The fast all-in-one Node.js toolkit
This report summarizes scanner evidence for nubjs/nub, a Rust project with 4,379 GitHub stars. SynthScan examined 316,489 lines of code across 931 source files, recording 2032 pattern matches distributed across 10 syntactic categories. The legacy adjusted pattern signal is 8.4 (Moderate pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Can maintainers explain intent, assumptions, and trade-offs? 1755 finding(s).
Are imports declared and package/API names verified? 3 finding(s).
Are wrappers, guards, and repeated structures necessary? 283 finding(s).
Which changes need focused human review? 2032 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 2032 distinct pattern matches across 10 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | Cargo.toml | 1 | [workspace] | COMMENT |
| LOW | Cargo.toml | 21 | # `[profile.release] panic = "unwind"`, and is excluded here. It is built with | COMMENT |
| LOW | Cargo.toml | 41 | # | COMMENT |
| LOW | Cargo.toml | 121 | # the transpiler's tsconfig parsing and nub's own global config file | COMMENT |
| LOW | Cargo.toml | 161 | # gzip: without it reqwest sends no Accept-Encoding, so the registry serves | COMMENT |
| LOW | Cargo.toml | 181 | # Windows .zip Node-dist extraction (pure Rust, no shell-out to Expand-Archive / | COMMENT |
| LOW | Cross.toml | 1 | # cross-rs configuration. | COMMENT |
| LOW | install.sh | 201 | # which tar restored above. Recreate them anyway: an archive from before they | COMMENT |
| LOW | hawk.toml | 1 | # hawk (astral-sh/hawk) visibility-lint config. | COMMENT |
| LOW | .githooks/agents-symlink-check.sh | 1 | #!/bin/sh | COMMENT |
| LOW | tools/pnpm-workspace.yaml | 1 | # pnpm-side soak surface + catalog (pnpm reads minimumReleaseAge in MINUTES | COMMENT |
| LOW | tools/pnpm-workspace.yaml | 21 | # which the gate can't validate); expired ones warn until `soak:fix` / | COMMENT |
| LOW | crates/nub-phantom-scan/src/classify.rs | 21 | HardPhantom, | COMMENT |
| LOW | crates/nub-phantom-scan/src/classify.rs | 41 | /// Undeclared as a runtime dep, but present in `devDependencies` AND reachable | COMMENT |
| LOW | crates/nub-phantom-scan/src/classify.rs | 61 | /// Reachable from a non-`.` `exports` subpath (the adapter surface). | COMMENT |
| LOW | crates/nub-phantom-scan/src/classify.rs | 81 | /// the path is what settles it. | COMMENT |
| LOW | crates/nub-phantom-scan/src/classify.rs | 201 | if is_host_provided(package) { | COMMENT |
| LOW | crates/nub-phantom-scan/src/graph.rs | 1 | //! Walk the module graph reachable from a package's PUBLISHED entry points, | COMMENT |
| LOW | crates/nub-phantom-scan/src/graph.rs | 21 | use crate::manifest::{Entry, EntryKind}; | COMMENT |
| LOW | crates/nub-phantom-scan/src/graph.rs | 41 | const FROM_DEEP_PATH: u8 = 0b1000; | COMMENT |
| LOW | crates/nub-phantom-scan/src/graph.rs | 61 | pub(crate) soft: bool, | COMMENT |
| LOW | crates/nub-phantom-scan/src/graph.rs | 81 | pub files_analyzed: usize, | COMMENT |
| LOW | crates/nub-phantom-scan/src/graph.rs | 101 | fn resolve_entry(&self, entry_path: &str, prefer_dts: bool) -> Option<Self::Key>; | COMMENT |
| LOW | crates/nub-phantom-scan/src/graph.rs | 121 | fn read_rel(&self, rel: &str) -> Option<String>; | COMMENT |
| LOW | crates/nub-phantom-scan/src/graph.rs | 141 | /// report can separate subpath-adapter phantoms from main-graph ones. | COMMENT |
| LOW | crates/nub-phantom-scan/src/graph.rs | 301 | /// OR `bit` into `key`'s provenance mask. Returns true if the mask GREW (new | COMMENT |
| LOW | crates/nub-phantom-scan/src/graph.rs | 341 | /// `pusher-js` ships `src/` built with `baseUrl: "src"` and | COMMENT |
| LOW | crates/nub-phantom-scan/src/graph.rs | 421 | .iter() | COMMENT |
| LOW | crates/nub-phantom-scan/src/graph.rs | 481 | out.sort(); | COMMENT |
