3.1

Adjusted Signal

3.1

Raw Pattern Score

100%

Time Factor

2026-10-31

Last Push

37.0K

Stars

Rust

Language

1.7M

Lines of Code

9.1K

Files

4.2K

Pattern Hits

2026-10-31

Scan Date

0.01

HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 11.8/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 4021 finding(s).

Hallucinated Dependency & Supply Chain Risk 3.0/100 · LOW

Are imports declared and package/API names verified? 188 finding(s).

Agent Over-Engineering Ratio 4.4/100 · LOW

Are wrappers, guards, and repeated structures necessary? 1464 finding(s).

PR Review Velocity Impact 14.3/100 · LOW

Which changes need focused human review? 4219 finding(s).

What These Metrics Mean

Adjusted Signal: Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score: Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor: A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits: Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate: High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files: Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 83HIGH 10MEDIUM 53LOW 4073

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 4219 distinct pattern matches across 17 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Over-Commented Block2458 hits · 2420 pts

Severity	File	Line	Snippet	Context
LOW	Cargo.toml	281	mockito = { version = "1.7.2" }	COMMENT
LOW	deny.toml	21	unmaintained = "workspace"	COMMENT
LOW	deny.toml	41	# cargo-deny scopes an ignore to an advisory id, never to a version, so this	COMMENT
LOW	rustfmt.toml	1	# Make Rust more readable given most people have wide screens nowadays.	COMMENT
LOW	Cross.toml	1	# Image overrides for `cross`. Every other release target builds in the image	COMMENT
LOW	.pr_agent.toml	41	# the /improve tool (see pr_commands and push_commands), so approval is re-checked	COMMENT
LOW	dylint.toml	1	# Dylint configuration. cargo-dylint reads `[workspace.metadata.dylint]`	COMMENT
LOW	dylint.toml	21	# to a `let` internally before the match, so the expression is	COMMENT
LOW	pnpm-workspace.yaml	101	# @pnpm/logger is a workspace package, but every consumer depends on the	COMMENT
LOW	.config/nextest.toml	1	# Workspace-wide cargo-nextest configuration (pacquet and pnpr).	COMMENT
LOW	.config/nextest.toml	21	slow-timeout = { period = "120s", terminate-after = 5 }	COMMENT
LOW	.config/pnpm/policies.yaml	21	# GHSA-h67p-54hq-rp68: js-yaml quadratic-complexity DoS in merge key handling.	COMMENT
LOW	…lling/deps-resolver/test/resolveDependencyTree.test.ts	201	const exactResolution = tResolutions.find(({ bareSpecifier }) => bareSpecifier === '1.0.0')	COMMENT
LOW	…/installing/deps-resolver/src/linkPathToPeerVersion.ts	1	// Converts a link: path into a stable, filename-safe token used as the	COMMENT
LOW	pnpm11/installing/deps-resolver/src/hoistPeers.ts	141	function pickPreferredPeerSpec (	COMMENT
LOW	pnpm11/installing/deps-installer/test/catalogs.ts	881	catalogs: { default: { '@pnpm.test/is-positive-alias': { specifier: 'npm:is-positive@1.0.0', version: '1.0.0' } } },	COMMENT
LOW	pnpm11/installing/deps-installer/test/catalogs.ts	961	//	COMMENT
LOW	…est/install/injectWorkspacePackagesPersistence.test.ts	361		COMMENT
LOW	…est/install/injectWorkspacePackagesPersistence.test.ts	481	expect(lockfileAfterUpdate.importers['.'].devDependencies!.winston.version).toBe('3.19.0')	COMMENT
LOW	…eps-installer/src/install/verifyLockfileResolutions.ts	21		COMMENT
LOW	…eps-installer/src/install/verifyLockfileResolutions.ts	421	// `react@18.0.0(peer)(patch_hash=...)`); the same (name, version) pair may	COMMENT
LOW	pnpm11/installing/commands/src/runPacquet.ts	141	}	COMMENT
LOW	pnpm11/config/reader/src/rescopeUnscopedCreds.ts	1	import { nerfDart } from '@pnpm/config.registry-auth-key'	COMMENT
LOW	pnpm11/config/reader/src/rescopeUnscopedCreds.ts	21	// in the first place — only the URL-scoped `//host/:certfile=...` and	COMMENT
LOW	pnpm11/config/reader/src/loadNpmrcFiles.ts	261	}	COMMENT
LOW	pnpm11/__fixtures__/pnpm-workspace.yaml	21	sharedWorkspaceLockfile: false	COMMENT
LOW	…ures__/multiple-scripts-error-exit/pnpm-workspace.yaml	1	# This fixture exercises child-process cleanup when `pnpm run` exits, not	COMMENT
LOW	pnpm11/resolving/local-resolver/README.md	21	resolveFromLocal({bareSpecifier: './example-package'}, {prefix: process.cwd()})	COMMENT
LOW	pnpm11/resolving/npm-resolver/README.md	41	// "ava": "^0.0.4"	COMMENT
LOW	pnpm11/resolving/npm-resolver/test/publishedBy.test.ts	581	expect(resolveResult!.resolvedVia).toBe('npm-registry')	COMMENT
LOW	pnpm11/resolving/npm-resolver/src/releaseAgeUpgrade.ts	21	}	COMMENT
LOW	pnpm11/workspace/projects-graph/README.md	41	// dependencies: ['/home/zkochan/src/bar'],	COMMENT
LOW	…11/workspace/workspace-manifest-writer/src/keyOrder.ts	21	}	COMMENT
LOW	pnpm11/__typings__/index.d.ts	1	/// <reference path="local.d.ts" />	COMMENT
LOW	pnpm11/pnpm/bundle-deps.ts	1	import fs from 'node:fs'	COMMENT
LOW	pnpm11/pnpm/bundle-deps.ts	21	// This is used to include certain dependencies like node-gyp out of the box	COMMENT
LOW	pnpm11/pnpm/bundle-deps.ts	41	// │ └── pnpm-workspace.yaml │	COMMENT
LOW	pnpm11/pnpm/bundle-deps.ts	121	}	COMMENT
LOW	pnpm11/pnpm/artifacts/exe/prepare.js	21	// relative to the script: a `PATH` lookup would run whatever other pnpm comes	COMMENT
LOW	pnpm11/pnpm/artifacts/exe/setup.js	21	const platform = process.platform	COMMENT
LOW	pnpm11/pnpm/artifacts/exe/setup.js	61	if (platform === 'win32') {	COMMENT
LOW	pnpm11/pnpm/artifacts/exe/scripts/build-artifacts.ts	1	import fs from 'node:fs'	COMMENT
LOW	pnpm11/cli/default-reporter/src/liveOutput.ts	101	* The text that updates the terminal from the previous view to `view`.	COMMENT
LOW	…er/src/reporterForClient/reportLockfileVerification.ts	61	// time is clamped at zero so a clock that moved backwards between the	COMMENT
LOW	pnpm11/benchmarks/bench.sh	1	#!/bin/bash	COMMENT
LOW	…config/perfectionist/excessive-cognitive-complexity.js	1	import { describeFunction, functionHeadLoc, functionName, isChainedTernary, isElseIf, trackMeasuredBodies } from './func	COMMENT
LOW	pnpm11/__utils__/scripts/src/bump.ts	1	// Applies the pending release plan, then runs the meta-updater to mirror the	COMMENT
LOW	pnpm11/__utils__/jest-config/jest.transform.js	21	})	COMMENT
LOW	pnpm11/exec/commands/test/dlx.e2e.ts	441	expect(fs.existsSync(path.join(builtPkg2Path, 'generated-by-install.js'))).toBeTruthy()	COMMENT
LOW	pnpm11/deps/status/src/modifiedAtOrAfter.ts	1	import type fs from 'node:fs'	COMMENT
LOW	pnpm11/deps/compliance/sbom/src/license.ts	1	// Sub-path import to pull only the SPDX module — avoids dragging in the	COMMENT
LOW	pnpm11/deps/compliance/audit/src/walkForPaths.ts	41	// added when its node is opened and removed when the frame is unwound, so the	COMMENT
LOW	pnpm11/deps/compliance/audit/src/dependencyEdges.ts	41	appendNamedDepPaths(children, parent.snapshot.dependencies ?? {}, isSkipped)	COMMENT
LOW	…pm11/deps/inspection/tree-builder/test/getTree.test.ts	241	// The "once" package is seen again at depth 1. The "once"	COMMENT
LOW	…pm11/deps/inspection/tree-builder/test/getTree.test.ts	481	}),	COMMENT
LOW	pnpm11/deps/inspection/outdated/src/outdated.ts	301	function isEmpty (obj: object): boolean {	COMMENT
LOW	pnpm11/fs/symlink-dependency/src/safeJoinModulesDir.ts	1	import fs from 'node:fs'	COMMENT
LOW	…leasing/commands/test/publish/oidcOrchestrator.test.ts	1	import { afterAll, afterEach, beforeAll, beforeEach, describe, expect, jest, test } from '@jest/globals'	COMMENT
LOW	pnpm11/releasing/commands/src/deploy/deploy.ts	161	// deployed dir to their original (non-deployed) directory in an attempt to	COMMENT
LOW	pnpm11/releasing/commands/src/deploy/deploy.ts	181	// foo:	COMMENT
2398 more matches not shown…

