2.7

Adjusted Signal

2.7

Raw Pattern Score

100%

Time Factor

2026-10-21

Last Push

7.5K

Stars

TypeScript

Language

399.0K

Lines of Code

1.9K

Files

535

Pattern Hits

2026-10-31

Scan Date

0.02

HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 7.8/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 417 finding(s).

Hallucinated Dependency & Supply Chain Risk 2.1/100 · LOW

Are imports declared and package/API names verified? 39 finding(s).

Agent Over-Engineering Ratio 4.4/100 · LOW

Are wrappers, guards, and repeated structures necessary? 163 finding(s).

PR Review Velocity Impact 10.3/100 · LOW

Which changes need focused human review? 535 finding(s).

What These Metrics Mean

Adjusted Signal: Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score: Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor: A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits: Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate: High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files: Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 0HIGH 31MEDIUM 88LOW 416

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 535 distinct pattern matches across 16 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Decorative Section Separators78 hits · 274 pts

Severity	File	Line	Snippet	Context
MEDIUM	specs/current/ptc/scripts/ptc_common.py	20	# ── Constants ──────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	specs/current/ptc/scripts/ptc_common.py	39	# ── Timezone ───────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	specs/current/ptc/scripts/ptc_common.py	54	# ── String / format helpers ────────────────────────────────────────────────────	COMMENT
MEDIUM	specs/current/ptc/scripts/ptc_common.py	134	# ── Arg parser / DB setup ──────────────────────────────────────────────────────	COMMENT
MEDIUM	specs/current/ptc/scripts/ptc_common.py	278	# ── Tool call organization ─────────────────────────────────────────────────────	STRING
MEDIUM	specs/current/ptc/scripts/ptc_common.py	299	# ── Billing fetch + organize (shared by ptc_debug_billing and ptc_verify) ──────	STRING
MEDIUM	specs/current/ptc/scripts/ptc_verify.py	23	# ── Section [2]: BILLING TIMELINE ─────────────────────────────────────────────	COMMENT
MEDIUM	specs/current/ptc/scripts/ptc_verify.py	79	# ── Section [3]: CHECKS (includes billing warnings) ───────────────────────────	COMMENT
MEDIUM	specs/current/ptc/scripts/ptc_verify.py	99	# ── action_results.ptc_enabled ──────────────────────────────────────────────	COMMENT
MEDIUM	specs/current/ptc/scripts/ptc_verify.py	110	# ── action_messages ─────────────────────────────────────────────────────────	COMMENT
MEDIUM	specs/current/ptc/scripts/ptc_verify.py	124	# ── user_api_keys (temp sandbox key) ────────────────────────────────────────	COMMENT
MEDIUM	specs/current/ptc/scripts/ptc_verify.py	160	# ── tool_call_results: ptc_call_id linkage ──────────────────────────────────	STRING
MEDIUM	specs/current/ptc/scripts/ptc_verify.py	182	# ── credit_usages: tool_call_id foreign key integrity ───────────────────────	STRING
MEDIUM	specs/current/ptc/scripts/ptc_verify.py	212	# ── billing warnings (unbilled completed calls) ──────────────────────────────	STRING
MEDIUM	specs/current/ptc/scripts/ptc_verify.py	230	# ── Result ──────────────────────────────────────────────────────────────────	STRING
MEDIUM	specs/current/ptc/scripts/ptc_verify.py	242	# ── Main ───────────────────────────────────────────────────────────────────────	STRING
MEDIUM	specs/current/ptc/scripts/ptc_debug_calling.py	24	# ── Formatting helpers ─────────────────────────────────────────────────────────	COMMENT
MEDIUM	specs/current/ptc/scripts/ptc_debug_calling.py	94	# ── Data fetch / organize ──────────────────────────────────────────────────────	COMMENT
MEDIUM	specs/current/ptc/scripts/ptc_debug_calling.py	159	# ── Main ───────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	specs/current/ptc/scripts/ptc_debug_billing.py	23	# ── Section [2]: BILLING TRACE with inline summary ─────────────────────────────	COMMENT
MEDIUM	specs/current/ptc/scripts/ptc_debug_billing.py	134	# ── Section [3]: WARNINGS ──────────────────────────────────────────────────────	COMMENT
MEDIUM	specs/current/ptc/scripts/ptc_debug_billing.py	156	# ── Section [4]: DETAILED BREAKDOWN (--full only) ─────────────────────────────	COMMENT
MEDIUM	specs/current/ptc/scripts/ptc_debug_billing.py	212	# ── Main ───────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM⚡	deploy/docker/trace/prometheus-config.yaml	8	# ============================================================================	COMMENT
MEDIUM⚡	deploy/docker/trace/prometheus-config.yaml	10	# ============================================================================	COMMENT
MEDIUM⚡	deploy/docker/trace/prometheus-config.yaml	12	# --------------------------------------------------------------------------	COMMENT
MEDIUM⚡	deploy/docker/trace/prometheus-config.yaml	20	# --------------------------------------------------------------------------	COMMENT
MEDIUM⚡	deploy/docker/trace/prometheus-config.yaml	26	# --------------------------------------------------------------------------	COMMENT
MEDIUM⚡	deploy/docker/trace/prometheus-config.yaml	38	# --------------------------------------------------------------------------	COMMENT
MEDIUM⚡	deploy/docker/trace/prometheus-config.yaml	43	# --------------------------------------------------------------------------	COMMENT
MEDIUM⚡	deploy/docker/trace/prometheus-config.yaml	50	# --------------------------------------------------------------------------	COMMENT
MEDIUM⚡	deploy/docker/trace/prometheus-config.yaml	59	# ============================================================================	COMMENT
MEDIUM⚡	deploy/docker/trace/prometheus-config.yaml	61	# ============================================================================	COMMENT
MEDIUM	deploy/docker/trace/prometheus-config.yaml	75	# ============================================================================	COMMENT
MEDIUM⚡	scripts/cli-deploy/quick-start.sh	78	# =============================================================================	COMMENT
MEDIUM⚡	scripts/cli-deploy/quick-start.sh	80	# =============================================================================	COMMENT
MEDIUM⚡	scripts/cli-deploy/quick-start.sh	114	# =============================================================================	COMMENT
MEDIUM⚡	scripts/cli-deploy/quick-start.sh	116	# =============================================================================	COMMENT
MEDIUM⚡	scripts/cli-deploy/quick-start.sh	137	# =============================================================================	COMMENT
MEDIUM⚡	scripts/cli-deploy/quick-start.sh	139	# =============================================================================	COMMENT
MEDIUM⚡	scripts/cli-deploy/quick-start.sh	176	# =============================================================================	COMMENT
MEDIUM⚡	scripts/cli-deploy/quick-start.sh	178	# =============================================================================	COMMENT
MEDIUM⚡	scripts/cli-deploy/quick-start.sh	199	# =============================================================================	COMMENT
MEDIUM⚡	scripts/cli-deploy/quick-start.sh	201	# =============================================================================	COMMENT
MEDIUM⚡	scripts/cli-deploy/quick-start.sh	225	# =============================================================================	COMMENT
MEDIUM⚡	scripts/cli-deploy/quick-start.sh	227	# =============================================================================	COMMENT
MEDIUM⚡	scripts/cli-deploy/quick-start.sh	256	# =============================================================================	COMMENT
MEDIUM⚡	scripts/cli-deploy/quick-start.sh	258	# =============================================================================	COMMENT
MEDIUM	scripts/cli-deploy/quick-start.sh	15	# =============================================================================	COMMENT
MEDIUM	scripts/cli-deploy/quick-start.sh	17	# =============================================================================	COMMENT
MEDIUM	scripts/cli-deploy/quick-start.sh	30	# =============================================================================	COMMENT
MEDIUM	scripts/cli-deploy/quick-start.sh	32	# =============================================================================	COMMENT
MEDIUM	scripts/cli-deploy/quick-start.sh	297	# =============================================================================	COMMENT
MEDIUM	scripts/cli-deploy/quick-start.sh	299	# =============================================================================	COMMENT
MEDIUM⚡	scripts/cli-deploy/deploy-cli.sh	88	# =============================================================================	COMMENT
MEDIUM⚡	scripts/cli-deploy/deploy-cli.sh	90	# =============================================================================	COMMENT
MEDIUM⚡	scripts/cli-deploy/deploy-cli.sh	116	# =============================================================================	COMMENT
MEDIUM⚡	scripts/cli-deploy/deploy-cli.sh	118	# =============================================================================	COMMENT
MEDIUM⚡	scripts/cli-deploy/deploy-cli.sh	139	# =============================================================================	COMMENT
MEDIUM⚡	scripts/cli-deploy/deploy-cli.sh	141	# =============================================================================	COMMENT
18 more matches not shown…