| LOW | crates/nub-phantom-scan/src/graph.rs | 841 | } else { | COMMENT |
| LOW | crates/nub-phantom-scan/src/lib.rs | 1 | //! nub-phantom-scan — scan an already-extracted package version's PUBLISHED, | COMMENT |
| LOW | crates/nub-phantom-scan/src/lib.rs | 41 | } | COMMENT |
| LOW | crates/nub-phantom-scan/src/lib.rs | 81 | /// Scan a package straight from its CAS-backed file index — the EXTRACT-TIME | COMMENT |
| LOW | crates/nub-phantom-scan/src/manifest.rs | 1 | //! Parse a package's `package.json` into (a) its DECLARED dependency surface — | COMMENT |
| LOW | crates/nub-phantom-scan/src/manifest.rs | 21 | /// Required peers (`peerDependencies` without an `optional` meta flag). | COMMENT |
| LOW | crates/nub-phantom-scan/src/manifest.rs | 41 | pub has_exports: bool, | COMMENT |
| LOW | crates/nub-phantom-scan/src/manifest.rs | 301 | /// and `"./dist"` → `./dist/index.js` at runtime, and the graph walk's | COMMENT |
| LOW | crates/nub-data-formats/Cargo.toml | 1 | # The YAML/TOML/JSON5/JSONC parsers behind Nub's data imports, factored out so | COMMENT |
| LOW | crates/nub-data-formats/src/lib.rs | 1 | //! The data formats Nub's runtime accepts as imports — YAML, TOML, JSON5, JSONC. | COMMENT |
| LOW | crates/nub-data-formats/src/lib.rs | 21 | /// take arbitrary user data — a `.json5` fixture is not a `nub.jsonc` — but far | COMMENT |
| LOW | crates/nub-tsconfig/Cargo.toml | 1 | # tsconfig discovery / parse / `extends` resolution (the get-tsconfig@4.14.0 port), | COMMENT |
| LOW | crates/nub-tsconfig/src/lib.rs | 1 | //! In-process tsconfig discovery / parse / `extends` resolution + a `paths` | COMMENT |
| LOW | crates/nub-tsconfig/src/lib.rs | 21 | //! (the cache-key component) all match get-tsconfig's output so warm transpile | COMMENT |
| LOW | crates/nub-tsconfig/src/lib.rs | 61 | COMMENT | |
| LOW | crates/nub-tsconfig/src/lib.rs | 161 | COMMENT | |
| LOW | crates/nub-tsconfig/src/lib.rs | 181 | /// Problems found parsing the tsconfig governing `dir`, already rendered for a | COMMENT |
| LOW | crates/nub-tsconfig/src/lib.rs | 601 | obj.remove("extends"); | COMMENT |
| LOW | crates/nub-tsconfig/src/lib.rs | 921 | ) | COMMENT |
| LOW | crates/nub-tsconfig/src/lib.rs | 1041 | // UTF-8 BOM, but a configured tsconfig — and the package metadata in its | COMMENT |
| LOW | crates/nub-phantom/Cargo.toml | 1 | # nub-phantom — an INTERNAL/eval tool, not part of the shipped `nub` binary. | COMMENT |
| LOW | crates/nub-phantom/src/lib.rs | 1 | //! nub-phantom — detect UNDECLARED (phantom) dependencies of an npm package. | COMMENT |
| LOW | crates/nub-core/Cargo.toml | 1 | # SELF-CONTAINED MANIFEST (no `*.workspace = true`): nub-core is a member of the | COMMENT |
| LOW | crates/nub-core/Cargo.toml | 41 | libc = "0.2" | COMMENT |
| LOW | crates/nub-core/Cargo.toml | 81 | # sha1 (ancient PM publishes carry only a sha1 dist.shasum) sits alongside sha2. | COMMENT |
| LOW | crates/nub-core/Cargo.toml | 101 | # | COMMENT |
| LOW | crates/nub-core/Cargo.toml | 121 | "Win32_Foundation", | COMMENT |
| LOW | crates/nub-core/Cargo.toml | 141 | # the crate unlinked: E0433 from the build script. | COMMENT |
| LOW | crates/nub-core/build.rs | 1 | //! Single-binary blob generation (the `embed-runtime` feature only). | COMMENT |
| LOW | crates/nub-core/build.rs | 141 | let mut hasher = Sha256::new(); | COMMENT |
| LOW | crates/nub-core/benches/cache_body_copy.rs | 1 | //! Bench for the warm-hit body-copy reduction in `crates/nub-native/src/cache.rs`. | COMMENT |
| 1550 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | crates/nub-tsconfig/src/lib.rs | 378 | // ── `${configDir}` (TS 5.5) ───────────────────────────────────────── | COMMENT |
| MEDIUM | crates/nub-tsconfig/src/lib.rs | 1229 | // ── compilerOptions extraction + hash ─────────────────────────────── | COMMENT |
