Desktop app to manage markdown knowledge bases
This report summarizes scanner evidence for refactoringhq/tolaria, a TypeScript project with 20,034 GitHub stars. SynthScan examined 439,677 lines of code across 2208 source files, recording 2107 pattern matches distributed across 10 syntactic categories. The legacy adjusted pattern signal is 5.4 (Moderate pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Can maintainers explain intent, assumptions, and trade-offs? 2051 finding(s).
Are imports declared and package/API names verified? 17 finding(s).
Are wrappers, guards, and repeated structures necessary? 2071 finding(s).
Which changes need focused human review? 2107 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 2107 distinct pattern matches across 10 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | vite.config.ts | 65 | function collectWikiLinksFromValue(value: unknown, depth: number): string[] { | CODE |
| LOW | vite.config.ts | 355 | function isScalarFrontmatterProperty(value: unknown): value is number | boolean { | CODE |
| LOW | vite.config.ts | 557 | function commandVaultRenameFilename({ args }: VaultCommandContext): VaultCommandResponse { | CODE |
| LOW | vite.config.ts | 649 | function collectLegacyWikilinkTargets({ oldPath, oldTitle, vaultPath }: LegacyWikilinkTargetInput): string[] { | CODE |
| LOW | vite.config.ts | 655 | function updateWikilinksForTargets({ excludePath, newTarget, oldTargets, vaultPath }: WikilinkTargetUpdateInput): number | CODE |
| LOW | vite.config.ts | 711 | function collectVaultSearchResults({ excludeFrontmatter, vaultPath, query }: SearchRequestInput): VaultSearchResult[] { | CODE |
| LOW⚡ | vite.config.ts | 795 | function validateMarkdownFilenameStem(value: unknown): FilenameStemValidation { | CODE |
| LOW⚡ | vite.config.ts | 802 | function isUnsafeMarkdownFilenameStem(stem: string): boolean { | CODE |
| LOW⚡ | vite.config.ts | 811 | async function handleVaultRenameFilename(url: URL, req: IncomingMessage, res: ServerResponse): Promise<boolean> { | CODE |
| LOW | mcp-server/vault-path.js | 96 | function existingOrPreferredAppConfigPath(configDirs, fileName) { | CODE |
| LOW | mcp-server/test.js | 767 | function assertToolsUseReadOnlyAnnotations(toolsByName, names) { | CODE |
| LOW | mcp-server/test.js | 773 | function assertToolsUseWritableAnnotations(toolsByName, names) { | CODE |
| LOW | mcp-server/test.js | 787 | function assertWritableContentToolSchema(toolsByName, name) { | CODE |
| LOW | mcp-server/test.js | 803 | async function assertRejectsOutsideVault(prefix, resolveNotePath) { | CODE |
| LOW | mcp-server/test.js | 827 | async function assertWriteRejectsOutsideVault(prefix, writeOutsideNote) { | CODE |
| LOW | mcp-server/vault-lifecycle.js | 120 | async function assertCloneDestinationAvailable(destinationPath) { | CODE |
| LOW | mcp-server/agent-instructions.js | 18 | export async function vaultContextWithInstructions(vaultPath) { | CODE |
| LOW | mcp-server/tool-service.js | 249 | function fallbackCreateNoteContent(args = {}) { | CODE |
| LOW | mcp-server/vault.js | 247 | async function ensureWritableParentInsideVault(vaultRoot, requestedPath) { | CODE |
| LOW | mcp-server/vault.js | 274 | function relativeNotePathInsideVault(vaultRoot, requestedPath) { | CODE |
| LOW | mcp-server/vault.js | 349 | function shouldUseFallbackFrontmatter(parsed, fallback) { | CODE |
| LOW | mcp-server/vault.js | 539 | async function assertNoteMatchesExpectedMtime(noteRealPath, expectedMtime) { | CODE |
| LOW | tests/smoke/tldraw-whiteboard-notes.spec.ts | 35 | async function installTauriContextMenuHarness(page: Page): Promise<void> { | CODE |