Structural Annotation Overuse133 hits · 240 pts

Severity	File	Line	Snippet	Context
LOW⚡	…hange/20260226-ptc-billing-fix-fal-nano-banana/spec.md	73	# Step 1: Run the workflow (minimal test case including fal and nano banana)	COMMENT
LOW⚡	…hange/20260226-ptc-billing-fix-fal-nano-banana/spec.md	76	# Step 2: Watch until all nodes complete	COMMENT
LOW⚡	…hange/20260226-ptc-billing-fix-fal-nano-banana/spec.md	79	# Step 3: Verify each PTC node by title	COMMENT
LOW	docs/community-version/self-deploy/faq-ip-access.md	7	## Step 1: Confirm Server Information	COMMENT
LOW	docs/community-version/self-deploy/faq-ip-access.md	11	## Step 2: Modify Environment Variables	COMMENT
LOW	docs/community-version/self-deploy/faq-ip-access.md	26	## Step 3: Restart Services	COMMENT
LOW	docs/community-version/self-deploy/faq-ip-access.md	35	## Step 4: Verification and Testing	COMMENT
LOW⚡	scripts/cli-deploy/quick-start.sh	79	# Step 1: Check Prerequisites	COMMENT
LOW⚡	scripts/cli-deploy/quick-start.sh	115	# Step 2: Install Dependencies & Build	COMMENT
LOW⚡	scripts/cli-deploy/quick-start.sh	138	# Step 3: Start Services	COMMENT
LOW⚡	scripts/cli-deploy/quick-start.sh	177	# Step 4: Seed Tool Data	COMMENT
LOW⚡	scripts/cli-deploy/quick-start.sh	200	# Step 5: Start API Server	COMMENT
LOW⚡	scripts/cli-deploy/quick-start.sh	226	# Step 6: Login & Generate API Key	COMMENT
LOW⚡	scripts/cli-deploy/quick-start.sh	257	# Step 7: Verify & Summary	COMMENT
LOW⚡	scripts/cli-deploy/deploy-cli.sh	89	# Step 1: Check Prerequisites	COMMENT
LOW⚡	scripts/cli-deploy/deploy-cli.sh	117	# Step 2: Clone/Update Repository	COMMENT
LOW⚡	scripts/cli-deploy/deploy-cli.sh	140	# Step 3: Install Dependencies and Build	COMMENT
LOW⚡	scripts/cli-deploy/deploy-cli.sh	163	# Step 4: Start Services	COMMENT
LOW⚡	scripts/cli-deploy/deploy-cli.sh	207	# Step 5: Seed Tool Data	COMMENT
LOW⚡	scripts/cli-deploy/deploy-cli.sh	230	# Step 6: Login and Generate API Key	COMMENT
LOW⚡	scripts/cli-deploy/deploy-cli.sh	266	# Step 7: Verify Installation	COMMENT
LOW	packages/utils/src/artifact.ts	69	// Step 1: Find the complete opening tag using a more precise regex	COMMENT
LOW	packages/utils/src/artifact.ts	95	// Step 2: Extract the content between opening and closing tags	COMMENT
LOW	packages/utils/src/artifact.ts	139	// Step 1: Find the opening tag and extract all attributes	COMMENT
LOW	packages/utils/src/artifact.ts	158	// Step 2: Extract the content between opening and closing tags	COMMENT
LOW⚡	packages/cli/skill/SKILL.md	60	# Step 1: Run and capture RUN_ID	COMMENT
LOW⚡	packages/cli/skill/SKILL.md	64	# Step 2: Wait for completion	COMMENT
LOW⚡	packages/cli/skill/SKILL.md	67	# Step 3: Get files and download to Desktop	COMMENT
LOW⚡	packages/cli/skill/SKILL.md	85	# Step 1: Run and capture RUN_ID	COMMENT
LOW⚡	packages/cli/skill/SKILL.md	89	# Step 2: Wait for completion	COMMENT
LOW⚡	packages/cli/skill/SKILL.md	92	# Step 3: Extract text content from toolcalls	COMMENT
LOW⚡	packages/cli/skill/SKILL.md	103	# Step 1: Run and capture RUN_ID	COMMENT
LOW⚡	packages/cli/skill/SKILL.md	107	# Step 2: Wait for completion	COMMENT
LOW⚡	packages/cli/skill/SKILL.md	110	# Step 3: Confirm action status	COMMENT
LOW	packages/cli/skill/references/execution.md	27	### Step 1: Run Skill and Get Run ID	COMMENT
LOW	packages/cli/skill/references/execution.md	47	### Step 2: Open Workflow in Browser and Wait for Completion	COMMENT
LOW	packages/cli/skill/references/execution.md	57	### Step 3: Get Results (Choose Based on Skill Category)	COMMENT
LOW⚡	packages/cli/src/skill/symlink.ts	458	# Step 1: Run and capture RUN_ID (we-xxx format)	COMMENT
LOW⚡	packages/cli/src/skill/symlink.ts	463	# Step 2: Wait for completion (use RUN_ID, not installationId)	COMMENT
LOW⚡	packages/cli/src/skill/symlink.ts	466	# Step 3: Get files from this run (use RUN_ID)	COMMENT
LOW⚡	packages/cli/src/skill/symlink.ts	469	# Step 4: Download and open each file	COMMENT
LOW	packages/cli/src/api/client.ts	644	// Step 1: Get presigned URL	COMMENT
LOW⚡	packages/cli/src/api/client.ts	655	// Step 2: Upload to presigned URL	COMMENT
LOW⚡	packages/cli/src/api/client.ts	665	// Step 3: Confirm upload	COMMENT
LOW⚡	…/components/settings/tools-config/CommunityMcpCard.tsx	110	// Step 1: Validate MCP server connection	COMMENT
LOW⚡	…/components/settings/tools-config/CommunityMcpCard.tsx	118	// Step 2: Install the MCP server if validation successful	COMMENT
LOW⚡	…ents/settings/tools-config/CommunityMcpApiKeyModal.tsx	30	// Step 1: Validate MCP server connection	COMMENT
LOW⚡	…ents/settings/tools-config/CommunityMcpApiKeyModal.tsx	36	// Step 2: Install the MCP server if validation successful	COMMENT
LOW	…ponents/settings/tools-config/McpServerBatchImport.tsx	202	// Step 1: Create the server using createMutation.	COMMENT
LOW	apps/api/load-tests/scenarios/smoke-test.js	35	// Step 1: Check configuration	COMMENT
LOW	apps/api/load-tests/scenarios/smoke-test.js	52	// Step 2: Test API connection	COMMENT
LOW	apps/api/load-tests/scenarios/smoke-test.js	66	// Step 3: Test authentication	COMMENT
LOW	apps/api/load-tests/scenarios/smoke-test.js	88	// Step 4: Verify test canvas	COMMENT
LOW⚡	apps/api/src/modules/variable-extraction/prompt.ts	101	### Step 1: Intent Understanding & Reference Study	COMMENT
LOW⚡	apps/api/src/modules/variable-extraction/prompt.ts	107	### Step 2: Minimal Entity Extraction	COMMENT
LOW⚡	apps/api/src/modules/variable-extraction/prompt.ts	114	### Step 3: Variable Classification	COMMENT
LOW⚡	apps/api/src/modules/variable-extraction/prompt.ts	119	### Step 4: Reuse Detection & Minimalist Validation	COMMENT
LOW⚡	apps/api/src/modules/variable-extraction/prompt.ts	129	### Step 5: Variable Naming	COMMENT
LOW⚡	apps/api/src/modules/variable-extraction/prompt.ts	134	### Step 6: Template Construction	COMMENT
LOW	apps/api/src/modules/credit/credit.service.ts	595	// Step 1: Check if there's an active gift credit recharge for today	COMMENT
73 more matches not shown…