| MEDIUM | crates/nub-tsconfig/src/lib.rs | 1276 | // ── paths matcher (get-tsconfig's `createPathsMatcher`) ───────────── | COMMENT |
| MEDIUM | crates/nub-core/src/resource_limits.rs | 159 | // ───────────────────────── CPU budget (cgroup CFS quota) ───────────────────────── | COMMENT |
| MEDIUM | crates/nub-core/src/resource_limits.rs | 712 | // ─────────────────────── CPU budget ─────────────────────── | COMMENT |
| MEDIUM | crates/nub-core/src/workspace/shell_escape.rs | 203 | // ── POSIX sh (the verified-against-npm path) ────────────────────────── | COMMENT |
| MEDIUM | crates/nub-core/src/workspace/shell_escape.rs | 282 | // ── splice_args (the body+args display/exec string) ─────────────────── | COMMENT |
| MEDIUM | crates/nub-core/src/version_management/manage.rs | 72 | // ── install ────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/nub-core/src/version_management/manage.rs | 214 | // ── ls ─────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/nub-core/src/version_management/manage.rs | 243 | // ── uninstall ──────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/nub-core/src/version_management/manage.rs | 282 | // ── pin ────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/nub-core/src/node/version.rs | 452 | // ── Tier boundary cases ──────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/nub-core/src/node/feature_matrix.rs | 171 | // ── vm.Module / vm.SourceTextModule ──────────────────────────────────── | COMMENT |
| MEDIUM | crates/nub-core/src/node/feature_matrix.rs | 206 | // ── EventSource global ────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/nub-core/src/node/feature_matrix.rs | 226 | // ── node:sqlite ───────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/nub-core/src/node/feature_matrix.rs | 247 | // ── Wasm ES-module imports (import of `.wasm`) ────────────────────────── | COMMENT |
| MEDIUM | crates/nub-core/src/node/feature_matrix.rs | 274 | // ── addon-modules (ESM import of native .node addons) ──────────────────── | COMMENT |
| MEDIUM | crates/nub-core/src/node/feature_matrix.rs | 298 | // ── import-text (importing source as text via import attributes) ───────── | COMMENT |
| MEDIUM | crates/nub-core/src/node/feature_matrix.rs | 334 | // ── Deferred module evaluation (`import defer`) ────────────────────────── | COMMENT |
| MEDIUM | crates/nub-core/src/node/feature_matrix.rs | 406 | // ── Module syntax detection (ambiguous ESM `.js`) ──────────────────────── | COMMENT |
| MEDIUM | crates/nub-core/src/node/feature_matrix.rs | 433 | // ── node:ffi (foreign function interface) ──────────────────────────────── | COMMENT |
| MEDIUM | crates/nub-core/src/node/feature_matrix.rs | 452 | // ── node:vfs (virtual file system) ─────────────────────────────────────── | COMMENT |
| MEDIUM | crates/nub-core/src/node/feature_matrix.rs | 466 | // ── node:stream/iter (async-iterator stream adapters) ──────────────────── | COMMENT |
| MEDIUM | crates/nub-core/src/node/feature_matrix.rs | 480 | // ── AsyncLocalStorage on AsyncContextFrame ─────────────────────────────── | COMMENT |
| MEDIUM | crates/nub-core/src/node/feature_matrix.rs | 519 | // ── WebSocket global ──────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/nub-core/src/node/feature_matrix.rs | 535 | // ── Web Storage (localStorage / sessionStorage) ───────────────────────── | COMMENT |
| MEDIUM | crates/nub-core/src/node/feature_matrix.rs | 564 | // ── reportError ───────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/nub-core/src/node/feature_matrix.rs | 579 | // ── URLPattern ────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/nub-core/src/node/feature_matrix.rs | 597 | // ── RegExp.escape ─────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/nub-core/src/node/feature_matrix.rs | 613 | // ── Error.isError ─────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/nub-core/src/node/feature_matrix.rs | 630 | // ── Promise.try ───────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/nub-core/src/node/feature_matrix.rs | 646 | // ── Stage 3+ library surfaces ─────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/nub-core/src/node/feature_matrix.rs | 787 | // ── Shipped-standard builtins missing below their Node line ───────────── | COMMENT |
