3.6

Adjusted Signal

3.6

Raw Pattern Score

100%

Time Factor

2026-10-30

Last Push

45.1K

Stars

TypeScript

Language

296.2K

Lines of Code

1.1K

Files

694

Pattern Hits

2026-10-31

Scan Date

0.00

HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 7.5/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 448 finding(s).

Hallucinated Dependency & Supply Chain Risk 1.4/100 · LOW

Are imports declared and package/API names verified? 71 finding(s).

Agent Over-Engineering Ratio 10.7/100 · LOW

Are wrappers, guards, and repeated structures necessary? 314 finding(s).

PR Review Velocity Impact 16.9/100 · LOW

Which changes need focused human review? 694 finding(s).

What These Metrics Mean

Adjusted Signal: Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score: Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor: A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits: Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate: High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files: Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 0HIGH 3MEDIUM 193LOW 498

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 694 distinct pattern matches across 10 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Decorative Section Separators175 hits · 530 pts

Severity	File	Line	Snippet	Context
MEDIUM	desktop/src/main.ts	106	// ── popover IPC ──────────────────────────────────────────────────────────	COMMENT
MEDIUM	server/src/providers/index.ts	583	// ── Chinese domestic providers (#922/#923/#924) ─────────────────────────────	COMMENT
MEDIUM	server/src/providers/index.ts	583	// ── Chinese domestic providers (#922/#923/#924) ─────────────────────────────	COMMENT
MEDIUM	server/src/__tests__/providers/google.test.ts	684	// ── Streaming ──────────────────────────────────────────────────────────────	COMMENT
MEDIUM	server/src/__tests__/providers/google.test.ts	817	// ── timeoutMs plumbing ────────────────────────────────────────────────────	COMMENT
MEDIUM	server/src/__tests__/lib/exhaustion-statuses.test.ts	71	// ── isContextTooLargeError: real provider error shapes ───────────────────────	COMMENT
MEDIUM	server/src/__tests__/lib/exhaustion-statuses.test.ts	172	// ── exhaustedRetryError: failure-kind → terminal-status taxonomy ─────────────	COMMENT
MEDIUM	server/src/__tests__/lib/exhaustion-statuses.test.ts	290	// ── routingExhaustionBody: zero attempts ran ─────────────────────────────────	COMMENT
MEDIUM	server/src/__tests__/lib/exhaustion-statuses.test.ts	370	// ── Wire helpers: OpenAI error payload + Retry-After header ──────────────────	COMMENT
MEDIUM	server/src/__tests__/lib/exhaustion-statuses.test.ts	406	// ── End-to-end through the shared loop ───────────────────────────────────────	COMMENT
MEDIUM	…ver/src/__tests__/lib/fallback-loop-issue-1239.test.ts	124	// ── 1. classification ────────────────────────────────────────────────────────	COMMENT
MEDIUM	…ver/src/__tests__/lib/fallback-loop-issue-1239.test.ts	165	// ── 2. 402 benches the key across the platform ───────────────────────────────	COMMENT
MEDIUM	…ver/src/__tests__/lib/fallback-loop-issue-1239.test.ts	198	// ── 3. exhaustion ladder ─────────────────────────────────────────────────────	COMMENT
MEDIUM	server/src/__tests__/routes/routing-semantics.test.ts	232	// ── #919: remaining-quota key selection ─────────────────────────────────────	COMMENT
MEDIUM	server/src/__tests__/routes/routing-semantics.test.ts	232	// ── #919: remaining-quota key selection ─────────────────────────────────────	COMMENT
MEDIUM	server/src/__tests__/routes/logs.test.ts	86	// ── Capture ────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	server/src/__tests__/routes/logs.test.ts	156	// ── Structured events ──────────────────────────────────────────────────────	COMMENT
MEDIUM	server/src/__tests__/routes/logs.test.ts	198	// ── Storage ────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	server/src/__tests__/routes/logs.test.ts	248	// ── API ────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	server/src/__tests__/routes/logs.test.ts	377	// ── Auth ───────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	server/src/__tests__/routes/logs.test.ts	388	// ── Retention ──────────────────────────────────────────────────────────────	COMMENT
MEDIUM	server/src/__tests__/routes/anthropic.test.ts	591	// ── Same-model cross-provider failover (#932) ────────────────────────────	COMMENT
MEDIUM	server/src/__tests__/routes/anthropic.test.ts	591	// ── Same-model cross-provider failover (#932) ────────────────────────────	COMMENT
MEDIUM	server/src/lib/provider-identity.ts	1	// ── Provider identity for analytics ─────────────────────────────────────────	COMMENT