Verbosity Indicators114 hits · 202 pts

Severity	File	Line	Snippet	Context
LOW⚡	scripts/cli-deploy/quick-start.sh	79	# Step 1: Check Prerequisites	COMMENT
LOW⚡	scripts/cli-deploy/quick-start.sh	115	# Step 2: Install Dependencies & Build	COMMENT
LOW⚡	scripts/cli-deploy/quick-start.sh	138	# Step 3: Start Services	COMMENT
LOW⚡	scripts/cli-deploy/quick-start.sh	177	# Step 4: Seed Tool Data	COMMENT
LOW⚡	scripts/cli-deploy/quick-start.sh	200	# Step 5: Start API Server	COMMENT
LOW⚡	scripts/cli-deploy/quick-start.sh	226	# Step 6: Login & Generate API Key	COMMENT
LOW⚡	scripts/cli-deploy/quick-start.sh	257	# Step 7: Verify & Summary	COMMENT
LOW⚡	scripts/cli-deploy/deploy-cli.sh	89	# Step 1: Check Prerequisites	COMMENT
LOW⚡	scripts/cli-deploy/deploy-cli.sh	117	# Step 2: Clone/Update Repository	COMMENT
LOW⚡	scripts/cli-deploy/deploy-cli.sh	140	# Step 3: Install Dependencies and Build	COMMENT
LOW⚡	scripts/cli-deploy/deploy-cli.sh	163	# Step 4: Start Services	COMMENT
LOW⚡	scripts/cli-deploy/deploy-cli.sh	207	# Step 5: Seed Tool Data	COMMENT
LOW⚡	scripts/cli-deploy/deploy-cli.sh	230	# Step 6: Login and Generate API Key	COMMENT
LOW⚡	scripts/cli-deploy/deploy-cli.sh	266	# Step 7: Verify Installation	COMMENT
LOW	packages/utils/src/artifact.ts	69	// Step 1: Find the complete opening tag using a more precise regex	COMMENT
LOW	packages/utils/src/artifact.ts	95	// Step 2: Extract the content between opening and closing tags	COMMENT
LOW	packages/utils/src/artifact.ts	139	// Step 1: Find the opening tag and extract all attributes	COMMENT
LOW	packages/utils/src/artifact.ts	158	// Step 2: Extract the content between opening and closing tags	COMMENT
LOW⚡	packages/cli/src/skill/symlink.ts	458	# Step 1: Run and capture RUN_ID (we-xxx format)	COMMENT
LOW⚡	packages/cli/src/skill/symlink.ts	463	# Step 2: Wait for completion (use RUN_ID, not installationId)	COMMENT
LOW⚡	packages/cli/src/skill/symlink.ts	466	# Step 3: Get files from this run (use RUN_ID)	COMMENT
LOW⚡	packages/cli/src/skill/symlink.ts	469	# Step 4: Download and open each file	COMMENT
LOW	packages/cli/src/api/client.ts	644	// Step 1: Get presigned URL	COMMENT
LOW⚡	packages/cli/src/api/client.ts	655	// Step 2: Upload to presigned URL	COMMENT
LOW⚡	packages/cli/src/api/client.ts	665	// Step 3: Confirm upload	COMMENT
LOW⚡	…/components/settings/tools-config/CommunityMcpCard.tsx	110	// Step 1: Validate MCP server connection	COMMENT
LOW⚡	…/components/settings/tools-config/CommunityMcpCard.tsx	118	// Step 2: Install the MCP server if validation successful	COMMENT
LOW⚡	…ents/settings/tools-config/CommunityMcpApiKeyModal.tsx	30	// Step 1: Validate MCP server connection	COMMENT
LOW⚡	…ents/settings/tools-config/CommunityMcpApiKeyModal.tsx	36	// Step 2: Install the MCP server if validation successful	COMMENT
LOW	…ponents/settings/tools-config/McpServerBatchImport.tsx	202	// Step 1: Create the server using createMutation.	COMMENT
LOW	apps/api/load-tests/scenarios/smoke-test.js	35	// Step 1: Check configuration	COMMENT
LOW	apps/api/load-tests/scenarios/smoke-test.js	52	// Step 2: Test API connection	COMMENT
LOW	apps/api/load-tests/scenarios/smoke-test.js	66	// Step 3: Test authentication	COMMENT
LOW	apps/api/load-tests/scenarios/smoke-test.js	88	// Step 4: Verify test canvas	COMMENT
LOW⚡	apps/api/src/modules/variable-extraction/prompt.ts	101	### Step 1: Intent Understanding & Reference Study	COMMENT
LOW⚡	apps/api/src/modules/variable-extraction/prompt.ts	107	### Step 2: Minimal Entity Extraction	COMMENT
LOW⚡	apps/api/src/modules/variable-extraction/prompt.ts	114	### Step 3: Variable Classification	COMMENT
LOW⚡	apps/api/src/modules/variable-extraction/prompt.ts	119	### Step 4: Reuse Detection & Minimalist Validation	COMMENT
LOW⚡	apps/api/src/modules/variable-extraction/prompt.ts	129	### Step 5: Variable Naming	COMMENT
LOW⚡	apps/api/src/modules/variable-extraction/prompt.ts	134	### Step 6: Template Construction	COMMENT
LOW	apps/api/src/modules/credit/credit.service.ts	595	// Step 1: Check if there's an active gift credit recharge for today	COMMENT
LOW	apps/api/src/modules/credit/credit.service.ts	617	// Step 2: Check if user has active subscription	COMMENT
LOW	apps/api/src/modules/credit/credit.service.ts	629	// Step 3: Find plan quota for daily gift credit amount	COMMENT
LOW	…rc/modules/skill-package/skill-installation.service.ts	776	// Step 1: Fetch source canvas workflow variables directly (bypassing uid check)	COMMENT
LOW	…rc/modules/skill-package/skill-installation.service.ts	789	// Step 2: Use canvasService.duplicateCanvas to clone the canvas for the user	COMMENT
LOW	…rc/modules/skill-package/skill-installation.service.ts	801	// Step 3: If source has workflow variables, update the cloned canvas	COMMENT
LOW	apps/api/src/modules/tool-call/tool-call.service.ts	257	// Step 1: Group tool calls by step name	COMMENT
LOW	apps/api/src/modules/tool-call/tool-call.service.ts	273	// Step 2: Attach tool calls to each step and merge XML content	COMMENT
LOW	…s/api/src/modules/subscription/subscription.service.ts	633	// Step 1: Find all non-duplicate credit recharge records that are expired but not disabled	COMMENT
LOW	…s/api/src/modules/subscription/subscription.service.ts	647	// Step 2: Process subscription-based recharges only (gift recharges are now handled by lazy loading)	COMMENT
LOW⚡	apps/api/src/modules/search/search.service.ts	456	// Step 1: Prepare queries for each locale	COMMENT
LOW⚡	apps/api/src/modules/search/search.service.ts	462	// Step 2: Perform web search	COMMENT
LOW	apps/api/src/modules/search/search.service.ts	492	// Step 3: Rerank results if enabled	COMMENT
LOW	apps/api/src/modules/action/action.service.ts	706	// Step 1: Check if controller is in memory (same pod) - FASTEST	COMMENT
LOW	apps/api/src/modules/action/action.service.ts	721	// Step 2: Check if job is still queued in BullMQ	COMMENT
LOW⚡	apps/api/src/modules/workflow/workflow-plan.service.ts	247	// Step 1: Find the most recent copilot session for this canvas	COMMENT
LOW⚡	apps/api/src/modules/workflow/workflow-plan.service.ts	257	// Step 2: Find the latest plan version in that session	COMMENT
LOW	apps/api/src/modules/drive/drive.service.ts	1072	// Step 1: Try to load from cache	COMMENT
LOW	apps/api/src/modules/drive/drive.service.ts	1163	// Step 2: No cache found, perform parsing	COMMENT
LOW	apps/api/src/modules/drive/drive.service.ts	2001	// Step 1: Check if file exists in externalOss (public)	COMMENT
54 more matches not shown…