| MEDIUM | crates/nub-core/src/node/feature_matrix.rs | 906 | // ── Promise.withResolvers ─────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/nub-core/src/node/feature_matrix.rs | 925 | // ── Promise.allKeyed / Promise.allSettledKeyed ────────────────────────── | COMMENT |
| MEDIUM | crates/nub-core/src/node/feature_matrix.rs | 952 | // ── Float16Array ──────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/nub-core/src/node/feature_matrix.rs | 970 | // ── Uint8Array base64/hex ─────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/nub-core/src/node/feature_matrix.rs | 990 | // ── DisposableStack / AsyncDisposableStack / SuppressedError ───────────── | COMMENT |
| MEDIUM | crates/nub-core/src/node/feature_matrix.rs | 1039 | // ── Temporal ──────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/nub-core/src/node/feature_matrix.rs | 1055 | // ── Worker (browser-shape global) ─────────────────────────────────────── | COMMENT |
| MEDIUM | crates/nub-core/src/node/feature_matrix.rs | 1070 | // ── navigator global ──────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/nub-core/src/node/feature_matrix.rs | 1091 | // ── navigator.locks (Web Locks API) ───────────────────────────────────── | COMMENT |
| MEDIUM | crates/nub-cli/tests/fetch_handler.rs | 284 | // ── The served shapes ──────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/nub-cli/tests/fetch_handler.rs | 385 | // ── The request and response bridge ────────────────────────────────── | COMMENT |
| MEDIUM | crates/nub-cli/tests/fetch_handler.rs | 482 | // ── What must NOT be served ────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/nub-cli/tests/fetch_handler.rs | 587 | // ── Behind a wrapper ──────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/nub-cli/tests/fetch_handler.rs | 684 | // ── Address selection ─────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/nub-cli/tests/cli_grammar_parity.rs | 111 | // ───────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/nub-cli/tests/cli_grammar_parity.rs | 115 | // ───────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/nub-cli/tests/cli_grammar_parity.rs | 369 | // ───────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/nub-cli/tests/cli_grammar_parity.rs | 373 | // ───────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/nub-cli/tests/cli_grammar_parity.rs | 505 | // ───────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/nub-cli/tests/cli_grammar_parity.rs | 510 | // ───────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/nub-cli/tests/integration.rs | 1697 | // ── Version-gated tests ───────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/nub-cli/tests/integration.rs | 1907 | // ── Project-source plain JS (.js/.mjs/.cjs) transpile ─────────────── | COMMENT |
| MEDIUM | crates/nub-cli/tests/integration.rs | 4297 | // ── Parallel run ────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/nub-cli/tests/integration.rs | 4338 | // ── Serial control run (concurrency=1) ─────────────────────────────────── | COMMENT |
| MEDIUM | crates/nub-cli/tests/integration.rs | 4578 | // ── Section 4: Missing integration tests (v0.1-quality) ────────── | COMMENT |
| MEDIUM | crates/nub-cli/tests/integration.rs | 8475 | // ── Section 7: pnpm workspace behavior tests ──────────────────── | COMMENT |
| MEDIUM | crates/nub-cli/tests/integration.rs | 8943 | // ── `nub run` full flag set (run.md) ──────────────────────────────────────── | COMMENT |