MEDIUM	server/src/lib/fallback-loop.ts	72	// ── Model-level failure benching ─────────────────────────────────────────────	COMMENT
MEDIUM	server/src/lib/fallback-loop.ts	160	// ── Wall-clock retry budget ──────────────────────────────────────────────────	COMMENT
MEDIUM	server/src/lib/fallback-loop.ts	356	// ── Truncated-stream streak (#1218) ──────────────────────────────────────────	COMMENT
MEDIUM	server/src/lib/fallback-loop.ts	356	// ── Truncated-stream streak (#1218) ──────────────────────────────────────────	COMMENT
MEDIUM	server/src/lib/fallback-loop.ts	373	// ── Empty-completion streak (issue #751) ─────────────────────────────────────	COMMENT
MEDIUM	server/src/lib/fallback-loop.ts	373	// ── Empty-completion streak (issue #751) ─────────────────────────────────────	COMMENT
MEDIUM	server/src/lib/fallback-loop.ts	636	// ── Upstream 401 handling (key-fatal, not request-fatal) ─────────────────────	COMMENT
MEDIUM	server/src/lib/fallback-loop.ts	708	// ── Attempt trail ─────────────────────────────────────────────────────────────	COMMENT
MEDIUM	server/src/lib/fallback-loop.ts	767	// ── Detailed failover trace header (opt-in) ──────────────────────────────────	COMMENT
MEDIUM	server/src/lib/fallback-loop.ts	1137	// ── Routing exhaustion (zero attempts ran) ───────────────────────────────────	COMMENT
MEDIUM⚡	server/src/lib/guardrails.ts	58	// ── Token budget (pre-flight) ────────────────────────────────────────────────	COMMENT
MEDIUM	server/src/lib/server-logs.ts	98	// ── State ────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	server/src/lib/server-logs.ts	128	// ── Formatting ───────────────────────────────────────────────────────────────	COMMENT
MEDIUM	server/src/lib/server-logs.ts	165	// ── Ingest ───────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	server/src/lib/server-logs.ts	303	// ── Persistence ──────────────────────────────────────────────────────────────	COMMENT
MEDIUM	server/src/lib/server-logs.ts	442	// ── Read side ────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	server/src/lib/web-search-tool.ts	150	// ── Replay of earlier search results ────────────────────────────────────────	COMMENT
MEDIUM	server/src/lib/web-search-tool.ts	181	// ── In-process re-entry into a route handler ────────────────────────────────	COMMENT
MEDIUM	server/src/lib/sampling-params.ts	189	// ── Per-platform support policy ──────────────────────────────────────────────	COMMENT
MEDIUM	server/src/lib/sampling-params.ts	396	// ── Unified output-token cap ─────────────────────────────────────────────────	COMMENT
MEDIUM	server/src/lib/endpoint-scope.ts	1	// ── Endpoint identity for custom relay models (#651) ────────────────────────	COMMENT
MEDIUM	server/src/lib/endpoint-scope.ts	1	// ── Endpoint identity for custom relay models (#651) ────────────────────────	COMMENT
MEDIUM	server/src/lib/error-classify.ts	113	// ── Transport failures hidden in the cause chain (undici) ────────────────────	COMMENT
MEDIUM	server/src/lib/error-classify.ts	229	// ── Timeout wording ─────────────────────────────────────────────────────────	COMMENT
MEDIUM	server/src/lib/error-classify.ts	253	// ── Client-caused aborts ─────────────────────────────────────────────────────	COMMENT
MEDIUM	server/src/lib/error-classify.ts	279	// ── Fallback time-budget hedging (fallback-v2) ──────────────────────────────	COMMENT
MEDIUM	server/src/lib/error-classify.ts	682	// ── Permanent upstream retirement (issue #634) ───────────────────────────────	COMMENT
MEDIUM	server/src/lib/error-classify.ts	682	// ── Permanent upstream retirement (issue #634) ───────────────────────────────	COMMENT
MEDIUM	server/src/routes/fallback.ts	31	// ── Bandit routing strategy ─────────────────────────────────────────────────	COMMENT
MEDIUM	server/src/routes/anthropic.ts	67	// ── Request schema ──────────────────────────────────────────────────────────	COMMENT
MEDIUM	server/src/routes/anthropic.ts	147	// ── Response shape ──────────────────────────────────────────────────────────	COMMENT
MEDIUM	server/src/routes/anthropic.ts	209	// ── Auth (shared with the OpenAI route) ─────────────────────────────────────	COMMENT
MEDIUM	server/src/routes/anthropic.ts	223	// ── Request translation: Anthropic → internal (OpenAI-shaped) ───────────────	COMMENT
MEDIUM	server/src/routes/anthropic.ts	402	// ── Response translation: internal → Anthropic ──────────────────────────────	COMMENT
MEDIUM	server/src/routes/anthropic.ts	438	// ── SSE helpers ─────────────────────────────────────────────────────────────	COMMENT
MEDIUM	server/src/routes/settings.ts	136	// ── MCP server lifecycle (#925, MVP-1) ──────────────────────────────────────	COMMENT
115 more matches not shown…