Cross-Language Confusion (JS/TS)18 hits · 98 pts

Severity	File	Line	Snippet	Context
HIGH	packages/sandbox-agent/src/session.ts	249	print("✓ Image saved: monthly_revenue_chart.png") # ✅ REQUIRED print statement	CODE
HIGH	packages/sandbox-agent/src/session.ts	253	print("✓ CSV saved: revenue_summary_by_month.csv") # ✅ REQUIRED print statement	CODE
HIGH⚡	packages/sandbox-agent/src/session.ts	275	print("✓ Image saved: product_sales_chart.png")	CODE
HIGH⚡	packages/sandbox-agent/src/session.ts	285	print("✓ Image saved: monthly_sales_chart.png")	CODE
HIGH⚡	packages/sandbox-agent/src/session.ts	288	print("✓ CSV saved: sales_data_export.csv")	CODE
HIGH	packages/agent-tools/src/builtin/sandbox.ts	70	print(f"Processed {len(df)} rows")	CODE
HIGH	packages/cli/src/commands/init.ts	145	print('init', {	CODE
HIGH	packages/cli/src/commands/init.ts	187	print('login', {	CODE
HIGH	packages/cli/src/commands/upgrade.ts	191	print('upgrade.progress', {	CODE
HIGH	packages/cli/src/commands/upgrade.ts	200	print('upgrade.progress', {	CODE
HIGH	packages/cli/src/commands/workflow/status.ts	153	print('workflow.status', {	CODE
HIGH	packages/cli/src/commands/workflow/status.ts	168	print('workflow.status', {	CODE
HIGH	packages/cli/src/commands/workflow/status.ts	175	print('workflow.progress', {	CODE
HIGH	packages/cli/src/commands/workflow/generate.ts	200	print('workflow.cleanup', {	CODE
HIGH	…n/src/components/canvas/webhook/webhook-config-tab.tsx	142	print(response.json())`	CODE
HIGH	…common/src/components/canvas/integration-docs/utils.ts	540	print("Final status:", status)	CODE
HIGH	…common/src/components/canvas/integration-docs/utils.ts	547	print(output_res.json())`;	CODE
HIGH	…anvas/integration-docs/components/webhook-docs-tab.tsx	173	print(response.json())`;	CODE