| 214 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | Cargo.toml | 108 | # Benchmark harness (dev-only). `harness = false` benches drive criterion's own | COMMENT |
| MEDIUM | crates/nub-core/src/version_management/mod.rs | 182 | /// selector keys on Node's `glibcVersionRuntime` (the robust detect-libc signal), | COMMENT |
| MEDIUM | crates/nub-cache-key/Cargo.toml | 3 | # resolved by the Node host at dlopen, so a `cargo test` harness for that crate | COMMENT |
| MEDIUM | crates/nub-json-guard/Cargo.toml | 4 | # `test = false` (a `cargo test` harness cannot link them) — a copy of this | COMMENT |
| MEDIUM | crates/nub-native/Cargo.toml | 118 | # allowed), but a `cargo test` harness is a normal executable and CANNOT link those | COMMENT |
| MEDIUM | crates/nub-cli/tests/integration.rs | 3327 | // Dual-channel doubling regression, tier-robust. On the `nub <file>` path the | COMMENT |
| MEDIUM | crates/nub-cli/tests/integration.rs | 9135 | /// fake shell that prints a marker before delegating to `/bin/sh` — robust across | COMMENT |
| MEDIUM | crates/nub-cli/tests/integration.rs | 9428 | // loading is the robust augmentation discriminator here — flag/preload | COMMENT |
| MEDIUM | tests/bench/install/run-warm-gvs.sh | 106 | # $$ here is the harness PID (constant); $RANDOM varies per --prepare eval. | COMMENT |
| MEDIUM | tests/bench/install/gen-fixtures.sh | 7 | # each bench harness installs from nub.lock — its native lockfile — not the | COMMENT |
| MEDIUM | tests/bench/script-runner/run-vs-node.sh | 20 | # This is a canonical checked-in benchmark harness. By default, result JSON is | COMMENT |
| MEDIUM | tests/bench/bin-runner/run-pure.sh | 10 | # bin-runner sibling of run-script-runner-pure.sh and uses the same harness. | COMMENT |
| MEDIUM | tests/launcher/make-fixture.sh | 59 | # (the harness exercises the RUNTIME heal, independent of postinstall). | COMMENT |
| MEDIUM | tests/launcher/make-fixture.sh | 185 | # failure this harness exists to prevent. | COMMENT |
| MEDIUM | tests/pnpm-conformance/run.sh | 2 | # pnpm conformance harness — run pnpm's OWN black-box CLI test suite against nub. | COMMENT |
| MEDIUM | tests/pnpm-conformance/run.sh | 210 | # Substituting them into the file is the robust seam. `#` is the sed delimiter | COMMENT |
| MEDIUM | tests/pnpm-conformance/run.sh | 258 | # First integer run of `jest --version` (robust to a leading v / extra text). | COMMENT |
| MEDIUM | tests/brand-global/run.sh | 60 | # clean too, then print a single PASS/FAIL line the harness greps. A TS annotation | COMMENT |
| MEDIUM | tests/aube-conformance/run.sh | 2 | # Lockfile conformance harness — nub's embedded aube engine writes each | COMMENT |
| MEDIUM | tests/compile-hide-console/run.sh | 38 | # sets — the flip is byte editing, so the header arms of this harness can be | COMMENT |
| MEDIUM | tests/compile-hide-console/run.sh | 83 | # The deliberate terminal case. Not a defect and not this harness's business to | COMMENT |
| MEDIUM | tests/mutation/run-mutations.sh | 2 | # Lockfile MUTATION differential harness — the write-path counterpart to the | COMMENT |
| MEDIUM | tests/mutation/run-mutations.sh | 111 | # spec file, which is harness metadata, not project content. | COMMENT |
| MEDIUM | tests/native-deps/run.sh | 2 | # Native-dependency floor end-to-end harness. | COMMENT |
| MEDIUM | tests/native-deps/run.sh | 76 | # Copy only the fixture files — not the harness scripts — to avoid | COMMENT |
| MEDIUM | tests/parcel-gvs/make-fixture.sh | 7 | # over-split this harness regression-tests). | COMMENT |
| MEDIUM | tests/parcel-gvs/run.sh | 2 | # Regression harness for the GVS @parcel/core store-dir over-split. | COMMENT |
| MEDIUM | tests/daily-driver/run.sh | 2 | # Real-app daily-loop smoke harness. | COMMENT |
