7.4 billion tokens per month. 34 free LLM providers. 635 free model endpoints. All behind one /v1 endpoint, plus any custom OpenAI-compatible endpoint. Smart routing, automatic failover, encrypted keys. Personal experimentation only.
This report presents the forensic synthetic code analysis of tashfeenahmed/freellmapi, a TypeScript project with 21,587 GitHub stars. SynthScan v2.0 examined 214,591 lines of code across 683 source files, recording 519 pattern matches distributed across 10 syntactic categories. The overall adjusted score of 3.8 places this repository in the Likely human-written band.
The scanner applied 160+ deterministic lexical heuristics, multi-line block detectors, abstract syntax tree depth profilers, and a cross-file Jaccard similarity matrix to construct a statistically normalised synthetic code estimate. All matches are individually weighted by severity coefficient and contextual multiplier before summation, and the resulting headline score is temporally discounted to account for the repository's development history relative to the commercial emergence of large language model coding tooling (November 2022 onward).
This chart maps the temporal evolution of the adjusted synthetic code score across successive scan runs. An upward trajectory indicates ongoing incorporation of AI-generated code or expanding LLM-assisted scaffolding; a stable or declining trajectory may reflect active human refactoring, code removal, or the adoption of stricter authorship policies. The dashed secondary line (right axis) independently tracks total raw pattern hit count, which can diverge from the normalised score when codebase size changes significantly between scans.
Classifies detected patterns by their diagnostic confidence and structural impact. CRITICAL patterns (coefficient 10) represent definitive synthetic signatures — hallucinated imports, explicit LLM attribution metadata — virtually never produced by human authors. HIGH (5) indicates strong structural tells such as cross-file repetition or cross-linguistic idioms. MEDIUM (2) covers recognisable conversational padding and AI-specific vocabulary. LOW (1) captures subtle indicators like tautological comments and generic boilerplate that require density to carry independent signal.
This horizontal bar chart decomposes the repository's raw synthetic code score by top-level directory, allowing you to pinpoint precisely which modules or components carry the highest AI authorship density. Directories with disproportionately high scores relative to their size warrant targeted manual review: concentrated AI signatures often trace back to mass-generated configuration layers, auto-ported test suites, LLM-scaffolded boilerplate classes, or entire subsystems authored under heavy copilot assistance. Use this view to prioritise your human code-review effort.
The scanner identified 519 distinct pattern matches across 10 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a statistically significant AI authorship indicator. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the diagnostic confidence level (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — comment-context matches receive a ×1.5 weight because LLMs systematically over-annotate. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier as dense clusters constitute far stronger evidence of synthetic authorship than isolated hits.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | desktop/src/main.ts | 94 | // ── popover IPC ────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/src/providers/index.ts | 438 | // ── Chinese domestic providers (#922/#923/#924) ───────────────────────────── | COMMENT |
| MEDIUM | server/src/providers/index.ts | 438 | // ── Chinese domestic providers (#922/#923/#924) ───────────────────────────── | COMMENT |
| MEDIUM | server/src/__tests__/providers/google.test.ts | 627 | // ── Streaming ────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/src/__tests__/providers/google.test.ts | 726 | // ── timeoutMs plumbing ──────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/src/__tests__/lib/exhaustion-statuses.test.ts | 71 | // ── isContextTooLargeError: real provider error shapes ─────────────────────── | COMMENT |
| MEDIUM | server/src/__tests__/lib/exhaustion-statuses.test.ts | 143 | // ── exhaustedRetryError: failure-kind → terminal-status taxonomy ───────────── | COMMENT |
| MEDIUM | server/src/__tests__/lib/exhaustion-statuses.test.ts | 261 | // ── routingExhaustionBody: zero attempts ran ───────────────────────────────── | COMMENT |