Hyper-Verbose Identifiers1454 hits · 1472 pts

Severity	File	Line	Snippet	Context
LOW	pnpm11/crypto/object-hasher/src/index.ts	44	export function hashObjectNullableWithPrefix (object: Record<string, unknown> \| undefined): PrefixedHash \| undefined {	CODE
LOW	pnpm11/crypto/shasums-file/src/index.ts	34	export async function fetchVerifiedNodeShasumsFile (	CODE
LOW	pnpm11/crypto/shasums-file/src/index.ts	60	export async function fetchVerifiedNodeShasumsFileCached (	CODE
LOW	pnpm11/crypto/shasums-file/src/index.ts	147	export function pickFileChecksumFromShasumsFile (body: string, fileName: string): string {	CODE
LOW	pnpm11/crypto/shasums-file/src/verifyNodeShasums.ts	58	export async function fetchVerifiedNodeShasumsWithSignature (	CODE
LOW	pnpm11/crypto/shasums-file/src/verifyNodeShasums.ts	85	export async function nodeShasumsSignatureVerifies (	CODE
LOW	pnpm11/crypto/hash/src/index.ts	18	export async function createHashFromMultipleFiles (files: string[]): Promise<string> {	CODE
LOW	pnpm11/registry-access/commands/src/unpublish.ts	219	function removeVersionsFromPackument (pkg: PackumentResponse, versions: string[]): string[] {	CODE
LOW	pnpm11/registry-access/commands/src/accessRequest.ts	31	export function createPackageRequestContext (opts: AccessOptions, packageName: string): PackageRequestContext {	CODE
LOW	pnpm11/core/error/src/index.ts	215	export function redactAndSanitizeMultiline (text: string): string {	CODE
LOW	pnpm11/core/error/src/index.ts	229	function sanitizeControlCharacters (text: string): string {	CODE
LOW	pnpm11/cache/api/src/cacheView.ts	59	function partitionVersionsByStorePresence (	CODE
LOW	…lling/deps-resolver/test/updateProjectManifest.test.ts	407	function aliaslessWantedDependency (bareSpecifier: string, optional = false): WantedDependency {	CODE
LOW	…lling/deps-resolver/test/resolveDependencyTree.test.ts	436	function createLockfileWithTPinning (): LockfileObject {	CODE
LOW	pnpm11/installing/deps-resolver/src/resolvedPackage.ts	131	export function detectNamedRegistryCollision (	CODE
LOW	…pm11/installing/deps-resolver/src/findStalePeerPins.ts	18	export function collectDirectDependencySpecs (	CODE
LOW	…pm11/installing/deps-resolver/src/findStalePeerPins.ts	80	function isAutoInstalledPeerWithRange (	CODE
LOW	…m11/installing/deps-resolver/src/dependencyManifest.ts	20	export function prepareDependencyManifest (pkg: PackageManifest, ctx: DependencyManifestContext): PackageManifest {	CODE
LOW	…m11/installing/deps-resolver/src/dependencyManifest.ts	28	function omitPeersFromDependencies (pkg: PackageManifest, ctx: DependencyManifestContext): PackageManifest {	CODE
LOW	…talling/deps-resolver/src/indexResolvedDependencies.ts	24	export function collectResolvedDependencies (resolvedDependencies: ResolveDependenciesOfDependency[]): CollectedDependen	CODE
LOW	…talling/deps-resolver/src/indexResolvedDependencies.ts	64	export function indexResolvedDependencies (	CODE
LOW	…talling/deps-resolver/src/indexResolvedDependencies.ts	98	function addPreferredVersionSelector (	CODE
LOW	…ng/deps-resolver/src/resolveDependenciesOfImporters.ts	22	export async function resolveDependenciesOfImporters (	CODE
LOW	…ng/deps-resolver/src/resolveDependenciesOfImporters.ts	43	async function resolveDirectDependenciesOfImporter (	CODE
LOW	…ng/deps-resolver/src/resolveDependenciesOfImporters.ts	83	async function resolveSubdependenciesOfImporter (	CODE
LOW	…ng/deps-resolver/src/resolveDependenciesOfImporters.ts	137	async function resolveDependenciesOfImporterDependency (	CODE
LOW	…ng/deps-resolver/src/resolveDependenciesOfImporters.ts	190	function isExplicitDistTagSpecifier (bareSpecifier: string \| undefined): boolean {	CODE
LOW	pnpm11/installing/deps-resolver/src/missingPeers.ts	38	export function collectMissingRequiredPeers (	CODE
LOW	pnpm11/installing/deps-resolver/src/missingPeers.ts	85	function findRequestsOfPeerNotProvidedByParent (	CODE
LOW	pnpm11/installing/deps-resolver/src/missingPeers.ts	109	export function filterMissingPeersFromPkgAddresses (	CODE
LOW	…/installing/deps-resolver/src/linkPathToPeerVersion.ts	57	function findEndWithoutTrailingPlusesAndDots (out: string): number {	CODE
LOW	…/installing/deps-resolver/src/resolveDependencyTree.ts	384	function dedupeSameAliasDirectDeps (directDeps: PkgAddressOrLink[], wantedDependencies: WantedDependency[]): PkgAddressO	CODE
LOW	…m11/installing/deps-resolver/src/lookUpCatalogEntry.ts	24	export function getCatalogExistingVersionFromSnapshot (	CODE
LOW	…11/installing/deps-resolver/src/getCatalogSnapshots.ts	37	export function addCatalogEntriesOfImporters (	CODE
LOW	…installing/deps-resolver/src/optionalPeerCandidates.ts	45	export function createCandidatePeerRangesLookup (	CODE
LOW	…installing/deps-resolver/src/optionalPeerCandidates.ts	58	function indexPeerRangesByNameVersion (	CODE
LOW	…installing/deps-resolver/src/optionalPeerCandidates.ts	84	export function peersAcceptProvidedVersions (	CODE
LOW	…pm11/installing/deps-resolver/src/hoistableRootDeps.ts	61	function isProjectRelativeSpecifier (bareSpecifier: string): boolean {	CODE
LOW	…pm11/installing/deps-resolver/src/hoistableRootDeps.ts	75	async function pinProjectRelativeDepToItsVersion (	CODE
LOW	…pm11/installing/deps-resolver/src/hoistableRootDeps.ts	93	async function readManifestOfLocalTarget (dir: string): Promise<PackageManifest \| null> {	CODE
LOW	…lling/deps-resolver/src/wantedDepIsLocallyAvailable.ts	7	export function wantedDepIsLocallyAvailable (	CODE
LOW	…m11/installing/deps-resolver/src/childrenResolution.ts	54	function takeOverChildrenResolution (	CODE
LOW	…m11/installing/deps-resolver/src/childrenResolution.ts	87	function forwardMissingPeersOfChildren (	CODE
LOW	…m11/installing/deps-resolver/src/childrenResolution.ts	102	function canReuseMissingPeersOfChildren (	CODE
LOW	…m11/installing/deps-resolver/src/childrenResolution.ts	121	function compareChildrenResolutionOwners (owner1: ChildrenResolutionOwner, owner2: ChildrenResolutionOwner): number {	CODE
LOW⚡	…m11/installing/deps-resolver/src/childrenResolution.ts	132	function createMissingPeersOfChildren (): MissingPeersOfChildren {	CODE
LOW⚡	…m11/installing/deps-resolver/src/childrenResolution.ts	141	export function isCurrentChildrenResolution (	CODE
LOW⚡	…m11/installing/deps-resolver/src/childrenResolution.ts	149	export async function resolveMissingPeersFromCurrentChildrenResolution (	CODE
LOW	…m11/installing/deps-resolver/src/childrenResolution.ts	165	export function setDependencyTreeNodeWithCurrentChildren (	CODE
LOW	…m11/installing/deps-resolver/src/childrenResolution.ts	193	export function updateChildrenResolutionNodes (	CODE
LOW	…nstalling/deps-resolver/src/resolveRootDependencies.ts	119	async function hoistRequiredPeersOfImporter (hoisting: PeerHoisting, index: number): Promise<MissingOptionalPeerRanges>	CODE
LOW	…nstalling/deps-resolver/src/resolveRootDependencies.ts	139	function createImporterPeersHoister (hoisting: PeerHoisting, index: number): (missingRequiredPeers: Array<[string, Missi	CODE
LOW	…nstalling/deps-resolver/src/resolveRootDependencies.ts	162	function collectMissingPeersOfImporter (	CODE
LOW	…nstalling/deps-resolver/src/resolveRootDependencies.ts	233	async function resolveHoistedDependencies (	CODE
LOW	…nstalling/deps-resolver/src/resolveRootDependencies.ts	265	async function hoistOptionalPeersOfImporters (	CODE
LOW	…nstalling/deps-resolver/src/resolveRootDependencies.ts	297	async function hoistOptionalPeersOfImporter (	CODE
LOW	…nstalling/deps-resolver/src/resolveRootDependencies.ts	341	function getHoistedPeersUpdateDepth ({ options, wantedDependencies }: ImporterToResolve): number {	CODE
LOW	…nstalling/deps-resolver/src/resolveRootDependencies.ts	353	function getLockedPeerVersionsOfImporter (hoisting: PeerHoisting, index: number): Map<string, Set<string>> {	CODE
LOW	…pm11/installing/deps-resolver/src/findPeersCacheHit.ts	124	function parentPkgsHaveSingleOccurrence (parentPkgs: Record<string, ParentPkgInfo>): boolean {	CODE
LOW	…nstalling/deps-resolver/src/validateDependencyAlias.ts	15	export function assertValidDependencyAliases (	CODE
1394 more matches not shown…

