placeholder' > runtime/addons/nub-native.node | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …skills/cpu-reduction/scripts/clean-worktree-targets.py | 4 | CODE |