| MEDIUM | server/src/__tests__/lib/exhaustion-statuses.test.ts | 341 | // ── Wire helpers: OpenAI error payload + Retry-After header ────────────────── | COMMENT |
| MEDIUM | server/src/__tests__/lib/exhaustion-statuses.test.ts | 377 | // ── End-to-end through the shared loop ─────────────────────────────────────── | COMMENT |
| MEDIUM | server/src/__tests__/routes/routing-semantics.test.ts | 232 | // ── #919: remaining-quota key selection ───────────────────────────────────── | COMMENT |
| MEDIUM | server/src/__tests__/routes/routing-semantics.test.ts | 232 | // ── #919: remaining-quota key selection ───────────────────────────────────── | COMMENT |
| MEDIUM | server/src/__tests__/routes/logs.test.ts | 86 | // ── Capture ──────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/src/__tests__/routes/logs.test.ts | 156 | // ── Structured events ────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/src/__tests__/routes/logs.test.ts | 198 | // ── Storage ──────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/src/__tests__/routes/logs.test.ts | 248 | // ── API ──────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/src/__tests__/routes/logs.test.ts | 365 | // ── Auth ─────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/src/__tests__/routes/logs.test.ts | 376 | // ── Retention ────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/src/__tests__/routes/anthropic.test.ts | 516 | // ── Same-model cross-provider failover (#932) ──────────────────────────── | COMMENT |
| MEDIUM | server/src/__tests__/routes/anthropic.test.ts | 516 | // ── Same-model cross-provider failover (#932) ──────────────────────────── | COMMENT |
| MEDIUM | server/src/lib/provider-identity.ts | 1 | // ── Provider identity for analytics ───────────────────────────────────────── | COMMENT |
| MEDIUM | server/src/lib/fallback-loop.ts | 61 | // ── Model-level failure benching ───────────────────────────────────────────── | COMMENT |
| MEDIUM | server/src/lib/fallback-loop.ts | 115 | // ── Wall-clock retry budget ────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/src/lib/fallback-loop.ts | 222 | // ── Empty-completion streak (issue #751) ───────────────────────────────────── | COMMENT |
| MEDIUM | server/src/lib/fallback-loop.ts | 222 | // ── Empty-completion streak (issue #751) ───────────────────────────────────── | COMMENT |
| MEDIUM | server/src/lib/fallback-loop.ts | 342 | // ── Upstream 401 handling (key-fatal, not request-fatal) ───────────────────── | COMMENT |
| MEDIUM | server/src/lib/fallback-loop.ts | 402 | // ── Attempt trail ───────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/src/lib/fallback-loop.ts | 461 | // ── Detailed failover trace header (opt-in) ────────────────────────────────── | COMMENT |
| MEDIUM | server/src/lib/fallback-loop.ts | 801 | // ── Routing exhaustion (zero attempts ran) ─────────────────────────────────── | COMMENT |
| MEDIUM⚡ | server/src/lib/guardrails.ts | 58 | // ── Token budget (pre-flight) ──────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/src/lib/server-logs.ts | 87 | // ── State ──────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/src/lib/server-logs.ts | 112 | // ── Formatting ─────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/src/lib/server-logs.ts | 149 | // ── Ingest ─────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/src/lib/server-logs.ts | 256 | // ── Persistence ────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/src/lib/server-logs.ts | 395 | // ── Read side ──────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/src/lib/sampling-params.ts | 190 | // ── Per-platform support policy ────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/src/lib/sampling-params.ts | 365 | // ── Unified output-token cap ───────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/src/lib/endpoint-scope.ts | 1 | // ── Endpoint identity for custom relay models (#651) ──────────────────────── | COMMENT |
| MEDIUM | server/src/lib/endpoint-scope.ts | 1 | // ── Endpoint identity for custom relay models (#651) ──────────────────────── | COMMENT |
| MEDIUM | server/src/lib/error-classify.ts | 113 | // ── Transport failures hidden in the cause chain (undici) ──────────────────── | COMMENT |
| MEDIUM | server/src/lib/error-classify.ts | 229 | // ── Timeout wording ───────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/src/lib/error-classify.ts | 253 | // ── Client-caused aborts ───────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/src/lib/error-classify.ts | 279 | // ── Fallback time-budget hedging (fallback-v2) ────────────────────────────── | COMMENT |