| MEDIUM | tests/node-gyp-headers/run.sh | 2 | # node-gyp header-cache end-to-end harness. | COMMENT |
| MEDIUM | tests/node-gyp-headers/run.sh | 14 | # downloading, and this harness is what says so. | COMMENT |
| MEDIUM | tests/registry-stall/run-stall-matrix.sh | 34 | # A binary that predates the stall bound is the failure mode this harness is | COMMENT |
| MEDIUM | tests/vite-compat/driver.sh | 25 | # Fidelity note: this harness asserts at the HTTP layer — it fetches the REAL | COMMENT |
| MEDIUM | tests/vite-compat/driver.sh | 43 | # the next run then binds a DIFFERENT port while the harness curls the stale | COMMENT |
| MEDIUM | tests/vite-compat/driver.sh | 44 | # (unpatched) server → false 403s. The robust fix is a process GROUP: the dev | COMMENT |
| MEDIUM | tests/conversion/run.sh | 2 | # Cross-format lockfile conversion harness — proves `nub pm use <target>` produces | COMMENT |
| MEDIUM | tests/conversion/run.sh | 10 | # For each (source, target) pair the harness: | COMMENT |
| MEDIUM | tests/compile-corpus/layouts.sh | 185 | # defect for as long as the harness existed: the shared chunks were emitted as | COMMENT |
| MEDIUM | tests/cross-runtime/pty-spawn.py | 7 | # exits with the child's status, because the harness reads exit codes; and it | COMMENT |
| MEDIUM | tests/cross-runtime/pty-spawn.py | 8 | # resolves the command through PATH (execvpe, not execve), because the harness | COMMENT |
| MEDIUM | tests/global-install/run.sh | 49 | # fail, the harness is broken, not the code. `git worktree add` at the | COMMENT |
| MEDIUM | tests/compile-augmentation/run.sh | 39 | # on nub. Naming the suffix here keeps the harness saying what it means. | COMMENT |
| MEDIUM | tests/compile-augmentation/run.sh | 98 | # That is ordering coupling in a shared harness, which is the shape that turns | COMMENT |
| MEDIUM | tests/compile-augmentation/run.sh | 114 | # present wherever this harness is meant to run, and a fixture that quietly | COMMENT |
| MEDIUM | tests/aube-bats/run.sh | 5 | # registry. This harness runs a CURATED subset of those suites with nub's PM | COMMENT |
| MEDIUM | tests/aube-bats/run.sh | 9 | # that exec's nub — so the harness's own PATH prepend resolves straight to | COMMENT |
| MEDIUM | tests/aube-bats/run.sh | 51 | # nothing else is guaranteed to survive the harness's env isolation); | COMMENT |
| MEDIUM | tests/aube-bats/run.sh | 52 | # 2. translate the harness's AUBE_* knobs to their npm_config_* spellings. | COMMENT |
| MEDIUM | tests/installer/run.sh | 6 | # Local end-to-end harness for install.sh. Each case runs the REAL installer | COMMENT |
| MEDIUM | tests/compile-metadata/run.sh | 44 | # resource is written by byte-editing, so the whole harness can be exercised from | COMMENT |
| MEDIUM | tests/conformance/run.sh | 2 | # Drop-in PM conformance harness — proves nub is a true drop-in package manager | COMMENT |
| MEDIUM | tests/conformance/run-pnpm11.sh | 2 | # pnpm-11 conformance leg for the drop-in PM conformance harness. | COMMENT |
| MEDIUM | tests/conformance/frontdoor/run.sh | 9 | # DISTINCT from its two siblings (README.md): the lockfile harness verifies | COMMENT |
| MEDIUM | tests/conformance/frontdoor/run.sh | 10 | # round-trip fidelity; the cmdflag harness verifies every verb runs on one repo; | COMMENT |
| MEDIUM | tests/conformance/frontdoor/run.sh | 23 | set -uo pipefail # NOT -e: a failing cell is data, not a harness abort. | CODE |
| MEDIUM⚡ | tests/conformance/cmdflag/run.sh | 2 | # Command×flag conformance harness — exercise nub's FULL CLI surface against a | COMMENT |
| MEDIUM⚡ | tests/conformance/cmdflag/run.sh | 8 | # DISTINCT from the lockfile harness one level up (tests/conformance/run.sh), | COMMENT |
| MEDIUM⚡ | tests/conformance/cmdflag/run.sh | 17 | # harness operates on COPIES — the fixture is never | COMMENT |