Hallucination Indicators83 hits · 850 pts

Severity	File	Line	Snippet	Context
CRITICAL	…ckage-manager/src/install/run/frozen_local_tarballs.rs	128	let workspace_root = settled.projects.workspace.dirs.workspace_root.clone();	CODE
CRITICAL	…resolving-deps-resolver/src/resolve_dependency_tree.rs	581	ctx.options.base.version.preferred_versions_overlay.clone(),	CODE
CRITICAL	…-deps-resolver/src/resolve_dependency_tree/manifest.rs	114	pnpm_fs::lexical_normalize(&ctx.options.base.project.project_dir.join(target))	CODE
CRITICAL	…-deps-resolver/src/resolve_dependency_tree/manifest.rs	334	prefix: ctx.options.base.project.project_dir.display().to_string(),	CODE
CRITICAL	…-resolver/src/resolve_dependency_tree/reuse/subtree.rs	169	if self.ctx.workspace.reuse.dedupe.covers(&name, key.suffix.version_semver())	CODE
CRITICAL	…-resolver/src/resolve_dependency_tree/reuse/subtree.rs	170	\|\| self.ctx.workspace.cache.registry_context.moved_registry(key).is_some()	CODE
CRITICAL	…r/src/resolve_dependency_tree/reuse/direct_versions.rs	345	pick_overlay: ctx.options.base.version.preferred_versions_overlay.clone(),	CODE
CRITICAL	…src/resolve_dependency_tree/reuse/snapshot_children.rs	86	let base_overlay = ctx.options.base.version.preferred_versions_overlay.clone();	CODE
CRITICAL	…ver/src/resolve_dependency_tree/walk/manifest_hooks.rs	12	let Some(hook) = ctx.workspace.hooks.manifests.pnpmfile_hook.as_ref() else {	CODE
CRITICAL	…lver/src/resolve_dependency_tree/walk/warm_children.rs	41	if ctx.workspace.hooks.manifests.pnpmfile_hook.is_some() {	CODE
CRITICAL	pnpm/crates/python-installer/src/manifest/selection.rs	80	let explicit = self.tool.pnpm.python.extras.as_ref();	CODE
CRITICAL	pnpm/crates/python-installer/src/manifest/selection.rs	99	let explicit = self.tool.pnpm.python.groups.as_ref();	CODE
CRITICAL⚡	pnpr/crates/config/src/tests/access.rs	30	config.identity.auth.htpasswd.file.as_deref(),	CODE
CRITICAL⚡	pnpr/crates/config/src/tests/access.rs	34	assert_eq!(config.identity.auth.tokens.file.as_deref(), Some(Path::new("/etc/pnpr/tokens.db")));	CODE
CRITICAL⚡	pnpr/crates/config/src/tests/access.rs	41	assert!(config.identity.auth.htpasswd.file.is_none());	CODE
CRITICAL⚡	pnpr/crates/config/src/tests/access.rs	42	assert!(config.identity.auth.tokens.file.is_none());	CODE
CRITICAL	pnpr/crates/config/src/tests/access.rs	71	config.identity.auth.tokens.file.as_deref(),	CODE
CRITICAL	pnpr/crates/pnpr/src/export.rs	178	if let Some(ht_path) = config.identity.auth.htpasswd.file.as_deref().filter(\|p\| p.exists()) {	CODE
CRITICAL	pnpr/crates/pnpr/src/export.rs	182	if let Some(tok_path) = config.identity.auth.tokens.file.as_deref().filter(\|p\| p.exists()) {	CODE
CRITICAL	pnpr/crates/pnpr/src/cli_commands.rs	257	let target = target.or_else(\|\| config.identity.auth.htpasswd.file.clone());	CODE
CRITICAL	pnpr/crates/pnpr/src/cli_commands.rs	360	&& config.identity.auth.htpasswd.file.is_none()	CODE
CRITICAL	pnpr/crates/pnpr/src/main.rs	136	if config.identity.auth.htpasswd.file.is_some() {	CODE
CRITICAL	pnpr/crates/pnpr/src/main.rs	139	if config.identity.auth.tokens.file.is_some() {	CODE
CRITICAL	pnpr/crates/pnpr/src/server/team_rosters.rs	81	if let Some(hosted) = state.inner.config.routing.hosted.get(registry) {	CODE
CRITICAL	pnpr/crates/pnpr/src/server/tokens.rs	116	match state.inner.identity.auth.tokens.issue_token(&username, new_token).await {	CODE
CRITICAL	pnpr/crates/pnpr/src/server/tokens.rs	224	if let Some(hash) = state.inner.identity.auth.users.password_hash(username).await? {	CODE
CRITICAL	pnpr/crates/pnpr/src/server/tokens.rs	275	let tokens = match state.inner.identity.auth.tokens.list_for_user(&username).await {	CODE
CRITICAL	pnpr/crates/pnpr/src/server/tokens.rs	295	match state.inner.identity.auth.tokens.find_by_key(key).await {	CODE
CRITICAL	pnpr/crates/pnpr/src/server/tokens.rs	302	Ok(Some(_)) => match state.inner.identity.auth.tokens.revoke_by_key(key).await {	CODE
CRITICAL	pnpr/crates/pnpr/src/server/tokens.rs	343	let target_owner = match state.inner.identity.auth.tokens.lookup(raw_token).await {	CODE
CRITICAL	pnpr/crates/pnpr/src/server/tokens.rs	356	match state.inner.identity.auth.tokens.revoke_by_raw(raw_token).await {	CODE