| MEDIUM | server/src/lib/error-classify.ts | 554 | // ── Permanent upstream retirement (issue #634) ─────────────────────────────── | COMMENT |
| MEDIUM | server/src/lib/error-classify.ts | 554 | // ── Permanent upstream retirement (issue #634) ─────────────────────────────── | COMMENT |
| MEDIUM | server/src/routes/fallback.ts | 22 | // ── Bandit routing strategy ───────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/src/routes/anthropic.ts | 53 | // ── Request schema ────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/src/routes/anthropic.ts | 132 | // ── Response shape ────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/src/routes/anthropic.ts | 194 | // ── Auth (shared with the OpenAI route) ───────────────────────────────────── | COMMENT |
| MEDIUM | server/src/routes/anthropic.ts | 205 | // ── Request translation: Anthropic → internal (OpenAI-shaped) ─────────────── | COMMENT |
| MEDIUM | server/src/routes/anthropic.ts | 381 | // ── Response translation: internal → Anthropic ────────────────────────────── | COMMENT |
| MEDIUM | server/src/routes/anthropic.ts | 417 | // ── SSE helpers ───────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/src/routes/mcp.ts | 12 | // ───────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/src/routes/mcp.ts | 30 | // ───────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/src/routes/mcp.ts | 66 | // ── Tool implementations ───────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/src/routes/mcp.ts | 187 | // ── Tool registry ──────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/src/routes/mcp.ts | 249 | // ── JSON-RPC dispatch ──────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/src/routes/keys.ts | 611 | // ── Custom OpenAI-compatible providers (#117, #212) ─────────────────────── | COMMENT |
| MEDIUM | server/src/routes/keys.ts | 611 | // ── Custom OpenAI-compatible providers (#117, #212) ─────────────────────── | COMMENT |
| MEDIUM | server/src/routes/proxy.ts | 1618 | // ── Fusion: multi-model synthesis ────────────────────────────────────────── | COMMENT |
| 69 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | desktop/src/server-host.ts | 41 | // This function mirrors the boot sequence of server/src/index.ts — every | COMMENT |
| LOW | desktop/src/server-host.ts | 81 | // password is random and never shown), so password re-verification for | COMMENT |
| LOW | desktop/src/logger.ts | 1 | // A file log for the desktop app (#824). | COMMENT |
| LOW | desktop/src/preload.ts | 21 | COMMENT | |
| LOW | desktop/src/__tests__/version.test.ts | 1 | import { readFileSync } from 'node:fs'; | COMMENT |
| LOW | server/src/app.ts | 101 | ...cfg.dashboardOrigins, | COMMENT |
| LOW | server/src/app.ts | 181 | // 10MB and used to 413 HERE, before auth/routing: no fallback attempt, no | COMMENT |
| LOW | server/src/app.ts | 201 | // auth scheme. Its legacy /api/embeddings handler explicitly falls through | COMMENT |
| LOW | server/src/app.ts | 221 | const adminRateLimiter = createAdminRateLimiter(); | COMMENT |
| LOW | server/src/app.ts | 281 | // OpenAI-compatible proxy. Per-IP rate limiting (#35 item #6) runs first so | COMMENT |
| LOW | server/src/app.ts | 301 | // like /v1 — NOT behind the dashboard session gate. Same per-IP limiter as | COMMENT |
| LOW | server/src/app.ts | 321 | if (cfg.serveStaticAssets) { | COMMENT |
| LOW | server/src/middleware/rateLimit.ts | 1 | import type { Request, Response, NextFunction } from 'express'; | COMMENT |
| LOW | server/src/providers/openai-compat.ts | 261 | // the whitespace between two valid JSON documents. | COMMENT |
| LOW | server/src/providers/google.ts | 21 | COMMENT | |
| LOW | server/src/providers/index.ts | 41 | platform: 'bai', | COMMENT |
| LOW | server/src/providers/index.ts | 61 | platform: 'anyapi', | COMMENT |
| LOW | server/src/providers/index.ts | 121 | // openai-compat chat routing plus console autodetect: the domestic | COMMENT |
| LOW | server/src/providers/index.ts | 141 | baseUrl: 'https://router.huggingface.co/v1', | COMMENT |
| LOW | server/src/providers/index.ts | 181 | // text.pollinations.ai host returned 502 in the July 2026 audit; publishable | COMMENT |
| LOW | server/src/providers/index.ts | 201 | // adapter as Groq/OpenRouter. A handful of promotional models are free for a | COMMENT |