| LOW | tests/smoke/tldraw-whiteboard-notes.spec.ts | 78 | async function expectNoEditorNodeSelection(page: Page): Promise<void> { | CODE |
| LOW | tests/smoke/note-width-modes.spec.ts | 27 | async function expectWideModeHasUnboundedWidth(page: Page) { | CODE |
| LOW | tests/smoke/fenced-code-copy.spec.ts | 62 | async function expectRichCodeBlockButtonCopy(page: Page, blockIndex: number, expectedText: string) { | CODE |
| LOW | tests/smoke/missing-string-metadata-open-note.spec.ts | 11 | function isMissingStringMetadataCrash(message: string): boolean { | CODE |
| LOW | tests/smoke/missing-string-metadata-open-note.spec.ts | 19 | function collectMissingMetadataCrashes(page: Page): string[] { | CODE |
| LOW | tests/smoke/missing-string-metadata-open-note.spec.ts | 32 | function removeAlphaProjectStringMetadata(entries: Array<Record<string, unknown>>) { | CODE |
| LOW | tests/smoke/missing-string-metadata-open-note.spec.ts | 50 | function appendMalformedReloadEntry(entries: Array<Record<string, unknown>>) { | CODE |
| LOW⚡ | tests/smoke/missing-string-metadata-open-note.spec.ts | 73 | async function reloadVaultFromCommandPalette(page: Page): Promise<void> { | CODE |
| LOW⚡ | tests/smoke/missing-string-metadata-open-note.spec.ts | 83 | async function expectAlphaProjectHeading(page: Page): Promise<void> { | CODE |
| LOW⚡ | tests/smoke/missing-string-metadata-open-note.spec.ts | 87 | async function switchFromNoteBBackToAlpha(page: Page, noteList: Locator): Promise<void> { | CODE |
| LOW | tests/smoke/create-empty-vault-flows.spec.ts | 42 | async function expectFreshVaultSeedEntries(page: Page) { | CODE |
| LOW | tests/smoke/create-empty-vault-flows.spec.ts | 85 | function buildFreshVaultSeedEntries(vaultPath: string): MockEntry[] { | CODE |
| LOW | tests/smoke/plain-filename-autolink.spec.ts | 60 | async function appendPlainFilenameParagraph(page: Page, value: string) { | CODE |
| LOW | tests/smoke/blocknote-slash-menu-mouse.spec.ts | 32 | async function openFilteredSlashMenuOnNewLine(page: Page) { | CODE |
| LOW | tests/smoke/blocknote-slash-menu-mouse.spec.ts | 41 | async function openEmojiShortcodeMenuOnNewLine(page: Page, query: string) { | CODE |
| LOW | tests/smoke/table-hover-crash.spec.ts | 91 | function writeTableWikilinkAliasNotes(vaultDir: string): void { | CODE |
| LOW | tests/smoke/new-note-first-property.spec.ts | 11 | async function holdCompletedAutoRenameResponse(page: Page): Promise<void> { | CODE |
| LOW | tests/smoke/new-note-first-property.spec.ts | 32 | async function waitForCompletedAutoRename(page: Page): Promise<void> { | CODE |
| LOW | tests/smoke/new-note-first-property.spec.ts | 36 | async function releaseCompletedAutoRenameResponse(page: Page): Promise<void> { | CODE |
| LOW⚡ | tests/smoke/sidebar-type-picker-sync.spec.ts | 13 | function seedJournalInstanceWithoutType(vaultPath: string): void { | CODE |
| LOW⚡ | tests/smoke/sidebar-type-picker-sync.spec.ts | 23 | async function openSidebarVisibilityPopover(page: Page): Promise<void> { | CODE |
| LOW⚡ | tests/smoke/sidebar-type-picker-sync.spec.ts | 31 | async function closeSidebarVisibilityPopover(page: Page): Promise<void> { | CODE |
| LOW | tests/smoke/create-open-relationship-note.spec.ts | 22 | async function openFirstRelationshipInput(page: import('@playwright/test').Page) { | CODE |
| LOW | tests/smoke/create-note-backing-file.spec.ts | 87 | async function installCreateNoteBackingFileProbe(page: Page): Promise<void> { | CODE |
| LOW | tests/smoke/list-marker-paste-regression.spec.ts | 45 | async function expectPastedFreshListItem(page: Page, options: { | CODE |