CRITICAL	pnpr/crates/pnpr/src/server/managed_state.rs	128	let ecosystem = state.inner.config.routing.registries.ecosystem(registry).unwrap_or_default();	CODE
CRITICAL	pnpr/crates/pnpr/src/server/package_search.rs	227	let Some(config) = state.inner.config.routing.upstreams.get(search.source) else {	CODE
CRITICAL	pnpr/crates/pnpr/src/server/package_search.rs	270	let Some(hosted) = state.inner.config.routing.hosted.get(source) else {	CODE
CRITICAL	pnpr/crates/pnpr/src/server/user_admin.rs	58	let names = state.inner.identity.auth.users.list_users().await?;	CODE
CRITICAL	pnpr/crates/pnpr/src/server/user_admin.rs	112	let removed = state.inner.identity.auth.users.delete_user(&path.user).await?;	CODE
CRITICAL	pnpr/crates/pnpr/src/server/user_admin.rs	148	let tokens = state.inner.identity.auth.tokens.list_for_user(&path.user).await?;	CODE
CRITICAL	pnpr/crates/pnpr/src/server/request_access.rs	20	let Some(config) = state.inner.config.routing.upstreams.get(upstream) else {	CODE
CRITICAL	pnpr/crates/pnpr/src/server/request_access.rs	41	state.inner.config.routing.upstreams.get(source).map(\|config\| config.url.as_str())	CODE
CRITICAL	pnpr/crates/pnpr/src/server/request_access.rs	148	_ => identify(authorization, state.inner.identity.auth.tokens.as_ref()).await?,	CODE
CRITICAL	pnpr/crates/pnpr/src/server/package_reads.rs	172	state.inner.config.routing.registries.default_for(ecosystem).map(str::to_string)	CODE
CRITICAL	pnpr/crates/pnpr/src/server/package_reads.rs	192	match state.inner.config.routing.registries.resolve(registry, ecosystem, package) {	CODE
CRITICAL	pnpr/crates/pnpr/src/server/package_reads.rs	375	let Some(hosted) = state.inner.config.routing.hosted.get(source) else {	CODE
CRITICAL	pnpr/crates/pnpr/src/server/package_reads.rs	432	let max_age = state.inner.config.http.packument_ttl.as_secs();	CODE
CRITICAL	pnpr/crates/pnpr/src/server/rule_overrides.rs	96	let Some(base) = state.inner.identity.managed.rule_bases.get(registry) else {	CODE
CRITICAL	pnpr/crates/pnpr/src/server/rule_overrides.rs	161	state.inner.config.routing.registries.ecosystem(registry).unwrap_or_default();	CODE
CRITICAL	pnpr/crates/pnpr/src/server/rule_overrides.rs	208	if let Some(hosted) = state.inner.config.routing.hosted.get(registry) {	CODE
CRITICAL	pnpr/crates/pnpr/src/server/rule_overrides.rs	252	let ecosystem = state.inner.config.routing.registries.ecosystem(registry).unwrap_or_default();	CODE
CRITICAL	pnpr/crates/pnpr/src/server/pypi.rs	165	let Some(hosted) = state.inner.config.routing.hosted.get(&source) else { continue };	CODE
CRITICAL	pnpr/crates/pnpr/src/server/ecosystem.rs	37	state.inner.config.routing.registries.addressed(name, ecosystem).map(str::to_string)	CODE
CRITICAL	pnpr/crates/pnpr/src/server/ecosystem.rs	61	let public_url = state.inner.config.http.public_url.trim_end_matches('/');	CODE
CRITICAL	pnpr/crates/pnpr/src/server/organizations.rs	75	let Some(hosted) = state.inner.config.routing.hosted.get(scan.source) else {	CODE
CRITICAL	pnpr/crates/pnpr/src/server/organizations.rs	120	let Some(config) = state.inner.config.routing.upstreams.get(scan.source) else {	CODE
CRITICAL	pnpr/crates/pnpr/src/server/organizations.rs	199	let Some((name, hosted)) = state.inner.config.routing.hosted.get_key_value(&source) else {	CODE
CRITICAL	pnpr/crates/pnpr/src/server/authentication.rs	281	if let Some(record) = state.inner.identity.auth.tokens.lookup_record(&raw_token).await? {	CODE
CRITICAL	pnpr/crates/pnpr/src/server/authentication.rs	332	state.inner.config.routing.hosted.get(name).map(\|hosted\| &hosted.rules)	CODE
CRITICAL	pnpr/crates/pnpr/src/server/authentication.rs	335	state.inner.config.routing.upstreams.get(name).map(\|upstream\| &upstream.rules)	CODE
CRITICAL	pnpr/crates/pnpr/src/server/authentication.rs	391	if state.inner.config.identity.admins.contains(username) {	CODE
CRITICAL	pnpr/crates/pnpr/src/server/routing.rs	228	if state.inner.config.identity.auth.scim.is_some() {	CODE
CRITICAL	pnpr/crates/pnpr/src/server/lifecycle.rs	120	let Some(listen) = state.inner.config.http.metrics.as_ref().and_then(\|metrics\| metrics.listen)	CODE
23 more matches not shown…