| LOW | server/src/providers/index.ts | 221 | platform: 'ovh', | COMMENT |
| LOW | server/src/providers/index.ts | 241 | platform: 'agnes', | COMMENT |
| LOW | server/src/providers/index.ts | 381 | // NOT the API); the real API is api.unorouter.com/v1. Free key from | COMMENT |
| LOW | server/src/providers/index.ts | 401 | // reports free_tokens limit_per_day=5,000,000; paid models answer an instant | COMMENT |
| LOW | server/src/providers/index.ts | 421 | // account-wide. Token from modelscope.cn/my/myaccesstoken, BUT calls only work | COMMENT |
| LOW | server/src/docs/docs-page.ts | 1 | // Self-contained API reference page served at `GET /v1/docs`. | COMMENT |
| LOW | server/src/docs/openapi.ts | 1 | // Hand-written OpenAPI 3.0 description of the public `/v1` surface. | COMMENT |
| LOW | server/src/__tests__/lib/module-purity.test.ts | 1 | import fs from 'node:fs'; | COMMENT |
| LOW | server/src/__tests__/lib/module-purity.test.ts | 121 | it('every listed module actually exists', () => { | COMMENT |
| LOW | …_tests__/routes/responses-fallback-convergence.test.ts | 1 | import { describe, it, expect, beforeAll, beforeEach, vi } from 'vitest'; | COMMENT |
| LOW | server/src/__tests__/routes/rescue-wants-tools.test.ts | 1 | import { describe, it, expect, beforeAll, beforeEach, afterEach, vi } from 'vitest'; | COMMENT |
| LOW | server/src/__tests__/routes/analytics.test.ts | 481 | // #889 — custom endpoints all share the platform id 'custom', so the | COMMENT |
| LOW | server/src/__tests__/routes/auth-reset-password.test.ts | 1 | import { describe, it, expect, beforeEach, afterAll, vi } from 'vitest'; | COMMENT |
| LOW | server/src/__tests__/services/ratelimit.test.ts | 141 | // 1st 429 → transient (no signal yet). Subsequent 429s stay transient | COMMENT |
| LOW | server/src/__tests__/services/router-bandit.test.ts | 461 | it('a saved intelligence_rank override visibly moves the axis (#673)', () => { | COMMENT |
| LOW | server/src/lib/image-normalize.ts | 1 | import type { ChatMessage } from '@freellmapi/shared/types.js'; | COMMENT |
| LOW | server/src/lib/image-normalize.ts | 21 | // hiccup. | COMMENT |
| LOW | server/src/lib/tool-args.ts | 1 | // Schema-aware repair of double-encoded tool-call arguments. | COMMENT |
| LOW | server/src/lib/provider-identity.ts | 1 | // ── Provider identity for analytics ───────────────────────────────────────── | COMMENT |
| LOW | server/src/lib/setup-code.ts | 1 | import { createOneTimeCode } from './one-time-code.js'; | COMMENT |
| LOW | server/src/lib/think-tags.ts | 1 | import type { ChatCompletionChunk } from '@freellmapi/shared/types.js'; | COMMENT |
| LOW | server/src/lib/header-value.ts | 1 | // Header-value sanitizer for the diagnostics headers built out of provider and | COMMENT |
| LOW | server/src/lib/fallback-loop.ts | 1 | // One shared provider retry/fallback loop for every OpenAI-, Responses- and | COMMENT |
| LOW | server/src/lib/fallback-loop.ts | 61 | // ── Model-level failure benching ───────────────────────────────────────────── | COMMENT |
| LOW | server/src/lib/fallback-loop.ts | 301 | if (isModelNotFoundError(err) || isModelAccessForbiddenError(err) || isContextTooLargeError(err) || err?.skipModelForR | COMMENT |
| LOW | server/src/lib/fallback-loop.ts | 461 | // ── Detailed failover trace header (opt-in) ────────────────────────────────── | COMMENT |
| LOW | server/src/lib/fallback-loop.ts | 801 | // ── Routing exhaustion (zero attempts ran) ─────────────────────────────────── | COMMENT |
| LOW | server/src/lib/fallback-loop.ts | 901 | timedOut: boolean; | COMMENT |
| LOW | server/src/lib/fallback-loop.ts | 921 | // attempt's fetch/body/stream is canceled the moment the client goes; the | COMMENT |
| LOW | server/src/lib/fallback-loop.ts | 1101 | outcome, | COMMENT |
| LOW | server/src/lib/fallback-loop.ts | 1141 | let outcome: DispatchOutcome; | COMMENT |
| LOW | server/src/lib/fallback-loop.ts | 1201 | // A still-exempt skipBench failure (format ignored, hidden-reasoning | COMMENT |
| LOW | server/src/lib/guardrails.ts | 1 | // Request-level guardrails: two hard limits, both OFF by default so an | COMMENT |
| LOW | server/src/lib/provider-timeout.ts | 1 | // Per-provider HTTP timeout overrides (issue #547, reworked from PR #509). | COMMENT |
| LOW | server/src/lib/content.ts | 141 | } | COMMENT |
| LOW | server/src/lib/attempt-trace.ts | 1 | // Per-request attempt trace: the durable record of the failover ladder one | COMMENT |
| LOW | server/src/lib/attempt-trace.ts | 21 | // finish (mid-stream error the surface rendered honestly, or | COMMENT |