Over-Commented Block287 hits · 262 pts

Severity	File	Line	Snippet	Context
LOW	desktop/electron-builder.yml	41	entitlements: assets/entitlements.mac.plist	COMMENT
LOW	desktop/src/server-host.ts	81	console.warn(`[tls] could not load the OS certificate store: ${(err as Error)?.message ?? err}`);	COMMENT
LOW	desktop/src/server-host.ts	101	// the same credential-stripped lines a terminal would — users paste it into	COMMENT
LOW	desktop/src/updater.ts	1	// In-app updates for the packaged desktop app, on top of electron-updater.	COMMENT
LOW	desktop/src/logger.ts	1	// A file log for the desktop app (#824).	COMMENT
LOW	desktop/src/preload.ts	21	contextBridge.exposeInMainWorld('__FREEAPI_PLATFORM__', process.platform);	COMMENT
LOW	desktop/src/tray-platform.ts	1	// Per-platform tray behaviour, kept free of Electron imports so it can be	COMMENT
LOW	desktop/src/tray-visibility.ts	1	// macOS 26 (Tahoe) gave every user a per-app switch for menu-bar icons in	COMMENT
LOW	desktop/src/__tests__/version.test.ts	1	import { readFileSync } from 'node:fs';	COMMENT
LOW	server/src/app.ts	101	const cfg = config ?? loadConfig();	COMMENT
LOW	server/src/app.ts	121	// CSP: default-src 'self' restricts content to the same origin. Scripts	COMMENT
LOW	server/src/app.ts	201	// else keeps the #200 limit — code agents (OpenCode, AionUI, Qwen Code)	COMMENT
LOW	server/src/app.ts	221	// brute-forceable credential check without it. Dashboard traffic on the	COMMENT
LOW	server/src/app.ts	241	app.use('/api', adminRateLimiter);	COMMENT
LOW	server/src/app.ts	301	app.use('/v1', providersRouter);	COMMENT
LOW	server/src/app.ts	341	// Error handler (for API routes)	COMMENT
LOW	server/src/middleware/allowed-hosts.ts	1	import type { Request, Response, NextFunction } from 'express';	COMMENT
LOW	server/src/middleware/rateLimit.ts	1	import type { Request, Response, NextFunction } from 'express';	COMMENT
LOW	server/src/providers/openai-compat.ts	441	// (1) base URL points at a non-OpenAI-compatible API (Ollama's native	COMMENT
LOW	server/src/providers/google.ts	61	if (!name) return undefined;	COMMENT
LOW	server/src/providers/google.ts	221	}	COMMENT
LOW	server/src/providers/google.ts	821	// Reaching here means the body ended with neither `[DONE]` nor any	COMMENT
LOW	server/src/providers/google.ts	861	// Google's error taxonomy is NOT the usual 401/403-means-bad-key (#268):	COMMENT
LOW	server/src/providers/index.ts	141	// publishes no RPM/RPD numbers at all; the 20 RPM / 200 RPD figures in #732 are	COMMENT
LOW	server/src/providers/index.ts	161	// in the hosted catalog rather than migrations. Both current models reject	COMMENT
LOW	server/src/providers/index.ts	221	// GitHub Models was retired upstream on 30 July 2026 (#549): models.github.ai	COMMENT
LOW	server/src/providers/index.ts	241	register(new CloudflareProvider());	COMMENT
LOW	server/src/providers/index.ts	261	register(new OpenAICompatProvider({	COMMENT
LOW	server/src/providers/index.ts	301	}));	COMMENT
LOW	server/src/providers/index.ts	321	}));	COMMENT
LOW	server/src/providers/index.ts	341	// (documented 2 req/min per IP per model — observed even stricter across	COMMENT