| MEDIUM | tests/conformance/cmdflag/run.sh | 32 | set -uo pipefail # NOT -e: a failing cell is data, not a harness abort. | CODE |
| MEDIUM | tests/conformance/cmdflag/run.sh | 68 | # point of the harness is to cover REAL machine state, not a pristine void. | COMMENT |
| MEDIUM | scripts/check-docs-links.ts | 146 | // Markdown link target: ](...) — the simplest robust form; docs use plain | COMMENT |
| 30 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | crates/nub-cli/tests/init_cmd.rs | 1 | //! `nub init` through the real binary — scaffold contents, refuse-don't- | COMMENT |
| MEDIUM | crates/nub-cli/tests/init_cmd.rs | 3 | //! is offline by construction: scaffold-only cases use `--no-install`, while | COMMENT |
| MEDIUM | crates/nub-cli/tests/init_cmd.rs | 394 | /// `git check-ignore` is the only honest test of a `.gitignore`: the scaffold's | COMMENT |
| MEDIUM | crates/nub-cli/tests/pm_verbs.rs | 975 | /// The scaffold contract itself lives in tests/init_cmd.rs. | COMMENT |
| MEDIUM | crates/nub-cli/src/init.rs | 1 | //! `nub init` — scaffold a minimal modern-TS project (nub's own project init, | COMMENT |
| MEDIUM | crates/nub-cli/src/init.rs | 3 | //! from ENGINE_VERBS). Design record: internal/commands/init.md. The scaffold is | COMMENT |
| MEDIUM⚡ | crates/nub-cli/src/init.rs | 16 | /// `@types/node` range written into the scaffold. Tracks the docs' latest-major | COMMENT |
| MEDIUM⚡ | crates/nub-cli/src/init.rs | 21 | /// Oldest declarations that cover the scaffold's `Worker`-era ambient surface. | COMMENT |
| MEDIUM⚡ | crates/nub-cli/src/init.rs | 27 | /// `typescript` range written into the scaffold. Nub transpiles TS itself, so | COMMENT |
| MEDIUM | crates/nub-cli/src/init.rs | 361 | /// Best-effort `git init` — a missing/failing git degrades the scaffold, it | COMMENT |
| MEDIUM | crates/nub-cli/src/cli.rs | 2971 | // Self-update, the scaffold, and the help pages consume no project | COMMENT |
| MEDIUM | crates/nub-cli/src/cli.rs | 2975 | // scaffold's final cwd. | COMMENT |
| MEDIUM | crates/nub-cli/src/cli.rs | 10361 | // (the same never-scaffold rule write_declared_pm enforces — but only | COMMENT |
| MEDIUM | crates/nub-cli/src/pm_engine/install_family.rs | 1483 | // refuses to scaffold one); the install already succeeded, so this is a | COMMENT |
| MEDIUM | crates/nub-cli/src/pm_engine/install_family.rs | 2493 | /// or scaffold one — the stamp is best-effort and silently no-ops (nub never | COMMENT |
| MEDIUM | crates/nub-cli/src/pm_engine/mod.rs | 290 | // own project scaffold (src/init.rs, a native subcommand), not the engine's | COMMENT |
| MEDIUM | tests/daily-driver/README.md | 35 | # Reuse an existing fixture (skip the scaffold + install for iteration) | COMMENT |
| MEDIUM⚡ | tests/vite-compat/scaffold.sh | 2 | # scaffold.sh — non-interactively scaffold a real Vite-powered project for the | COMMENT |
| MEDIUM⚡ | tests/vite-compat/scaffold.sh | 7 | # Usage: scaffold.sh <case> <dest-dir> | COMMENT |
| MEDIUM⚡ | tests/vite-compat/scaffold.sh | 8 | # Cases print, after scaffolding, two lines the runner consumes: | COMMENT |
| MEDIUM | tests/framework-matrix/frameworks.sh | 10 | # Usage: frameworks.sh scaffold <name> <dest> # scaffolds into <dest>, prints DEV=/BUILD=/PREVIEW=/PROBE=/GVS= | COMMENT |
| MEDIUM | tests/framework-matrix/frameworks.sh | 126 | # Next on the SHARED store: the same create-next-app scaffold (Turbopack on, | COMMENT |
| MEDIUM | tests/framework-matrix/frameworks.sh | 133 | # relocates the store through XDG_CACHE_HOME after scaffolding), mirroring | COMMENT |
| MEDIUM | tests/framework-matrix/matrix.sh | 3 | # scaffold it via its OFFICIAL create-* generator (frameworks.sh), then drive the | COMMENT |