| LOW | server/src/lib/served-model.ts | 1 | // Served-model drift guard (#534 follow-up). | COMMENT |
| LOW | server/src/lib/served-model.ts | 21 | // differs is treated as drift. | COMMENT |
| 141 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | server/src/providers/google.ts | 66 | function noteDummyThoughtSignature(name: string | undefined): void { | CODE |
| LOW | server/src/providers/modelscope.ts | 16 | function modelscopeValidateCacheMs(): number { | CODE |
| LOW | server/src/__tests__/db/migrate/roundtrip.test.ts | 169 | function getLatestAppliedMigrationName(db: Database.Database): string { | CODE |
| LOW | server/src/__tests__/db/migrate/roundtrip.test.ts | 193 | function getEnabledZenDeadPromoCount(db: Database.Database): number { | CODE |
| LOW | server/src/__tests__/routes/proxy-stream-usage.test.ts | 89 | function sseResponseUsageMidStream() { | CODE |
| LOW | server/src/__tests__/routes/proxy-stream-usage.test.ts | 111 | function sseResponseUsageOnContentFrame() { | CODE |
| LOW | server/src/__tests__/services/custom-model-sync.test.ts | 32 | function addDisabledCustomEndpoint(baseUrl: string, label = 'disabled-endpoint'): void { | CODE |
| LOW | server/src/__tests__/services/catalog-sync.test.ts | 77 | function existingAsCatalogEmbeddings(): CatalogEmbedding[] { | CODE |
| LOW | server/src/lib/custom-provider-cleanup.ts | 31 | export function deleteUnusedCustomEndpointKey(db: Db, keyId: number | null | undefined) { | CODE |
| LOW | server/src/lib/fallback-loop.ts | 234 | export function resetEmptyCompletionStreaks(): void { | CODE |
| LOW | server/src/lib/fallback-loop.ts | 250 | function consumeSkipBenchExemption(route: RouteResult, err: any): boolean { | CODE |
| LOW | server/src/lib/fallback-loop.ts | 483 | export function isFallbackDetailHeaderEnabled(): boolean { | CODE |
| LOW⚡ | server/src/lib/guardrails.ts | 49 | export function getRequestMaxTokensBudget(): number { | CODE |
| LOW⚡ | server/src/lib/guardrails.ts | 54 | export function getMaxConsecutiveUpstreamFails(): number { | CODE |
| LOW | server/src/lib/provider-timeout.ts | 57 | export function streamStallTimeoutEnvName(platform: string): string { | CODE |
| LOW | server/src/lib/content.ts | 113 | export function truncateMessagesForGithub( | CODE |
| LOW | server/src/lib/crypto.ts | 178 | export function isEncryptionKeyInitialized(): boolean { | CODE |
| LOW | server/src/lib/served-model.ts | 50 | export function resetServedModelObservations(): void { | CODE |
| LOW | server/src/lib/error-redaction.ts | 18 | export function sanitizeProviderErrorMessage(message: unknown): string { | CODE |
| LOW | server/src/lib/tool-validate.ts | 37 | export function isToolArgumentValidationEnabled(): boolean { | CODE |
| LOW | server/src/lib/tool-validate.ts | 151 | export function invalidToolArgumentsError(displayName: string, reasons: string[]): Error { | CODE |
| LOW | server/src/lib/url-guard.ts | 144 | export function isLoopbackOrPrivateHostname(hostname: string): boolean { | CODE |
| LOW | server/src/lib/config.ts | 30 | function parseRequestBodyLimitBytes(): number { | CODE |
| LOW | server/src/lib/config.ts | 84 | function parseCspUpgradeInsecureRequests(): boolean | undefined { | CODE |
| LOW | server/src/lib/sampling-params.ts | 402 | export function platformDropsResponseFormat(platform: string): boolean { | CODE |
| LOW | server/src/lib/sampling-params.ts | 423 | export function supportedParametersForPlatforms(platforms: string[], caps: { tools?: boolean } = {}): string[] { | CODE |
| LOW | server/src/lib/error-classify.ts | 355 | export function isDailyQuotaExhaustedError(err: any): boolean { | CODE |
| LOW | server/src/lib/error-classify.ts | 421 | export function isUpstreamClassificationOutput(text: unknown, platform?: string): boolean { | CODE |
| LOW | server/src/lib/error-classify.ts | 430 | export function isProviderBadRequestError(err: any): boolean { | CODE |
| LOW | server/src/lib/error-classify.ts | 517 | export function isModelAccessForbiddenError(err: any): boolean { | CODE |
| LOW | server/src/db/index.ts | 140 | function parseDirHardeningOverride(): boolean | undefined { | CODE |
| LOW | server/src/db/index.ts | 187 | function restrictDbFilePermissions(resolvedPath: string): void { | CODE |
| LOW | server/src/db/migrate/cli.ts | 104 | function updateDefaultMigrationRegistry(filename: string): void { | CODE |
| LOW | server/src/db/migrate/runner.ts | 98 | function initializeMigrationTracking(db: Db): void { | CODE |