LOW	server/src/providers/index.ts	361	// underneath, so watch for reversion to paid. ~30 concurrent requests succeed	COMMENT
LOW	server/src/providers/index.ts	381	// (#1202): Reka's FAQ now requires prepaid credits and a $0 balance answers	COMMENT
LOW	server/src/providers/index.ts	521		COMMENT
LOW	server/src/providers/index.ts	541	// xKiro (xkiro.com) — OpenAI-compatible gateway at api.xkiro.com/v1 (the	COMMENT
LOW	server/src/providers/index.ts	561		COMMENT
LOW	server/src/providers/index.ts	581	register(new ModelScopeProvider());	COMMENT
LOW	server/src/providers/index.ts	621	}));	COMMENT
LOW	server/src/providers/llmtr.ts	141	/** The probe itself: one authenticated request, verdict classified below. */	COMMENT
LOW	server/src/docs/docs-page.ts	1	// Self-contained API reference page served at `GET /v1/docs`.	COMMENT
LOW	server/src/docs/openapi.ts	1	// Hand-written OpenAPI 3.0 description of the public `/v1` surface.	COMMENT
LOW	server/src/__tests__/lib/proxy-restore.test.ts	21	// machine can genuinely have that set (macOS System Settings → Proxies),	COMMENT
LOW	server/src/__tests__/lib/module-purity.test.ts	1	import fs from 'node:fs';	COMMENT
LOW	…rver/src/__tests__/lib/fallback-loop-size-skip.test.ts	201	{ status: 413 },	COMMENT
LOW	…ver/src/__tests__/lib/fallback-loop-issue-1239.test.ts	1	import { describe, it, expect, beforeAll, beforeEach, vi } from 'vitest';	COMMENT
LOW	…_tests__/routes/responses-fallback-convergence.test.ts	1	import { describe, it, expect, beforeAll, beforeEach, vi } from 'vitest';	COMMENT
LOW	server/src/__tests__/routes/rescue-wants-tools.test.ts	1	import { describe, it, expect, beforeAll, beforeEach, afterEach, vi } from 'vitest';	COMMENT
LOW	…r/src/__tests__/routes/reasoning-only-failover.test.ts	1	import { describe, it, expect, beforeAll, beforeEach, afterEach, vi } from 'vitest';	COMMENT
LOW	server/src/__tests__/routes/auth-reset-password.test.ts	1	import { describe, it, expect, beforeEach, afterAll, vi } from 'vitest';	COMMENT
LOW	server/src/__tests__/services/ratelimit.test.ts	141	// 1st 429 → transient (no signal yet). Subsequent 429s stay transient	COMMENT
LOW	server/src/lib/image-normalize.ts	1	import { readFileSync } from 'node:fs';	COMMENT
LOW	server/src/lib/image-normalize.ts	21	// original image: a vision request must never be lost to a transcoding	COMMENT
LOW	server/src/lib/image-normalize.ts	41	// sharp is a NATIVE module: it ships a prebuilt libvips per platform+arch, and	COMMENT
LOW	server/src/lib/provider-size-parser.ts	1	// Pull a real token count out of a provider's 413 / context-length error body.	COMMENT
LOW	server/src/lib/provider-size-parser.ts	41		COMMENT
LOW	server/src/lib/tool-args.ts	1	// Schema-aware repair of double-encoded tool-call arguments.	COMMENT
LOW	server/src/lib/provider-identity.ts	1	// ── Provider identity for analytics ─────────────────────────────────────────	COMMENT
LOW	server/src/lib/setup-code.ts	1	import { createOneTimeCode } from './one-time-code.js';	COMMENT
LOW	server/src/lib/think-tags.ts	1	import type { ChatCompletionChunk } from '@freellmapi/shared/types.js';	COMMENT
LOW	server/src/lib/header-value.ts	1	// Header-value sanitizer for the diagnostics headers built out of provider and	COMMENT
227 more matches not shown…