Hyper-Verbose Identifiers84 hits · 86 pts

Severity	File	Line	Snippet	Context
LOW	specs/current/ptc/scripts/ptc_common.py	102	def extract_prompt_from_title(title):	CODE
LOW	…ages/web-core/src/hooks/useTemplateGenerationStatus.ts	24	export function useTemplateGenerationStatus({	CODE
LOW	packages/skill-template/src/scheduler/utils/context.ts	248	export function extractSummaryFromContent(	CODE
LOW	…ckages/skill-template/src/scheduler/utils/extractor.ts	166	function generateSchemaInstructions(schema: z.ZodType): string {	CODE
LOW	packages/skill-template/src/utils/schema-simplifier.ts	63	function simplifyUnionTypesForGemini(schema: JsonSchema \| SchemaProperty): void {	CODE
LOW	packages/skill-template/src/utils/mcp-utils.ts	115	export function convertMcpServersToClientConfig(response: {	CODE
LOW	packages/skill-template/src/utils/context-manager.ts	114	function createHistoryReferenceMessage(	CODE
LOW	packages/skill-template/src/utils/context-manager.ts	221	function calculateCachePrefixBoundary(messages: BaseMessage[]): number {	CODE
LOW	packages/skill-template/src/utils/context-manager.ts	260	function adjustPrefixBoundaryForToolPairing(	CODE
LOW	packages/skill-template/src/utils/context-manager.ts	311	function calculateCompressibleEndIndex(	CODE
LOW	packages/skill-template/src/utils/context-manager.ts	366	function adjustEndIndexForToolPairing(	CODE
LOW	packages/skill-template/src/utils/context-manager.ts	416	function buildCompressibleToolPairGroups(	CODE
LOW	packages/skill-template/src/utils/context-manager.ts	733	export function truncateContextBlockForPrompt(	CODE
LOW	packages/skill-template/src/utils/context-manager.ts	846	export function truncateContextBlockForModelPrompt(	CODE
LOW	packages/skill-template/src/utils/context-manager.ts	947	export async function compressAgentLoopMessages(	CODE
LOW	packages/skill-template/src/utils/context-manager.ts	1022	function truncateToolMessagesForBudget(args: {	CODE
LOW	packages/skill-template/src/adapters/client.ts	51	function createStdioConnectionSchema() {	CODE
LOW	packages/skill-template/src/adapters/client.ts	119	function createStreamableReconnectSchema() {	CODE
LOW	packages/skill-template/src/adapters/client.ts	147	export function createStreamableHTTPConnectionSchema() {	CODE
LOW	packages/skill-template/src/adapters/client.ts	302	function isResolvedStdioConnection(connection: unknown): connection is ResolvedStdioConnection {	CODE
LOW	packages/skill-template/src/adapters/client.ts	322	function isResolvedStreamableHTTPConnection(	CODE
LOW	packages/skill-template/src/adapters/tools.ts	55	function makeAllObjectFieldsRequired(schema: z.ZodTypeAny): z.ZodTypeAny {	CODE
LOW	packages/skill-template/src/skills/agent.ts	52	function getToolParallelConcurrency(): number {	CODE
LOW	packages/layout/src/PrimaryPageLayout.tsx	81	export function PrimaryPageLayoutContextUpdater({	CODE
LOW	packages/providers/src/llm/bedrock-tool-choice.test.ts	8	function langchainInferredToolChoiceValues(	CODE
LOW	packages/providers/src/monitoring/langfuse-wrapper.ts	141	export function wrapChatModelWithMonitoring(	CODE
LOW	packages/providers/src/monitoring/langfuse-wrapper.ts	295	export function wrapEmbeddingsWithMonitoring(	CODE
LOW	packages/utils/src/on-module-init.ts	31	export async function runModuleInitWithTimeoutAndRetry(	CODE
LOW	packages/utils/src/file-id.ts	271	export function replaceAllMarkdownFileIds(	CODE
LOW	packages/utils/src/parse.ts	77	export function parseMarkdownCitationsAndCanvasTags(content: string, _sources: Source[]): string {	CODE
LOW	packages/utils/src/parse.ts	108	export function parseMarkdownWithCitations(content: string, sources: Source[]): string {	CODE
LOW	packages/utils/src/drive-file-mapper.ts	90	export function mapDriveFileToWorkflowNodeExecution(	CODE
LOW	packages/utils/src/drive-file-mapper.ts	152	export function mapDriveFilesToCanvasNodes(files: DriveFile[], serverOrigin: string): CanvasNode[] {	CODE
LOW	packages/utils/src/drive-file-mapper.ts	164	export function mapDriveFilesToWorkflowNodeExecutions(	CODE