| LOW | server/src/db/migrate/runner.ts | 173 | function runLatestDownMigrationSync( | CODE |
| LOW | server/src/db/migrate/runner.ts | 213 | function getDefaultMigrationRecords(): MigrationRecord[] { | CODE |
| LOW | server/src/db/migrate/runner.ts | 262 | function getMigrationFileExtension(options: MigrationRunnerOptions): '.ts' | '.js' { | CODE |
| LOW | server/src/routes/anthropic.ts | 115 | export function effortFromAnthropicThinking( | CODE |
| LOW | server/src/routes/proxy.ts | 921 | function completionPromptToMessages(prompt: string, suffix?: string): ChatMessage[] { | CODE |
| LOW | server/src/routes/responses.ts | 286 | export function responsesInputHasFileIdImage(req: ResponsesRequest): boolean { | CODE |
| LOW | server/src/routes/responses.ts | 304 | export function responsesInputRequestsComputerUse(req: ResponsesRequest): boolean { | CODE |
| LOW | server/src/services/model-state.ts | 131 | export function recordCatalogModelTombstone( | CODE |
| LOW | server/src/services/model-state.ts | 164 | export function retireCatalogModelUpstream( | CODE |
| LOW | server/src/services/model-state.ts | 184 | export function reinstateUpstreamRetiredCatalogModel( | CODE |
| LOW | server/src/services/model-state.ts | 201 | export function clearCatalogModelTombstone( | CODE |
| LOW | server/src/services/model-state.ts | 253 | export function modelsWithOverriddenField( | CODE |
| LOW | server/src/services/model-state.ts | 299 | export function deleteTombstonedCatalogModels(db: Db): number { | CODE |
| LOW | server/src/services/provider-quota.ts | 80 | export function getQuotaObservationContext(): QuotaObservationContext | undefined { | CODE |
| LOW | server/src/services/provider-quota.ts | 239 | export function parseQuotaObservationsFromResponse( | CODE |
| LOW | server/src/services/provider-quota.ts | 422 | export function recordQuotaObservationsFromResponse( | CODE |
| LOW | server/src/services/provider-quota.ts | 438 | function normalizeExpiredQuotaState(db: ReturnType<typeof getDb>): void { | CODE |
| LOW | server/src/services/provider-quota.ts | 522 | export function invalidateKeyQuotaHeadroom(platform?: Platform): void { | CODE |
| LOW | server/src/services/custom-endpoint.ts | 63 | function defaultCustomEndpointLabel(baseUrl: string): string { | CODE |
| LOW | server/src/services/custom-model-tombstone.ts | 18 | export function recordCustomModelTombstone( | CODE |
| LOW | server/src/services/custom-model-tombstone.ts | 41 | export function clearCustomModelTombstone( | CODE |
| LOW | server/src/services/profile-models.ts | 35 | export function ensureAllModelsInProfiles(db: Db): void { | CODE |
| LOW | server/src/services/router.ts | 592 | function invalidateCommunityPriorCache(): void { | CODE |
| LOW | server/src/services/router.ts | 936 | function usableKeyCountsByPlatform(db: Db): Map<string, number> { | CODE |
| LOW | server/src/services/router.ts | 1334 | function orderKeysByRemainingQuota(entry: ChainRow, ordered: KeyRow[]): KeyRow[] { | CODE |
| LOW | server/src/services/router.ts | 1676 | export function resolveModelGroupCandidates( | CODE |
| 39 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | server/src/__tests__/routes/auth-setup-code.test.ts | 38 | const CREDS = { email: 'admin@example.com', password: 'supersecret' }; | CODE |
| LOW | server/src/__tests__/routes/auth.test.ts | 60 | const { status, body } = await call(app, 'POST', '/api/auth/setup', { email: 'admin@example.com', password: 'superse | CODE |
| LOW⚡ | server/src/__tests__/routes/auth.test.ts | 73 | const ok = await call(app, 'POST', '/api/auth/login', { email: 'admin@example.com', password: 'supersecret' }); | CODE |
| LOW⚡ | server/src/__tests__/routes/auth.test.ts | 77 | const bad = await call(app, 'POST', '/api/auth/login', { email: 'admin@example.com', password: 'wrongpassword' }); | CODE |
| LOW⚡ | server/src/__tests__/routes/auth.test.ts | 84 | expect(body).toMatchObject({ needsSetup: false, authenticated: true, email: 'admin@example.com' }); | CODE |
| LOW⚡ | server/src/__tests__/routes/auth.test.ts | 88 | const login = await call(app, 'POST', '/api/auth/login', { email: 'admin@example.com', password: 'supersecret' }); | CODE |
| LOW | …/src/__tests__/routes/custom-provider-multikey.test.ts | 330 | await post(app, '/api/keys/custom', { baseUrl: ENDPOINT, model: 'placeholder', apiKey: 'second-secret' }); | CODE |
| LOW | …/src/__tests__/routes/custom-provider-multikey.test.ts | 333 | expect((await del(app, `/api/models/custom/${chatModel('placeholder')!.id}`)).status).toBe(200); | CODE |