| MEDIUM | wiki/research/upstream-cpp-resolver-prs.md | 30 | - **#61548** (joyeecheung, merged Feb 2026) — "src: initial support for ESM in embedder API." Adds `ModuleData`, `Module | CODE |
| MEDIUM | wiki/research/gvs-in-ci.md | 52 | So the divergence question inverts: Nub is not diverging from the norm by gating GVS in CI — Nub diverged by making GVS | CODE |
| MEDIUM | wiki/research/workspace-discovery-walk-up.md | 19 | ## (1) Test scaffold | COMMENT |
| MEDIUM | benchmarks/README.md | 32 | # Script runner overhead (pure orchestration) | COMMENT |
| MEDIUM | .github/workflows/release.yml | 1084 | # writes both literals into the `nub init` scaffold, so they sit in every | COMMENT |
| MEDIUM | site/public/skill.md | 76 | nub run --node test # nub's CLI orchestration, runtime augmentation off | CODE |
| MEDIUM | skills/nub/SKILL.md | 76 | nub run --node test # nub's CLI orchestration, runtime augmentation off | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/bench/install/cold-cas.sh | 34 | # Usage: | COMMENT |
| LOW | tests/bench/install/run.sh | 5 | # Usage: | COMMENT |
| LOW | tests/bench/install/run-4way.sh | 10 | # Usage: | COMMENT |
| LOW | tests/pnpm-conformance/run.sh | 11 | # Usage: | COMMENT |
| LOW | tests/vm/tart-vm.sh | 13 | # Usage: | COMMENT |
| LOW | tests/pnp/run-pnp-matrix.sh | 17 | # Usage: | COMMENT |
| LOW | tests/conformance/run-pnpm11.sh | 23 | # Usage: | COMMENT |
| LOW | scripts/check-lockfiles.sh | 4 | # Usage: | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | crates/nub-core/src/pm/lockfile_version.rs | 256 | let berry = "# This file is generated by running \"yarn install\".\n\n\ | CODE |
| MEDIUM | crates/nub-launcher/.cargo/config.toml | 13 | # This file is the ONLY copy, and it lives here rather than at the repo root on purpose. | COMMENT |
| MEDIUM | .github/workflows/release.yml | 597 | # This file is what makes the corpus DOWNLOAD-RANKED rather than the | COMMENT |
| MEDIUM | .github/workflows/release.yml | 2041 | # Create the exact versioned release and verify its complete 32-asset set | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/worker-wpt/wpt/resources/testharness.js | 338 | function DedicatedWorkerTestEnvironment() { | CODE |
| LOW | tests/worker-wpt/wpt/resources/testharness.js | 361 | function SharedWorkerTestEnvironment() { | CODE |
| LOW | tests/worker-wpt/wpt/resources/testharness.js | 387 | function ServiceWorkerTestEnvironment() { | CODE |
| LOW | tests/worker-wpt/wpt/resources/testharness.js | 439 | function ShadowRealmTestEnvironment() { | CODE |
| LOW | tests/worker-wpt/wpt/resources/testharness.js | 4839 | function OptionalFeatureUnsupportedError(message) | CODE |
| LOW | …red-clone/structured-clone-battery-of-tests-harness.js | 16 | function runStructuredCloneBatteryOfTests(runner) { | CODE |
| LOW | …skills/cpu-reduction/scripts/clean-worktree-targets.py | 100 | def owns_installed_dev_binary(path: Path, binaries: list[Path]) -> bool: | CODE |
| LOW | wiki/research/store-marker-hardcoding.md | 18 | function getProjectRootDirectoryFromNodeModules(projectPath) { | CODE |
| LOW | wiki/research/node-strip-types-interaction.md | 29 | function initializeExtensionFormatMap() { | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | install.sh | 331 | # Check if already in PATH | COMMENT |
| LOW | setup-node/scripts/install.sh | 333 | # Check if already in PATH | COMMENT |
| LOW | site/public/install.sh | 331 | # Check if already in PATH | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | scripts/remote-build.ts | 461 | [ -s runtime/addons/nub-native.node ] || printf 'placeholder' > runtime/addons/nub-native.node | CODE |
| LOW | scripts/remote-build.ts | 883 | mkdir -p runtime/addons && printf 'placeholder' > runtime/addons/nub-native.node | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …skills/cpu-reduction/scripts/clean-worktree-targets.py | 4 | CODE |