| LOW | tests/smoke/multi-selection-shortcuts.spec.ts | 36 | function frontmatterDelimiterLineCount(content: string): number { | CODE |
| LOW | tests/smoke/wikilink-cmd-click-history.spec.ts | 33 | function trackStaleLinkClickErrors(page: Page): string[] { | CODE |
| LOW | tests/smoke/wikilink-cmd-click-history.spec.ts | 122 | async function dispatchModifiedLinkActivation(link: Locator): Promise<void> { | CODE |
| LOW | tests/smoke/wikilink-cmd-click-history.spec.ts | 157 | async function typeWikilinkQueryInNewParagraph(page: Page, target: string): Promise<Locator> { | CODE |
| LOW | tests/smoke/wikilink-cmd-click-history.spec.ts | 165 | async function createFromWikilinkAutocomplete( | CODE |
| LOW | tests/smoke/vault-loading-skeleton.spec.ts | 101 | async function expectUnifiedShellWhileVaultLoads(page: Page): Promise<void> { | CODE |
| LOW | tests/smoke/new-note-title-caret-click.spec.ts | 45 | async function editorHasContentEditableFocus(page: Page): Promise<boolean> { | CODE |
| LOW | tests/smoke/raw-editor-type-propagation.spec.ts | 3 | async function openFirstNoteWithProperties(page: Page) { | CODE |
| LOW | tests/smoke/gitignored-visibility.spec.ts | 24 | async function installGitignoredVisibilityHarness(page: Page): Promise<void> { | CODE |
| LOW | tests/smoke/gitignored-visibility.spec.ts | 73 | async function reloadVaultFromCommandPalette(page: Page): Promise<void> { | CODE |
| LOW⚡ | tests/smoke/add-remote-from-no-remote.spec.ts | 78 | async function expectAddRemoteModalAndClose(page: Page): Promise<void> { | CODE |
| LOW⚡ | tests/smoke/add-remote-from-no-remote.spec.ts | 85 | async function openAddRemoteFromStatusChip(page: Page): Promise<void> { | CODE |
| 1972 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | scripts/generate_demo_vault.py | 33 | # ── Quarter / month mappings ───────────────────────────────────── | COMMENT |
| MEDIUM | scripts/generate_demo_vault.py | 71 | # ── Helpers ────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | scripts/generate_demo_vault.py | 113 | # ── AREAS ──────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | scripts/generate_demo_vault.py | 126 | # ── RESPONSIBILITIES ───────────────────────────────────────────── | COMMENT |
| MEDIUM | scripts/generate_demo_vault.py | 172 | # ── MEASURES ───────────────────────────────────────────────────── | COMMENT |
| MEDIUM | scripts/generate_demo_vault.py | 193 | # ── TOPICS ─────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | scripts/generate_demo_vault.py | 223 | # ── PERSONS ────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | scripts/generate_demo_vault.py | 392 | # ── PROJECTS ───────────────────────────────────────────────────── | COMMENT |
| MEDIUM | scripts/generate_demo_vault.py | 437 | # ── EXPERIMENTS ─────────────────────────────────────────────────── | COMMENT |
| MEDIUM | scripts/generate_demo_vault.py | 447 | # ── GOALS ───────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | scripts/generate_demo_vault.py | 461 | # ── EVERGREEN TOPICS AND BODIES ─────────────────────────────────── | COMMENT |
| MEDIUM | scripts/generate_demo_vault.py | 517 | # ── READING NOTES ───────────────────────────────────────────────── | COMMENT |
| MEDIUM | .github/workflows/release.yml | 18 | # ───────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | .github/workflows/release.yml | 21 | # ───────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | .github/workflows/release.yml | 49 | # ------------------------------------------------------------- | COMMENT |
| MEDIUM | .github/workflows/release.yml | 51 | # ------------------------------------------------------------- | COMMENT |