LOW	packages/utils/src/query-processor.ts	104	function buildReferencedVariablesJson(	CODE
LOW	packages/utils/src/id.ts	100	export function genVariableExtractionSessionID(): string {	CODE
LOW	packages/utils/src/id.ts	112	export function genWorkflowNodeExecutionID(): string {	CODE
LOW⚡	packages/utils/src/id.ts	380	export function genSkillPackageWorkflowID(): string {	CODE
LOW⚡	packages/utils/src/id.ts	384	export function genSkillPackageInstallationID(): string {	CODE
LOW⚡	packages/utils/src/id.ts	388	export function genSkillPackageWorkflowDepID(): string {	CODE
LOW⚡	packages/utils/src/id.ts	392	export function genSkillPackageWorkflowExecID(): string {	CODE
LOW⚡	packages/utils/src/id.ts	396	export function genSkillPackageExecutionID(): string {	CODE
LOW	packages/utils/src/token.ts	234	function countTokenMedianIntegration(content: string): number {	CODE
LOW	packages/utils/src/translate/index.ts	157	export function detectLanguageFromCharacter(prompt: string): LanguageDetectionResult {	CODE
LOW	packages/cli/src/skill/types.ts	495	export function validateCommonSkillFields(	CODE
LOW	packages/cli/src/skill/types.ts	565	export function validateOptionalSkillFields(	CODE
LOW	packages/cli/src/skill/symlink.ts	187	export function initializeBaseSkillSymlink(): SkillSymlinkResult {	CODE
LOW	packages/cli/src/skill/symlink.ts	201	export function createReflySkillWithSymlink(	CODE
LOW	packages/cli/src/skill/symlink.ts	254	export function deleteDomainSkillWithSymlink(skillName: string): {	CODE
LOW	packages/cli/src/config/paths.ts	148	export function getClaudeSkillSymlinkPath(skillName: string): string {	CODE
LOW	packages/cli/src/platform/manager.ts	81	export async function deploySkillToAllPlatforms(	CODE
LOW	packages/cli/src/platform/manager.ts	149	export async function removeSkillFromAllPlatforms(	CODE
LOW	packages/cli/src/utils/variable-check.ts	81	export function buildMissingVariablesError(	CODE
LOW	packages/cli/src/utils/file-type.ts	111	export function getFileCategoryByMimeType(mimeType: string): FileCategory {	CODE
LOW	packages/cli/src/api/client.ts	694	export async function apiUpdateWorkflowVariables(	CODE
LOW	packages/cli/src/commands/skill/update.ts	61	function generateDescriptionExample(skillName: string): string {	CODE
LOW	packages/cli/src/commands/workflow/run.ts	365	function convertKeyValueToVariables(	CODE
LOW	packages/observability/src/langchain-callback.ts	226	export function getLangfuseCallbackHandler(): LangfuseCallbackHandler \| null {	CODE
LOW	packages/observability/src/langchain-callback.ts	246	export function getLangfuseCallbackHandlerWithMetadata(metadata: {	CODE
LOW	…/ai-workspace-common/src/utils/error-classification.ts	413	export function isCreditInsufficientError(	CODE
24 more matches not shown…

Magic Placeholder Names12 hits · 60 pts

Severity	File	Line	Snippet	Context
HIGH	README.md	259	-H "Authorization: Bearer YOUR_API_KEY" \	CODE
HIGH	README.md	279	-H "Authorization: Bearer YOUR_API_KEY"	CODE
HIGH	README_CN.md	147	-H "Authorization: Bearer YOUR_API_KEY" \	CODE
HIGH	README_CN.md	167	-H "Authorization: Bearer YOUR_API_KEY"	CODE
HIGH	docs/zh/guide/api/openapi.md	15	`Authorization: Bearer YOUR_API_KEY`	CODE
HIGH	docs/en/guide/api/openapi.md	15	`Authorization: Bearer YOUR_API_KEY`	CODE
HIGH	packages/openapi-schema/schema.yml	4713	API_KEY: your_api_key	CODE
HIGH	packages/openapi-schema/src/schemas.gen.ts	161	API_KEY: 'your_api_key',	CODE
HIGH	…s/integration-docs/components/copy-all-docs-button.tsx	218	const examples = generateCodeExamples(endpoint, baseUrl, 'YOUR_API_KEY', pathParams);	CODE
HIGH	…s/integration-docs/components/copy-all-docs-button.tsx	262	const bestPracticeExamples = generateBestPracticesExamples(baseUrl, canvasId, 'YOUR_API_KEY', {	CODE
HIGH	packages/i18n/src/zh-Hans/ui.ts	4590	authHeader: 'Authorization: Bearer YOUR_API_KEY',	CODE
HIGH	packages/i18n/src/en-US/ui.ts	4565	authHeader: 'Authorization: Bearer YOUR_API_KEY',	CODE