| LOW | client/src/i18n/locales/tr.json | 986 | "placeholder": "Sayfaları, modelleri, eylemleri arayın…", | CODE |
| LOW | client/src/i18n/locales/or.json | 986 | "placeholder": "ପୃଷ୍ଠା, ମଡେଲ୍, କ୍ରିୟାଗୁଡିକ ସନ୍ଧାନ କରନ୍ତୁ...", | CODE |
| LOW | client/src/i18n/locales/hu.json | 986 | "placeholder": "Keresőoldalak, modellek, akciók...", | CODE |
| LOW | client/src/i18n/locales/mr.json | 986 | "placeholder": "पृष्ठे, मॉडेल, क्रिया शोधा…", | CODE |
| LOW | client/src/i18n/locales/lt.json | 986 | "placeholder": "Paieškos puslapiai, modeliai, veiksmai...", | CODE |
| LOW | client/src/i18n/locales/bn.json | 986 | "placeholder": "অনুসন্ধান পৃষ্ঠা, মডেল, কর্ম…", | CODE |
| LOW | client/src/i18n/locales/ha.json | 986 | "placeholder": "Bincika shafuka, samfura, ayyuka…", | CODE |
| LOW | client/src/i18n/locales/ig.json | 986 | "placeholder": "Chọọ ibe, ụdị, omume…", | CODE |
| LOW | client/src/i18n/locales/yo.json | 986 | "placeholder": "Ṣewadii awọn oju-iwe, awọn awoṣe, awọn iṣe…", | CODE |
| LOW | client/src/i18n/locales/nl.json | 986 | "placeholder": "Zoek pagina's, modellen, acties...", | CODE |
| LOW | client/src/i18n/locales/ms.json | 986 | "placeholder": "Halaman carian, model, tindakan...", | CODE |
| LOW | client/src/i18n/locales/ja.json | 986 | "placeholder": "ページ、モデル、アクションを検索します...", | CODE |
| LOW | client/src/i18n/locales/de.json | 986 | "placeholder": "Suchseiten, Modelle, Aktionen…", | CODE |
| LOW | client/src/i18n/locales/ru.json | 986 | "placeholder": "Поиск по страницам, моделям, действиям…", | CODE |
| LOW | client/src/i18n/locales/pl.json | 986 | "placeholder": "Przeszukaj strony, modele, działania…", | CODE |
| LOW | client/src/i18n/locales/uk.json | 986 | "placeholder": "Пошук сторінок, моделей, дій…", | CODE |
| LOW | client/src/i18n/locales/fi.json | 986 | "placeholder": "Hakusivuja, malleja, toimintoja...", | CODE |
| LOW | client/src/i18n/locales/ta.json | 986 | "placeholder": "தேடல் பக்கங்கள், மாதிரிகள், செயல்கள்...", | CODE |
| LOW | client/src/i18n/locales/ur.json | 986 | "placeholder": "تلاش کے صفحات، ماڈل، اعمال…", | CODE |
| LOW | client/src/i18n/locales/zh-CN.json | 986 | "placeholder": "搜索页面、模型、操作…", | CODE |
| LOW | client/src/i18n/locales/sk.json | 986 | "placeholder": "Vyhľadávajte stránky, modely, akcie...", | CODE |
| LOW | client/src/i18n/locales/ml.json | 986 | "placeholder": "പേജുകൾ, മോഡലുകൾ, പ്രവർത്തനങ്ങൾ എന്നിവ തിരയുക...", | CODE |
| LOW | client/src/i18n/locales/az.json | 986 | "placeholder": "Axtarış səhifələri, modellər, fəaliyyətlər...", | CODE |
| LOW | client/src/i18n/locales/en.json | 1019 | "placeholder": "Search pages, models, actions…", | CODE |
| LOW | client/src/i18n/locales/ka.json | 986 | "placeholder": "მოძებნეთ გვერდები, მოდელები, მოქმედებები…", | CODE |
| LOW | client/src/i18n/locales/pa.json | 986 | "placeholder": "ਖੋਜ ਪੰਨੇ, ਮਾਡਲ, ਕਾਰਵਾਈਆਂ…", | CODE |
| LOW | client/src/i18n/locales/my.json | 986 | "placeholder": "စာမျက်နှာများ၊ မော်ဒယ်များ၊ လုပ်ဆောင်ချက်များကို ရှာဖွေပါ...", | CODE |
| LOW | client/src/i18n/locales/pt-PT.json | 986 | "placeholder": "Páginas de pesquisa, modelos, ações...", | CODE |
| LOW | client/src/i18n/locales/km.json | 986 | "placeholder": "ទំព័រស្វែងរក ម៉ូដែល សកម្មភាព...", | CODE |
| LOW | client/src/i18n/locales/it.json | 986 | "placeholder": "Cerca pagine, modelli, azioni…", | CODE |
| LOW | client/src/i18n/locales/sr.json | 986 | "placeholder": "Претражи странице, моделе, акције…", | CODE |
| LOW | client/src/i18n/locales/hr.json | 986 | "placeholder": "Pretraži stranice, modele, akcije...", | CODE |
| LOW | client/src/i18n/locales/tl.json | 986 | "placeholder": "Mga pahina ng paghahanap, mga modelo, mga aksyon...", | CODE |
| LOW | client/src/i18n/locales/kn.json | 986 | "placeholder": "ಪುಟಗಳು, ಮಾದರಿಗಳು, ಕ್ರಿಯೆಗಳನ್ನು ಹುಡುಕಿ...", | CODE |
| LOW | client/src/i18n/locales/ne.json | 986 | "placeholder": "पृष्ठ, नमूना, कार्य खोजी गर्नुहोस्...", | CODE |
| LOW | client/src/i18n/locales/fr.json | 986 | "placeholder": "Rechercher des pages, modèles, actions…", | CODE |
| LOW | client/src/i18n/locales/am.json | 986 | "placeholder": "የፍለጋ ገጾች፣ ሞዴሎች፣ ድርጊቶች...", | CODE |
| LOW | client/src/i18n/locales/gu.json | 986 | "placeholder": "શોધ પૃષ્ઠો, મોડેલો, ક્રિયાઓ...", | CODE |
| LOW | client/src/i18n/locales/el.json | 986 | "placeholder": "Αναζήτηση σελίδων, μοντέλων, ενεργειών...", | CODE |
| LOW | client/src/i18n/locales/bg.json | 986 | "placeholder": "Страници за търсене, модели, действия...", | CODE |