Fake / Example Data99 hits · 102 pts

Severity	File	Line	Snippet	Context
LOW	…alling/deps-installer/test/install/lifecycleScripts.ts	1237	tool: { content: '#!/usr/bin/env node\nconsole.log("placeholder")\n', mode: 0o755 },	CODE
LOW	…lling/deps-installer/test/install/packageExtensions.ts	615	fs.writeFileSync(tarballPath, createTarGz([{ name: 'package/README.md', content: 'placeholder' }]))	CODE
LOW	pnpm11/installing/deps-installer/test/install/auth.ts	80	email: 'foo@bar.com',	CODE
LOW	pnpm11/installing/deps-installer/test/install/auth.ts	138	email: 'foo@bar.com',	CODE
LOW	pnpm11/installing/deps-installer/test/install/auth.ts	230	email: 'foo@bar.com',	CODE
LOW	pnpm11/installing/deps-installer/test/install/auth.ts	256	email: 'foo@bar.com',	CODE
LOW⚡	pnpm11/config/reader/test/env.test.ts	122	HOME: '/home/fake-user',	CODE
LOW⚡	pnpm11/config/reader/test/env.test.ts	123	PATH: '/bin:/usr/bin:/usr/local/bin:/home/fake-user/.bin:/home/fake-user/share/local/bin',	CODE
LOW⚡	pnpm11/config/reader/test/env.test.ts	130	bar: path.join('/home/fake-user', 'abc/def/ghi'),	CODE
LOW⚡	pnpm11/config/reader/test/env.test.ts	131	baz: path.join('/home/fake-user', 'abc\\def\\ghi'),	CODE
LOW	pnpm11/config/reader/test/env.test.ts	31	HOME: '/home/fake-user',	CODE
LOW	pnpm11/config/reader/test/env.test.ts	32	PATH: '/bin:/usr/bin:/usr/local/bin:/home/fake-user/.bin:/home/fake-user/share/local/bin',	CODE
LOW	pnpm11/config/reader/test/env.test.ts	46	HOME: '/home/fake-user',	CODE
LOW	pnpm11/config/reader/test/env.test.ts	47	PATH: '/bin:/usr/bin:/usr/local/bin:/home/fake-user/.bin:/home/fake-user/share/local/bin',	CODE
LOW	pnpm11/config/reader/test/env.test.ts	61	HOME: '/home/fake-user',	CODE
LOW	pnpm11/config/reader/test/env.test.ts	62	PATH: '/bin:/usr/bin:/usr/local/bin:/home/fake-user/.bin:/home/fake-user/share/local/bin',	CODE
LOW	pnpm11/config/reader/test/env.test.ts	76	HOME: '/home/fake-user',	CODE
LOW	pnpm11/config/reader/test/env.test.ts	77	PATH: '/bin:/usr/bin:/usr/local/bin:/home/fake-user/.bin:/home/fake-user/share/local/bin',	CODE
LOW	pnpm11/config/reader/test/env.test.ts	91	HOME: '/home/fake-user',	CODE
LOW	pnpm11/config/reader/test/env.test.ts	92	PATH: '/bin:/usr/bin:/usr/local/bin:/home/fake-user/.bin:/home/fake-user/share/local/bin',	CODE
LOW	pnpm11/config/reader/test/env.test.ts	148	HOME: '/home/fake-user',	CODE
LOW	pnpm11/config/reader/test/env.test.ts	149	PATH: '/bin:/usr/bin:/usr/local/bin:/home/fake-user/.bin:/home/fake-user/share/local/bin',	CODE
LOW	pnpm11/config/reader/test/env.test.ts	165	HOME: '/home/fake-user',	CODE
LOW	pnpm11/config/reader/test/env.test.ts	166	PATH: '/bin:/usr/bin:/usr/local/bin:/home/fake-user/.bin:/home/fake-user/share/local/bin',	CODE
LOW	pnpm11/config/reader/test/env.test.ts	185	HOME: '/home/fake-user',	CODE
LOW	pnpm11/config/reader/test/env.test.ts	186	PATH: '/bin:/usr/bin:/usr/local/bin:/home/fake-user/.bin:/home/fake-user/share/local/bin',	CODE
LOW	pnpm11/config/reader/test/env.test.ts	205	HOME: '/home/fake-user',	CODE
LOW	pnpm11/config/reader/test/env.test.ts	206	PATH: '/bin:/usr/bin:/usr/local/bin:/home/fake-user/.bin:/home/fake-user/share/local/bin',	CODE
LOW	pnpm11/config/reader/test/index.ts	5266	test.each([undefined, '', 'dummy-token'])('expanded .npmrc auth key warning for %p', async (token) => {	CODE
LOW	pnpm11/__fixtures__/has-outdated-deps/pnpm-lock.yaml	26	deprecated: This package is deprecated. Lorem ipsum dolor sit amet, consectetur adipiscing elit.	CODE
LOW	pnpm11/__fixtures__/has-outdated-deps/pnpm-lock.yaml	26	deprecated: This package is deprecated. Lorem ipsum dolor sit amet, consectetur adipiscing elit.	CODE
LOW	…1/__fixtures__/has-only-deprecated-deps/pnpm-lock.yaml	16	deprecated: This package is deprecated. Lorem ipsum dolor sit amet, consectetur adipiscing elit.	CODE
LOW	…1/__fixtures__/has-only-deprecated-deps/pnpm-lock.yaml	16	deprecated: This package is deprecated. Lorem ipsum dolor sit amet, consectetur adipiscing elit.	CODE
LOW	pnpm11/resolving/npm-resolver/test/trustChecks.test.ts	90	email: 'user@example.com',	CODE
LOW	pnpm11/resolving/npm-resolver/test/trustChecks.test.ts	106	email: 'user@example.com',	CODE
LOW	pnpm11/resolving/npm-resolver/test/trustChecks.test.ts	109	email: 'user@example.com',	CODE
LOW	pnpm11/resolving/npm-resolver/test/trustChecks.test.ts	126	email: 'user@example.com',	CODE
LOW	pnpm11/resolving/npm-resolver/test/trustChecks.test.ts	129	email: 'user@example.com',	CODE
LOW	pnpm11/bins/linker/test/refreshPlan.ts	19	fs.writeFileSync(path.join(pkgRoot, 'cli.js'), '#!/usr/bin/env node\nconsole.log("placeholder")\n', { mode: 0o755 })	CODE
LOW	pnpm11/network/git-utils/test/index.test.ts	45	await execa('git', ['config', 'user.email', 'test@test.com'], { cwd: tempDir })	CODE
LOW	pnpm11/network/git-utils/test/index.test.ts	71	await git('config', 'user.email', 'test@test.com')	CODE
LOW	pnpm11/pnpm/artifacts/exe/test/setup.test.ts	209	fs.writeFileSync(path.join(fixtureDir, name), 'placeholder')	CODE
LOW	pnpm11/pnpm/test/dlx.ts	429	email: 'foo@bar.com',	CODE
LOW	pnpm11/pnpm/test/getConfig.test.ts	56	test.each([undefined, '', 'dummy-token'])('emit trusted auth environment warnings for %p', async (token) => {	CODE
LOW	pnpm11/pnpm/test/getConfig.test.ts	69	expect(console.warn).not.toHaveBeenCalledWith(expect.stringContaining('dummy-token'))	CODE
LOW	…1/deps/compliance/sbom/test/serializeCycloneDx.test.ts	27	author: 'Jane Doe',	CODE
LOW	…1/deps/compliance/sbom/test/serializeCycloneDx.test.ts	153	sbomAuthors: ['Jane Doe', 'John Smith'],	CODE
LOW	…1/deps/compliance/sbom/test/serializeCycloneDx.test.ts	157	expect(parsed.metadata.authors).toEqual([{ name: 'Jane Doe' }, { name: 'John Smith' }])	CODE
LOW	…1/deps/compliance/sbom/test/serializeCycloneDx.test.ts	299	expect(parsed.components[0].authors).toEqual([{ name: 'Jane Doe' }])	CODE
LOW	pnpm11/deps/compliance/sbom/test/getPkgMetadata.test.ts	174	expect(authorNameFromField('Jane Doe')).toBe('Jane Doe')	CODE
LOW	pnpm11/deps/compliance/sbom/test/getPkgMetadata.test.ts	175	expect(authorNameFromField({ name: 'Jane Doe', email: 'jane@example.com' })).toBe('Jane Doe')	CODE
LOW	pnpm11/deps/compliance/commands/test/sbom/index.ts	109	setManifestAuthor(path.join(workspaceDir, 'package.json'), 'Jane Doe')	CODE
LOW	pnpm11/deps/compliance/commands/test/sbom/index.ts	111	expect(namedCycloneDx.metadata.component.authors).toStrictEqual([{ name: 'Jane Doe' }])	CODE
LOW	pnpm11/deps/inspection/commands/test/outdated/index.ts	64	│ @pnpm.e2e/deprecated │ 1.0.0 │ Deprecated │ This package is deprecated. Lorem ipsum │	CODE
LOW	pnpm11/deps/inspection/commands/test/outdated/index.ts	65	│ │ │ │ dolor sit amet, consectetur adipiscing │	CODE
LOW	pnpm11/deps/inspection/commands/test/outdated/index.ts	184	This package is deprecated. Lorem ipsum dolor sit amet, consectetur adipiscing elit.	CODE
LOW	pnpm11/deps/inspection/commands/test/outdated/index.ts	184	This package is deprecated. Lorem ipsum dolor sit amet, consectetur adipiscing elit.	CODE
LOW	pnpm11/deps/inspection/commands/test/outdated/index.ts	535	│ @pnpm.e2e/deprecated │ 1.0.0 │ Deprecated │ This package is deprecated. Lorem ipsum │	CODE
LOW	pnpm11/deps/inspection/commands/test/outdated/index.ts	536	│ │ │ │ dolor sit amet, consectetur adipiscing │	CODE
LOW	pnpm11/building/commands/test/rebuildGraph.ts	53	fs.writeFileSync(path.join(pkgRoot, 'tool'), '#!/usr/bin/env node\nconsole.log("placeholder")\n', { mode: 0o755 })	CODE
39 more matches not shown…