Over-Commented Block53 hits · 49 pts

Severity	File	Line	Snippet	Context
LOW	cypress/support/commands.ts	1	/// <reference types="cypress" />	COMMENT
LOW	cypress/support/commands.ts	21	// -- This is a dual command --	COMMENT
LOW	cypress/support/e2e.ts	1	// ***********************************************************	COMMENT
LOW	deploy/docker/docker-compose.self-deploy-dev.yml	1	# Self-deploy development mode	COMMENT
LOW	deploy/docker/langfuse/docker-compose.yml	1	# Langfuse v3 - LLM Observability Platform	COMMENT
LOW	deploy/docker/trace/docker-compose.yml	1	# Trace & Logging Stack - Loki, Tempo, Prometheus, Grafana, OTEL Collector	COMMENT
LOW	deploy/docker/trace/prometheus-config.yaml	1	global:	COMMENT
LOW	deploy/docker/trace/prometheus-config.yaml	21	- job_name: 'reflyd'	COMMENT
LOW	deploy/docker/trace/prometheus-config.yaml	61	# ============================================================================	COMMENT
LOW	deploy/docker/searxng/settings.yml	21	new_issue_url: https://github.com/searxng/searxng/issues/new	COMMENT
LOW	deploy/docker/searxng/settings.yml	41	autocomplete_min: 4	COMMENT
LOW	deploy/docker/searxng/settings.yml	121	static_path: ""	COMMENT
LOW	deploy/docker/searxng/settings.yml	141	# results_on_new_tab: false	COMMENT
LOW	deploy/docker/searxng/settings.yml	161	# - safesearch	COMMENT
LOW	deploy/docker/searxng/settings.yml	181	# key: !!binary "your_morty_proxy_key"	COMMENT
LOW	deploy/docker/searxng/settings.yml	201	enable_http2: true	COMMENT
LOW	deploy/docker/searxng/settings.yml	221	# extra_proxy_timeout: 10	COMMENT
LOW	deploy/docker/searxng/settings.yml	261	active: false	COMMENT
LOW	deploy/docker/searxng/settings.yml	281	#	COMMENT
LOW	deploy/docker/searxng/settings.yml	1341	# MongoDB engine	COMMENT
LOW	deploy/docker/searxng/settings.yml	1601	# - https://pximg.cocomi.eu.org	COMMENT
LOW	deploy/docker/searxng/settings.yml	1741	# timeout: 30.0	COMMENT
LOW	deploy/docker/searxng/settings.yml	1901	shortcut: scc	COMMENT
LOW	deploy/docker/searxng/settings.yml	1921	# api_client_id: *******	COMMENT
LOW	deploy/docker/searxng/settings.yml	1981		COMMENT
LOW	deploy/docker/searxng/settings.yml	2041	# - name: Torznab EZTV	COMMENT
LOW	deploy/docker/searxng/settings.yml	2281	- name: mymemory translated	COMMENT
LOW	deploy/docker/searxng/settings.yml	2661	engine: senscritique	COMMENT
LOW	deploy/docker/searxng/settings.yml	2681	# tokens: []	COMMENT
LOW	deploy/docker/searxng/settings.yml	2701	# Be careful when enabling this engine if you are	COMMENT
LOW	deploy/docker/searxng/settings.yml	2721	# engine: command	COMMENT
LOW	docs/zh/index.md	1	# 欢迎使用 Refly	COMMENT
LOW	scripts/cli-deploy/quick-start.sh	1	#!/bin/bash	COMMENT
LOW	scripts/cli-deploy/deploy-cli.sh	1	#!/bin/bash	COMMENT
LOW	packages/sandbox-agent/src/session.ts	541	return output.content;	COMMENT
LOW	packages/sandbox-agent/src/session.ts	561	// if (filesToDownload.length > 0) {	COMMENT
LOW	packages/agent-tools/src/index.ts	1	export * from './base';	COMMENT
LOW	packages/utils/src/editor/to_markdown.ts	21	/// from inside the marks to outside the marks. This is necessary	COMMENT
LOW	…nvas/launchpad/rich-chat-input/atomic-inline-keymap.ts	61	// const $from = selection.$from;	COMMENT
LOW	…ommon/src/components/canvas/common/helper-line/util.ts	81		COMMENT
LOW	…ommon/src/components/canvas/common/helper-line/util.ts	101	// \| A \|	COMMENT
LOW	…ommon/src/components/canvas/common/helper-line/util.ts	121	// \|‾‾‾‾‾‾‾‾‾‾‾\|	COMMENT
LOW	…rc/components/canvas/front-page/chat-mode-selector.tsx	41	return (	COMMENT
LOW	…ai-workspace-common/src/hooks/use-available-voucher.ts	61	loading: voucherLoading,	COMMENT
LOW	…ai-workspace-common/src/hooks/use-available-voucher.ts	81	// } catch (error) {	COMMENT
LOW	apps/api/load-tests/run-all.sh	1	#!/bin/bash	COMMENT
LOW	apps/api/src/modules/skill/skill-invoker.service.ts	1401	const routedData = config?.routedData;	COMMENT
LOW	apps/api/src/modules/skill/skill-invoker.service.ts	1621	// ? 'token_limit_exceeded'	COMMENT
LOW	…/src/modules/skill-package/skill-package.controller.ts	401	// @ApiResponse({ status: 200, description: 'Skill package deleted' })	COMMENT
LOW	…/src/modules/skill-package/skill-package.controller.ts	421	// throw error;	COMMENT
LOW	…/src/modules/subscription/subscription.service.spec.ts	241	// customer: 'cus_123',	COMMENT
LOW	…/src/modules/subscription/subscription.service.spec.ts	261		COMMENT
LOW	apps/api/src/modules/collab/collab.controller.ts	21	// async loadDocument(@LoginedUser() user: User, @Query('name') name: string) {	COMMENT