| MEDIUM | .github/workflows/release.yml | 62 | # ───────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | .github/workflows/release.yml | 65 | # ───────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | .github/workflows/release.yml | 266 | # ───────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | .github/workflows/release.yml | 268 | # ───────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | .github/workflows/release-stable.yml | 14 | # ───────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | .github/workflows/release-stable.yml | 16 | # ───────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | .github/workflows/release-stable.yml | 41 | # ------------------------------------------------------------- | COMMENT |
| MEDIUM | .github/workflows/release-stable.yml | 43 | # ------------------------------------------------------------- | COMMENT |
| MEDIUM | .github/workflows/release-stable.yml | 54 | # ───────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | .github/workflows/release-stable.yml | 56 | # ───────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | .github/workflows/release-stable.yml | 267 | # ───────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | .github/workflows/release-stable.yml | 269 | # ───────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | .github/workflows/ci.yml | 51 | # ── 0. Build check (catches type errors and bundler failures) ───────── | COMMENT |
| MEDIUM | .github/workflows/ci.yml | 118 | # ── 2. Documentation check (warning only — does not fail build) ─────── | COMMENT |
| MEDIUM | .github/workflows/ci.yml | 136 | # ── 3. Lint & format ────────────────────────────────────────────────── | COMMENT |
| MEDIUM | src-tauri/src/commands/ai.rs | 116 | // ── Claude CLI commands (desktop) ─────────────────────────────────────────── | COMMENT |
| MEDIUM | src-tauri/src/commands/ai.rs | 264 | // ── Claude CLI (mobile stubs) ─────────────────────────────────────────────── | COMMENT |
| MEDIUM | src-tauri/src/commands/system.rs | 106 | // ── MCP commands (desktop) ────────────────────────────────────────────────── | COMMENT |
| MEDIUM | src-tauri/src/commands/system.rs | 176 | // ── MCP commands (mobile stubs) ───────────────────────────────────────────── | COMMENT |
| MEDIUM | src-tauri/src/commands/system.rs | 217 | // ── Menu commands ─────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | src-tauri/src/commands/system.rs | 383 | // ── Settings & config commands ────────────────────────────────────────────── | COMMENT |
| MEDIUM | src-tauri/src/commands/git.rs | 32 | // ── Git commands (desktop) ────────────────────────────────────────────────── | COMMENT |
| MEDIUM | src-tauri/src/commands/git.rs | 340 | // ── Git commands (mobile stubs) ───────────────────────────────────────────── | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| CRITICAL | src-tauri/gen/apple/assets/mcp-server/index.js | 17094 | const parsedReturns = await me._def.returns._def.type.parseAsync(result, params).catch((e) => { | CODE |
| CRITICAL | src/components/arrowLigaturesExtension.test.ts | 94 | fixture.view.state.doc.textBetween.mockReturnValue('-') | CODE |
| CRITICAL | src/components/arrowLigaturesExtension.test.ts | 108 | fixture.view.state.doc.textBetween.mockReturnValueOnce('\\<') | CODE |
| CRITICAL | src/components/arrowLigaturesExtension.test.ts | 111 | fixture.view.state.doc.textBetween.mockReturnValueOnce('<-') | CODE |
| CRITICAL | src/components/arrowLigaturesExtension.test.ts | 133 | fixture.view.state.doc.textBetween.mockReturnValue('-') | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | src-tauri/src/git/mod_tests.rs | 71 | .args(["config", "user.email", "test@test.com"]) | CODE |