Modern AI Meta-Vocabulary32 hits · 100 pts

Severity	File	Line	Snippet	Context
MEDIUM	pnpm11/__fixtures__/pnpm-workspace.yaml	27	# policy for fixture installs — they're test scaffolding, not a real	COMMENT
MEDIUM	pnpm11/benchmarks/bench.sh	9	# as before; the orchestration logic is shared with the pacquet bench.	COMMENT
MEDIUM	pnpm/tasks/ecosystem-e2e/README.md	53	# Iterate without re-scaffolding	COMMENT
MEDIUM	pnpm/tasks/ecosystem-e2e/src/stacks.rs	3	/// `scaffold` generates the project on disk without installing	COMMENT
MEDIUM	pnpm/tasks/ecosystem-e2e/src/main.rs	112	/// A failed scaffold dooms every cell of this stack; they are all recorded	COMMENT
MEDIUM	pnpm/crates/config/src/settings.rs	1624	/// `pnpm init` writes, replacing the `ISC` the scaffold carries.	COMMENT
MEDIUM	pnpm/crates/config/src/settings.rs	1628	/// `pnpm init` writes, replacing the `1.0.0` the scaffold carries.	COMMENT
MEDIUM	…pm/crates/package-manager/src/install/modules_state.rs	253	/// or one added or removed. Placeholder entries the approval scaffold	COMMENT
MEDIUM	…manager/src/install/lifecycle/project_script_runner.rs	143	/// standalone project whose scaffold manifest exists only in memory	COMMENT
MEDIUM	…manager/src/install/lifecycle/project_script_runner.rs	145	/// `node-gyp rebuild` its `binding.gyp` calls for. Write the scaffold	COMMENT
MEDIUM	…anager/src/install/apply_materialization/completion.rs	165	// A global install is exempt from the scaffold below: its root is a	COMMENT
MEDIUM	pnpm/crates/cli/tests/suite/run.rs	702	// directory would scaffold one before doing anything else.	COMMENT
MEDIUM	pnpm/crates/cli/tests/suite/workspace_install.rs	1171	/// root `package.json`, and installing must not scaffold one — pnpm never	COMMENT
MEDIUM	pnpm/crates/cli/tests/suite/init.rs	369	/// Nothing set leaves the scaffold's own placeholders in place, including	COMMENT
MEDIUM	pnpm/crates/cli/tests/suite/init.rs	370	/// the empty `author` field npm's scaffold carries.	COMMENT
MEDIUM	pnpm/crates/cli/tests/suite/approve_builds.rs	959	/// must not write the `allowBuilds` scaffold into one, even on a terminal.	COMMENT
MEDIUM	pnpm/crates/cli/src/state.rs	250	/// scaffold stays in memory until a command that writes the manifest	COMMENT
MEDIUM	pnpm/crates/cli/src/cli_args/rebuild.rs	191	/// whose manifest may still be the in-memory scaffold of a project that	COMMENT
MEDIUM	pnpm/crates/cli/src/cli_args/init.rs	9	/// and a scaffold command that appears to hang is worse than one that pins	COMMENT
MEDIUM	…pm/crates/workspace-manifest-writer/src/tests/files.rs	14	/// Every install that keeps ignoring the same build re-runs the scaffold;	COMMENT
MEDIUM	pnpm/crates/package-manifest/src/serialization.rs	264	/// The manifest at `path`, or the scaffold [`Self::create_if_needed`]	COMMENT
MEDIUM	pnpm/crates/package-manifest/src/serialization.rs	265	/// would write there. The scaffold stays in memory until the caller	COMMENT
MEDIUM	pnpm/crates/package-manifest/src/serialization.rs	280	// Read the scaffold back rather than assembling the manifest by	COMMENT
MEDIUM	pnpm/crates/package-manifest/src/initialization.rs	4	/// every scaffold carries.	COMMENT
MEDIUM⚡	pnpm/crates/package-manifest/src/initialization.rs	20	/// set renders empty, and the scaffold's empty `author` stands.	COMMENT
MEDIUM⚡	pnpm/crates/package-manifest/src/initialization.rs	23	/// The `license` the scaffold records instead of its `ISC` default.	COMMENT
MEDIUM⚡	pnpm/crates/package-manifest/src/initialization.rs	27	/// The `version` the scaffold records instead of its `1.0.0` default.	COMMENT
MEDIUM	pnpm/crates/package-manifest/src/initialization.rs	86	// The `init*` settings overwrite the scaffold's placeholders in	COMMENT
MEDIUM	pnpm/crates/package-manifest/src/initialization.rs	87	// place, so the key order the scaffold fixes is preserved.	COMMENT
MEDIUM	pnpm/crates/package-manifest/src/initialization.rs	101	/// The scaffold manifest `pnpm init` (and [`Self::create_if_needed`])	COMMENT
MEDIUM	pnpm/crates/package-manifest/src/tests/behavior.rs	45	/// The scaffold `pnpm add` writes when there is no manifest yet carries no	COMMENT
MEDIUM	pnpm/docs/cli/tasks.md	28	Lists the running (active holders) and waiting tasks across [concurrency groups](../workspace-task-orchestration.md#conc	CODE