Hyper-Verbose Identifiers139 hits · 138 pts

Severity	File	Line	Snippet	Context
LOW	desktop/src/tray-platform.ts	48	export function shouldOpenDashboardOnLaunch(	CODE
LOW	server/src/providers/google.ts	82	function noteDummyThoughtSignature(name: string \| undefined): void {	CODE
LOW	server/src/providers/modelscope.ts	16	function modelscopeValidateCacheMs(): number {	CODE
LOW	server/src/providers/llmtr.ts	56	async function blocksAutomatedValidation(res: Response): Promise<boolean> {	CODE
LOW	server/src/__tests__/db/migrate/roundtrip.test.ts	217	function getLatestAppliedMigrationName(db: Database.Database): string {	CODE
LOW	server/src/__tests__/db/migrate/roundtrip.test.ts	241	function getEnabledZenDeadPromoCount(db: Database.Database): number {	CODE
LOW	server/src/__tests__/routes/proxy-stream-usage.test.ts	89	function sseResponseUsageMidStream() {	CODE
LOW	server/src/__tests__/routes/proxy-stream-usage.test.ts	111	function sseResponseUsageOnContentFrame() {	CODE
LOW	server/src/__tests__/services/custom-model-sync.test.ts	32	function addDisabledCustomEndpoint(baseUrl: string, label = 'disabled-endpoint'): void {	CODE
LOW	server/src/__tests__/services/catalog-sync.test.ts	82	function existingAsCatalogEmbeddings(): CatalogEmbedding[] {	CODE
LOW	server/src/lib/custom-provider-cleanup.ts	31	export function deleteUnusedCustomEndpointKey(db: Db, keyId: number \| null \| undefined) {	CODE
LOW	server/src/lib/anthropic-web-search.ts	170	export async function maybeServeAnthropicWebSearch(	CODE
LOW	server/src/lib/provider-size-parser.ts	65	export function parseProviderReportedSize(platform: string, message: string \| null \| undefined): ProviderReportedSize \|	CODE
LOW	server/src/lib/fallback-loop.ts	285	export function msUntilNextPacificMidnight(now = Date.now()): number {	CODE
LOW	server/src/lib/fallback-loop.ts	385	export function resetEmptyCompletionStreaks(): void {	CODE
LOW	server/src/lib/fallback-loop.ts	410	function consumeSkipBenchExemption(route: RouteResult, err: any): boolean {	CODE
LOW	server/src/lib/fallback-loop.ts	789	export function isFallbackDetailHeaderEnabled(): boolean {	CODE
LOW⚡	server/src/lib/guardrails.ts	49	export function getRequestMaxTokensBudget(): number {	CODE
LOW⚡	server/src/lib/guardrails.ts	54	export function getMaxConsecutiveUpstreamFails(): number {	CODE
LOW	server/src/lib/provider-timeout.ts	57	export function streamStallTimeoutEnvName(platform: string): string {	CODE
LOW	server/src/lib/crypto.ts	178	export function isEncryptionKeyInitialized(): boolean {	CODE
LOW	server/src/lib/served-model.ts	50	export function resetServedModelObservations(): void {	CODE