Redundant / Tautological Comments15 hits · 21 pts

Severity	File	Line	Snippet	Context
LOW	deploy/docker/elasticsearch-entrypoint.sh	13	# Check if the plugin is already installed	COMMENT
LOW	scripts/wait-for-container-health.sh	24	# Check if any arguments were provided	COMMENT
LOW⚡	scripts/cli-deploy/quick-start.sh	185	# Check if seed script exists	COMMENT
LOW⚡	scripts/cli-deploy/quick-start.sh	208	# Check if API is already running	COMMENT
LOW⚡	scripts/cli-deploy/quick-start.sh	234	# Check if already logged in	COMMENT
LOW⚡	scripts/cli-deploy/deploy-cli.sh	107	# Check if Docker is running	COMMENT
LOW⚡	scripts/cli-deploy/deploy-cli.sh	238	# Check if already logged in	COMMENT
LOW	packages/sandbox-agent/verify-setup.sh	21	# Check if version is >= 18	COMMENT
LOW	packages/sandbox-agent/verify-setup.sh	43	# Check if node_modules exists	COMMENT
LOW	.github/workflows/deploy-test.yml	57	# Check if there are any merged issues	COMMENT
LOW	.github/workflows/deploy-test.yml	311	# Check if the update was successful	COMMENT
LOW	.github/workflows/deploy-to-staging.yml	37	# Check if project exists	COMMENT
LOW	.github/workflows/deploy-to-staging.yml	92	# Check if branch exists remotely	COMMENT
LOW	.github/workflows/deploy-to-staging.yml	147	# Check if the update was successful	COMMENT
LOW	apps/api/load-tests/run-all.sh	35	# Check if k6 is installed	COMMENT

Slop Phrases6 hits · 18 pts

Severity	File	Line	Snippet	Context
MEDIUM	deploy/docker/searxng/settings.yml	280	# Alternatively you can use external files for configuring the "Hostnames plugin":	COMMENT
MEDIUM	deploy/docker/searxng/settings.yml	913	# Or you can use the html non-stable engine, activated by default	COMMENT
MEDIUM	deploy/docker/searxng/settings.yml	2107	# Or you can use the html non-stable engine, activated by default	COMMENT
MEDIUM	deploy/docker/searxng/settings.yml	2271	# Or you can use the html non-stable engine, activated by default	COMMENT
MEDIUM	packages/agent-tools/src/notion/index.ts	401	// This is a basic implementation - in production you'd want more comprehensive parsing	COMMENT
MEDIUM	…c/modules/common/vector-search/backend/filter-utils.ts	262	// This is a basic implementation - for production use, consider using a proper SQL parser	COMMENT

AI Slop Vocabulary4 hits · 12 pts

Severity	File	Line	Snippet	Context
MEDIUM	…nts/markdown/plugins/artifact-thinking/rehypePlugin.ts	15	// Extract content using our robust method	COMMENT
MEDIUM	…nts/markdown/plugins/artifact-thinking/rehypePlugin.ts	50	// Extract content using our robust method	COMMENT
MEDIUM	…mponents/markdown/plugins/artifact-thinking/render.tsx	11	// More robust check - look for both the opening tag (anywhere) and the closing tag (after the opening)	COMMENT
MEDIUM	.github/workflows/deploy-to-prod.yml	12	# Default least privilege; deploy jobs elevate only what they need.	COMMENT

Fake / Example Data8 hits · 8 pts

Severity	File	Line	Snippet	Context
LOW	packages/utils/src/validator.test.ts	24	const obj = { name: 'John Doe' };	CODE
LOW	packages/utils/src/validator.test.ts	110	const obj = { name: 'John Doe' };	CODE
LOW	packages/utils/src/validator.test.ts	485	name: 'John Doe',	CODE
LOW	packages/utils/src/validator.test.ts	588	name: 'John Doe',	CODE
LOW	packages/openapi-schema/src/schemas.gen.ts	3021	example: 'John Doe',	CODE
LOW	packages/openapi-schema/src/schemas.gen.ts	6383	example: 'John Doe',	CODE
LOW	…/components/canvas/launchpad/rich-chat-input/index.tsx	427	key: new PluginKey('placeholder'),	CODE
LOW	…/src/modules/schedule/schedule-email-templates.spec.ts	77	userName: 'John Doe',	CODE

Synthetic Comment Markers1 hit · 8 pts

Severity	File	Line	Snippet	Context
HIGH	…rc/modules/tool/handlers/post/composio-post.service.ts	586	// Include Tavily's AI-generated answer if available (no filtering needed for AI response)	COMMENT

Example Usage Blocks3 hits · 4 pts

Severity	File	Line	Snippet	Context
LOW	deploy/docker/langfuse/docker-compose.yml	4	# Usage:	COMMENT
LOW	deploy/docker/trace/docker-compose.yml	4	# Usage:	COMMENT
LOW	apps/api/load-tests/run-all.sh	5	# Usage:	COMMENT

Deep Nesting4 hits · 4 pts

Severity	File	Line	Context
LOW	specs/current/ptc/scripts/ptc_debug_calling.py	52	CODE
LOW	specs/current/ptc/scripts/ptc_debug_calling.py	76	CODE
LOW	specs/current/ptc/scripts/ptc_debug_calling.py	162	CODE
LOW	specs/current/ptc/scripts/ptc_debug_billing.py	26	CODE

Unused Imports1 hit · 1 pts

Severity	File	Line	Snippet	Context
LOW	specs/current/ptc/scripts/ptc_debug_billing.py	4		CODE

Excessive Try-Catch Wrapping1 hit · 1 pts

Severity	File	Line	Snippet	Context
LOW	…ll-template/src/prompts/templates/partials/ptc-mode.md	39	except Exception as e:	CODE

refly-ai/refly

Open-Source Code Quality, Security and Technical Debt Review