Verbosity Indicators28 hits · 56 pts

Severity	File	Line	Snippet	Context
LOW⚡	…ling/deps-installer/test/install/globalVirtualStore.ts	391	// Step 2: Reinstall with allowBuilds changed (simulating what approve-builds does)	COMMENT
LOW⚡	…ling/deps-installer/test/install/globalVirtualStore.ts	399	// Step 3: Verify the hash changed and build artifacts are in the new directory	COMMENT
LOW⚡	…ling/deps-installer/test/install/globalVirtualStore.ts	589	// Step 2: Simulate a previous build failure by removing the GVS hash directory	COMMENT
LOW⚡	…ling/deps-installer/test/install/globalVirtualStore.ts	593	// Step 3: Remove node_modules and reinstall with frozenLockfile	COMMENT
LOW⚡	…ling/deps-installer/test/install/globalVirtualStore.ts	636	// Step 2: Simulate a crash between import and build — write a .pnpm-needs-build	COMMENT
LOW⚡	…ling/deps-installer/test/install/globalVirtualStore.ts	646	// Step 3: Reinstall — the GVS fast path should detect the .pnpm-needs-build	COMMENT
LOW	…ling/deps-installer/test/install/globalVirtualStore.ts	291	// Step 1: Install with no packages allowed to build (engine-agnostic hashes)	COMMENT
LOW	…ling/deps-installer/test/install/globalVirtualStore.ts	305	// Step 2: Reinstall with dep allowed to build — hashes should change	COMMENT
LOW	…ling/deps-installer/test/install/globalVirtualStore.ts	376	// Step 1: Install with builds NOT approved (simulating first `pnpm install`)	COMMENT
LOW	…ling/deps-installer/test/install/globalVirtualStore.ts	575	// Step 1: Successful install with build	COMMENT
LOW	…ling/deps-installer/test/install/globalVirtualStore.ts	619	// Step 1: Install with build	COMMENT
LOW	…alling/deps-installer/test/install/autoInstallPeers.ts	726	// Step 1: install without override — auto-installs peer-c@1.0.1	COMMENT
LOW	…alling/deps-installer/test/install/autoInstallPeers.ts	739	// Step 2: reinstall with override narrowing peer-c to 1.0.0	COMMENT
LOW⚡	pnpm11/pnpm/test/install/minimumReleaseAge.ts	30	// Step 1: populate a lockfile under no policy. The resolver picks	COMMENT
LOW⚡	pnpm11/pnpm/test/install/minimumReleaseAge.ts	37	// Step 2: turn on minimumReleaseAge in strict mode. The lockfile is now	COMMENT
LOW⚡	pnpm11/pnpm/test/install/minimumReleaseAge.ts	81	// Step 1: populate the lockfile with no policy. is-positive@1.0.0	COMMENT
LOW⚡	pnpm11/pnpm/test/install/minimumReleaseAge.ts	88	// Step 2: turn the policy on. The post-resolution gate now runs	COMMENT
LOW	pnpm11/pnpm/test/install/minimumReleaseAge.ts	113	// Step 3: another install with the same lockfile + policy. The cache	COMMENT
LOW⚡	pnpm11/pnpm/test/install/minimumReleaseAge.ts	368	// Step 1: install with the full exclude list — verifier writes a	COMMENT
LOW⚡	pnpm11/pnpm/test/install/minimumReleaseAge.ts	377	// Step 2: drop `is-odd` from the exclude list. The cached record	COMMENT
LOW⚡	pnpm11/pnpm/test/install/globalVirtualStore.ts	106	// Step 1: Install with GVS, builds NOT approved	COMMENT
LOW⚡	pnpm11/pnpm/test/install/globalVirtualStore.ts	116	// Step 2: approve-builds — updates config then runs install in GVS mode	COMMENT
LOW⚡	pnpm11/pnpm/test/install/globalVirtualStore.ts	119	// Step 3: Verify GVS hash changed (new engine-specific directory)	COMMENT
LOW⚡	pnpm11/pnpm/test/install/misc.ts	739	// Step 1: install with trust policy off. The resolver picks up the	COMMENT
LOW⚡	pnpm11/pnpm/test/install/misc.ts	747	// Step 2: turn the policy on. The resolver wouldn't be invoked under	COMMENT
LOW⚡	pnpm/crates/network/src/tls.rs	248	// Step 1: exact URL.	COMMENT
LOW⚡	pnpm/crates/network/src/tls.rs	252	// Step 2: nerf-darted URL.	COMMENT
LOW	pnpm/crates/network/src/tls.rs	274	/// Step 4: walk progressively shorter prefixes of the nerf-darted form.	COMMENT

Structural Annotation Overuse28 hits · 56 pts

Severity	File	Line	Snippet	Context
LOW⚡	…ling/deps-installer/test/install/globalVirtualStore.ts	391	// Step 2: Reinstall with allowBuilds changed (simulating what approve-builds does)	COMMENT
LOW⚡	…ling/deps-installer/test/install/globalVirtualStore.ts	399	// Step 3: Verify the hash changed and build artifacts are in the new directory	COMMENT
LOW⚡	…ling/deps-installer/test/install/globalVirtualStore.ts	589	// Step 2: Simulate a previous build failure by removing the GVS hash directory	COMMENT
LOW⚡	…ling/deps-installer/test/install/globalVirtualStore.ts	593	// Step 3: Remove node_modules and reinstall with frozenLockfile	COMMENT
LOW⚡	…ling/deps-installer/test/install/globalVirtualStore.ts	636	// Step 2: Simulate a crash between import and build — write a .pnpm-needs-build	COMMENT
LOW⚡	…ling/deps-installer/test/install/globalVirtualStore.ts	646	// Step 3: Reinstall — the GVS fast path should detect the .pnpm-needs-build	COMMENT
LOW	…ling/deps-installer/test/install/globalVirtualStore.ts	291	// Step 1: Install with no packages allowed to build (engine-agnostic hashes)	COMMENT
LOW	…ling/deps-installer/test/install/globalVirtualStore.ts	305	// Step 2: Reinstall with dep allowed to build — hashes should change	COMMENT
LOW	…ling/deps-installer/test/install/globalVirtualStore.ts	376	// Step 1: Install with builds NOT approved (simulating first `pnpm install`)	COMMENT
LOW	…ling/deps-installer/test/install/globalVirtualStore.ts	575	// Step 1: Successful install with build	COMMENT
LOW	…ling/deps-installer/test/install/globalVirtualStore.ts	619	// Step 1: Install with build	COMMENT
LOW	…alling/deps-installer/test/install/autoInstallPeers.ts	726	// Step 1: install without override — auto-installs peer-c@1.0.1	COMMENT
LOW	…alling/deps-installer/test/install/autoInstallPeers.ts	739	// Step 2: reinstall with override narrowing peer-c to 1.0.0	COMMENT
LOW⚡	pnpm11/pnpm/test/install/minimumReleaseAge.ts	30	// Step 1: populate a lockfile under no policy. The resolver picks	COMMENT
LOW⚡	pnpm11/pnpm/test/install/minimumReleaseAge.ts	37	// Step 2: turn on minimumReleaseAge in strict mode. The lockfile is now	COMMENT
LOW⚡	pnpm11/pnpm/test/install/minimumReleaseAge.ts	81	// Step 1: populate the lockfile with no policy. is-positive@1.0.0	COMMENT
LOW⚡	pnpm11/pnpm/test/install/minimumReleaseAge.ts	88	// Step 2: turn the policy on. The post-resolution gate now runs	COMMENT
LOW	pnpm11/pnpm/test/install/minimumReleaseAge.ts	113	// Step 3: another install with the same lockfile + policy. The cache	COMMENT
LOW⚡	pnpm11/pnpm/test/install/minimumReleaseAge.ts	368	// Step 1: install with the full exclude list — verifier writes a	COMMENT
LOW⚡	pnpm11/pnpm/test/install/minimumReleaseAge.ts	377	// Step 2: drop `is-odd` from the exclude list. The cached record	COMMENT
LOW⚡	pnpm11/pnpm/test/install/globalVirtualStore.ts	106	// Step 1: Install with GVS, builds NOT approved	COMMENT
LOW⚡	pnpm11/pnpm/test/install/globalVirtualStore.ts	116	// Step 2: approve-builds — updates config then runs install in GVS mode	COMMENT
LOW⚡	pnpm11/pnpm/test/install/globalVirtualStore.ts	119	// Step 3: Verify GVS hash changed (new engine-specific directory)	COMMENT
LOW⚡	pnpm11/pnpm/test/install/misc.ts	739	// Step 1: install with trust policy off. The resolver picks up the	COMMENT
LOW⚡	pnpm11/pnpm/test/install/misc.ts	747	// Step 2: turn the policy on. The resolver wouldn't be invoked under	COMMENT
LOW⚡	pnpm/crates/network/src/tls.rs	248	// Step 1: exact URL.	COMMENT
LOW⚡	pnpm/crates/network/src/tls.rs	252	// Step 2: nerf-darted URL.	COMMENT
LOW	pnpm/crates/network/src/tls.rs	274	/// Step 4: walk progressively shorter prefixes of the nerf-darted form.	COMMENT