| LOW | client/src/i18n/locales/ro.json | 986 | "placeholder": "Pagini de căutare, modele, acțiuni...", | CODE |
| LOW | client/src/i18n/locales/hi.json | 986 | "placeholder": "खोज पृष्ठ, मॉडल, क्रियाएँ...", | CODE |
| LOW | client/src/i18n/locales/si.json | 986 | "placeholder": "පිටු, ආකෘති, ක්රියා සොයන්න...", | CODE |
| LOW | client/src/i18n/locales/pt-BR.json | 986 | "placeholder": "Buscar páginas, modelos, ações…", | CODE |
| LOW | client/src/i18n/locales/ko.json | 986 | "placeholder": "페이지, 모델, 작업 검색…", | CODE |
| LOW | client/src/i18n/locales/he.json | 986 | "placeholder": "דפי חיפוש, דגמים, פעולות...", | CODE |
| LOW | client/src/i18n/locales/zh-TW.json | 986 | "placeholder": "搜尋頁面、模型、操作...", | CODE |
| LOW | client/src/i18n/locales/vi.json | 986 | "placeholder": "Tìm kiếm trang, mô hình, hành động…", | CODE |
| LOW | client/src/i18n/locales/fa.json | 986 | "placeholder": "جستجوی صفحات، مدلها، اقدامات…", | CODE |
| LOW | client/src/i18n/locales/cs.json | 986 | "placeholder": "Hledejte stránky, modely, akce...", | CODE |
| LOW | client/src/i18n/locales/te.json | 986 | "placeholder": "శోధన పేజీలు, నమూనాలు, చర్యలు...", | CODE |
| LOW | client/src/i18n/locales/id.json | 986 | "placeholder": "Cari halaman, model, tindakan…", | CODE |
| 8 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | server/src/__tests__/lib/unified-max-tokens.test.ts | 9 | // way guardrails.test.ts drives its knobs. | COMMENT |
| MEDIUM | server/src/__tests__/lib/guardrails.test.ts | 3 | // Unit tests for the request guardrails (ported from @coffcoe's fork): the | COMMENT |
| MEDIUM | server/src/__tests__/routes/custom-provider.test.ts | 466 | // #470: custom models used to register with supports_tools = 0, so agentic | COMMENT |
| MEDIUM | server/src/__tests__/routes/custom-provider.test.ts | 466 | // #470: custom models used to register with supports_tools = 0, so agentic | COMMENT |
| MEDIUM | server/src/__tests__/routes/proxy-auto-model.test.ts | 146 | // #282: clients read a model's context window from /v1/models; advertise it | COMMENT |
| MEDIUM | server/src/__tests__/services/scoring.test.ts | 165 | // The two guardrails agree wherever the remaining fraction agrees. | COMMENT |
| MEDIUM | server/src/lib/guardrails.ts | 1 | // Request-level guardrails: two hard limits, both OFF by default so an | COMMENT |
| MEDIUM | server/src/db/model-pricing.ts | 64 | // Groq (compound is an agentic pipeline — estimated at its underlying | COMMENT |
| MEDIUM | server/src/routes/fallback.ts | 24 | // breakdown (reliability / speed / intelligence + guardrails). | COMMENT |
| MEDIUM | server/src/routes/settings.ts | 271 | // Get the request guardrails (per-request token budget + failover circuit | COMMENT |
| MEDIUM | server/src/routes/settings.ts | 272 | // breaker). Both default to 0 = disabled; see lib/guardrails.ts. | COMMENT |
| MEDIUM | server/src/routes/settings.ts | 319 | // Update the guardrails. Partial: send just the knob you want to change. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | client/src/pages/MediaDetailPage.tsx | 46 | const key = keyData?.apiKey || 'YOUR_API_KEY' | CODE |
| HIGH | client/src/pages/ModelDetailPage.tsx | 225 | -H "Authorization: Bearer ${keyData?.apiKey || 'YOUR_API_KEY'}" \\ | CODE |
| HIGH | client/src/pages/EmbeddingDetailPage.tsx | 49 | const key = keyData?.apiKey || 'YOUR_API_KEY' | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | server/src/lib/error-classify.ts | 10 | // This structured check is the robust primary signal; the message-substring | COMMENT |
| MEDIUM | server/src/services/fusion.ts | 69 | // the whole request — a panel is robust to missing members by design. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | server/src/providers/modelscope.ts | 102 | // Step 1: pick a live model id for the auth probe. This call is NOT the | COMMENT |
| LOW | server/src/providers/modelscope.ts | 120 | // Step 2: the actual auth check — a minimal 1-token completion. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | server/src/providers/modelscope.ts | 102 | // Step 1: pick a live model id for the auth probe. This call is NOT the | COMMENT |
| LOW | server/src/providers/modelscope.ts | 120 | // Step 2: the actual auth check — a minimal 1-token completion. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | server/src/__tests__/lib/structured-output.test.ts | 26 | const r = enforceJsonContent('Sure! Here is the requested JSON: {"name":"Ada","tags":["a","b"]} Let me know if you n | CODE |