| LOW | src-tauri/src/git/dates.rs | 192 | .args(["config", "user.email", "test@test.com"]) | CODE |
| LOW | src-tauri/src/git/dates.rs | 260 | .args(["config", "user.email", "test@test.com"]) | CODE |
| LOW | src-tauri/src/vault/rename.rs | 716 | run_git(vault, &["config", "user.email", "test@test.com"]); | CODE |
| LOW | src-tauri/src/vault/frontmatter_regression_tests.rs | 35 | Some("Acme Corp") | CODE |
| LOW | src-tauri/src/vault/cache_tests/support.rs | 32 | .args(["config", "user.email", "test@test.com"]) | CODE |
| LOW | src/mock-tauri/mock-entries.ts | 268 | properties: { Company: 'Acme Corp', Role: 'Engineering Lead' }, | CODE |
| LOW | src/components/FilterBuilder.test.tsx | 40 | expect(screen.getByTestId('filter-value-input')).toHaveAttribute('placeholder', 'value') | CODE |
| LOW | src/components/FeedbackDialog.test.tsx | 198 | opener.setAttribute('placeholder', 'Type a command...') | CODE |
| LOW | src/components/InspectorPanels.test.tsx | 95 | entry: { path: '/vault/people/john-doe.md', filename: 'john-doe.md', title: 'John Doe', isA: 'Person' as const }, | CODE |
| LOW | src/hooks/useNoteCreation.extra.test.ts | 272 | const { entry } = resolveNewNote({ title: 'John Doe', type: 'Person', vaultPath: '/my/vault' }) | CODE |
| LOW | src/lib/feedbackDialogOpener.ts | 16 | && element.getAttribute('placeholder') === 'Type a command...' | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | docs/GETTING-STARTED.md | 171 | │ │ ├── Editor.tsx # Third panel: editor orchestration | CODE |
| MEDIUM | docs/GETTING-STARTED.md | 178 | │ │ ├── AiWorkspace.tsx # Multi-chat AI workspace orchestration (docked or native window) | CODE |
| MEDIUM | docs/GETTING-STARTED.md | 285 | │ │ │ └── getting_started.rs # Getting Started vault clone orchestration | CODE |
| MEDIUM | scripts/generate_demo_vault.py | 522 | ("note-building-a-second-brain","Building a Second Brain","Tiago Forte","topic-productivity-systems","https://exampl | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | src-tauri/gen/apple/assets/mcp-server/index.js | 16281 | }); | COMMENT |
| LOW | src-tauri/gen/apple/assets/mcp-server/index.js | 16321 | }), | COMMENT |
| LOW | src-tauri/gen/apple/assets/mcp-server/index.js | 16341 | // : never; | COMMENT |
| LOW | src-tauri/gen/apple/assets/mcp-server/index.js | 16361 | setKey(key, schema) { | COMMENT |
| LOW | src-tauri/src/ai_agents.rs | 141 | /// Probe every supported AI-agent CLI in parallel. | COMMENT |
| LOW | src-tauri/src/vault/mod_tests.rs | 41 | COMMENT | |
| LOW | src-tauri/src/vault/mod.rs | 521 | COMMENT | |
| LOW | src-tauri/src/vault/entry.rs | 41 | /// Accent color key for Type entries: "red", "purple", "blue", "green", "yellow", "orange". | COMMENT |
| LOW | src-tauri/src/vault/entry.rs | 61 | pub display: Option<String>, | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | VERITY.md | 3 | > This project uses [Verity](https://verity.md) to enforce quality and security standards on AI-generated code. | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | .claude/commands/create-adr.md | 90 | ### Step 1: Mark the old ADR as superseded | COMMENT |
| LOW | .claude/commands/create-adr.md | 107 | ### Step 2: Create the new ADR | COMMENT |
| LOW | .claude/commands/create-adr.md | 119 | ### Step 3: Update the README index | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | src-tauri/gen/apple/assets/mcp-server/index.js | 2782 | function getData($data, { dataLevel, dataNames, dataPathArr }) { | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | scripts/generate_demo_vault.py | 85 | CODE |