Cross-Language Confusion (JS/TS)6 hits · 40 pts

Severity	File	Line	Snippet	Context
HIGH	pnpm11/bins/cmd-shim/src/generateShShim.ts	200	elif command -v cygpath > /dev/null 2>&1; then	CODE
HIGH	pnpm11/bins/cmd-shim/src/generateShShim.ts	210	elif command -v wslpath > /dev/null 2>&1; then	CODE
HIGH⚡	pnpm11/bins/cmd-shim/src/generateShShim.ts	317	elif [ -x ${shLongProg} ]; then	CODE
HIGH⚡	pnpm11/bins/cmd-shim/src/generateShShim.ts	319	elif [ -n "$msys" ] && command -v ${shProg} >/dev/null 2>&1; then	CODE
HIGH⚡	pnpm11/bins/cmd-shim/src/generateShShim.ts	321	elif command -v ${shProg} >/dev/null 2>&1; then	CODE
HIGH⚡	pnpm11/bins/cmd-shim/src/generateShShim.ts	323	elif [ -n "$exe" ] && command -v ${shProgExe} >/dev/null 2>&1; then	CODE

Decorative Section Separators9 hits · 27 pts

Severity	File	Line	Snippet	Context
MEDIUM	pnpm11/pnpm/bundle-deps.ts	38	// │ ├── node_modules ──────────────┐	COMMENT
MEDIUM	pnpm11/pnpm/bundle-deps.ts	46	// │ ├── node_modules <────────────┘	COMMENT
MEDIUM	pnpm/crates/config/src/version_policy/tests.rs	86	// ─── create_package_version_policy ────────────────────────────────────	COMMENT
MEDIUM	pnpm/crates/cli/src/cli_args/owner/tests.rs	101	// ── owner ls HTTP-flow tests ──────────────────────────────────────────	COMMENT
MEDIUM	pnpm/crates/cli/src/cli_args/owner/tests.rs	372	// ── owner add HTTP-flow tests ─────────────────────────────────────────	COMMENT
MEDIUM	pnpm/crates/cli/src/cli_args/owner/tests.rs	508	// ── owner rm HTTP-flow tests ──────────────────────────────────────────	COMMENT
MEDIUM	pnpm/crates/cli/src/cli_args/owner/tests.rs	631	// ── default subcommand (no subcommand → ls) ──────────────────────────	COMMENT
MEDIUM	pnpm/crates/cli/src/cli_args/owner/tests.rs	653	// ── --registry override ──────────────────────────────────────────────	COMMENT
MEDIUM	pnpm/crates/cli/src/cli_args/owner/tests.rs	711	// ── normalize_registry_url ───────────────────────────────────────────	COMMENT

AI Slop Vocabulary9 hits · 27 pts

Severity	File	Line	Snippet	Context
MEDIUM	.github/workflows/test.yml	107	# The test harness serves package fixtures through the in-repo `pnpr`	COMMENT
MEDIUM	.github/workflows/pacquet-integrated-benchmark.yml	468	# the harness asserts pnpr@HEAD is not slower than pacquet@HEAD	COMMENT
MEDIUM	.github/workflows/pacquet-integrated-benchmark.yml	566	# The cross-engine ratio assertion inside the harness is a gate, not a	COMMENT
MEDIUM	.github/workflows/pacquet-integrated-benchmark.yml	576	# hyperfine exports both reports before the harness asserts, so a	COMMENT
MEDIUM	.github/workflows/pacquet-integrated-benchmark.yml	643	# The harness pre-warms the shared store per target before	COMMENT
MEDIUM	.github/workflows/ecosystem-e2e.yml	29	# Compile pacquet, the harness, and the pnpm bundle once, then share them	COMMENT
MEDIUM	.github/workflows/ecosystem-e2e.yml	93	# pin, which the harness passes to every subprocess through PATH.	COMMENT
MEDIUM	.github/workflows/ecosystem-e2e.yml	109	# The harness takes a single executable for --pnpm; the launcher is a	COMMENT
MEDIUM	.github/workflows/ecosystem-e2e.yml	142	# The harness mounts the committed `pnpm11/pnpm/package.json` and `bin/`	COMMENT

Synthetic Comment Markers3 hits · 22 pts

Severity	File	Line	Snippet	Context
HIGH	pnpm11/installing/deps-installer/test/catalogs.ts	1038	// Double check the correct version of is-positive as requested from the	COMMENT
HIGH	pnpm11/installing/deps-installer/test/catalogs.ts	1106	// Double check the correct version of is-positive as requested from the	COMMENT
HIGH	pnpm/crates/package-manager/src/update/rewrite.rs	219	/// range names no version to pin and is written as requested. A `runtime:`	COMMENT

Self-Referential Comments3 hits · 6 pts

Severity	File	Line	Snippet	Context
MEDIUM	…s/integrated-benchmark/src/work_env/cargo_workspace.rs	116	"# This file is automatically @generated by Cargo.\n# It is not intended for manual editing.\n\	CODE
MEDIUM	pnpm/crates/lockfile-import/src/yarn/tests.rs	84	r#"# This file is generated by running "yarn install" inside your project.	CODE
MEDIUM	pnpm/crates/cli/tests/suite/import.rs	139	const YARN_BERRY_LOCKFILE: &str = r#"# This file is generated by running "yarn install" inside your project.	CODE

Empty Error Handlers1 hit · 5 pts

Severity	File	Line	Snippet	Context
HIGH	pnpm11/__utils__/scripts/terminal.py	34	except ProcessLookupError:	CODE

TODO Padding2 hits · 3 pts

Severity	File	Line	Snippet	Context
LOW	pnpm11/installing/deps-installer/test/install/misc.ts	1054	// TODO: implement	COMMENT
LOW	pnpm11/store/controller/src/storeController/prune.ts	194	// TODO: implement prune of Node.js packages, they don't have a package.json file	COMMENT

Redundant / Tautological Comments2 hits · 3 pts

Severity	File	Line	Snippet	Context
LOW	.github/workflows/pacquet-micro-benchmark.yml	122	# Check if the event is not triggered by a fork	COMMENT
LOW	.github/workflows/pacquet-micro-benchmark.yml	132	# Check if the event is not triggered by a fork	COMMENT

Example Usage Blocks1 hit · 2 pts

Severity	File	Line	Snippet	Context
LOW	…s/skills/pull-requests/scripts/resolve-pr-conflicts.sh	4	# Usage:	COMMENT

Overly Generic Function Names1 hit · 1 pts

Severity	File	Line	Snippet	Context
LOW	pnpm/npm/get-pnpm/test/install.test.ts	182	function handleRequest (req: http.IncomingMessage, res: http.ServerResponse, tarballs: Tarballs): void {	CODE

pnpm/pnpm

Open-Source Code Quality, Security and Technical Debt Review