LOW	server/src/lib/error-redaction.ts	18	export function sanitizeProviderErrorMessage(message: unknown): string {	CODE
LOW	server/src/lib/tool-validate.ts	37	export function isToolArgumentValidationEnabled(): boolean {	CODE
LOW	server/src/lib/tool-validate.ts	151	export function invalidToolArgumentsError(displayName: string, reasons: string[]): Error {	CODE
LOW	server/src/lib/url-guard.ts	144	export function isLoopbackOrPrivateHostname(hostname: string): boolean {	CODE
LOW	server/src/lib/responses-web-search.ts	161	export async function maybeServeResponsesWebSearch(	CODE
LOW	server/src/lib/config.ts	30	function parseRequestBodyLimitBytes(): number {	CODE
LOW	server/src/lib/config.ts	136	function parseCspUpgradeInsecureRequests(): boolean \| undefined {	CODE
LOW	server/src/lib/sampling-params.ts	433	export function platformDropsResponseFormat(platform: string): boolean {	CODE
LOW	server/src/lib/sampling-params.ts	459	export function supportedParametersForPlatforms(platforms: string[], caps: { tools?: boolean } = {}): string[] {	CODE
LOW	server/src/lib/error-classify.ts	362	export function isDailyQuotaExhaustedError(err: any): boolean {	CODE
LOW	server/src/lib/error-classify.ts	389	export function isModelScopedOverloadError(err: any): boolean {	CODE
LOW	server/src/lib/error-classify.ts	472	export function isUpstreamClassificationOutput(text: unknown, platform?: string): boolean {	CODE
LOW	server/src/lib/error-classify.ts	481	export function isProviderBadRequestError(err: any): boolean {	CODE
LOW	server/src/lib/error-classify.ts	645	export function isModelAccessForbiddenError(err: any): boolean {	CODE
LOW	server/src/lib/client-context.ts	58	export function setRequestRoutingStrategy(strategy: PresetStrategy \| undefined): void {	CODE
LOW	server/src/lib/ttfb-budget.ts	51	export function invalidateTtfbBudgetCache(): void {	CODE
LOW	server/src/db/index.ts	140	function parseDirHardeningOverride(): boolean \| undefined {	CODE
LOW	server/src/db/index.ts	187	function restrictDbFilePermissions(resolvedPath: string): void {	CODE
LOW	server/src/db/migrate/cli.ts	104	function updateDefaultMigrationRegistry(filename: string): void {	CODE
LOW	server/src/db/migrate/runner.ts	98	function initializeMigrationTracking(db: Db): void {	CODE
LOW	server/src/db/migrate/runner.ts	173	function runLatestDownMigrationSync(	CODE
LOW	server/src/db/migrate/runner.ts	213	function getDefaultMigrationRecords(): MigrationRecord[] {	CODE
LOW	server/src/db/migrate/runner.ts	262	function getMigrationFileExtension(options: MigrationRunnerOptions): '.ts' \| '.js' {	CODE
LOW	server/src/routes/anthropic.ts	130	export function effortFromAnthropicThinking(	CODE
LOW	server/src/routes/mcp.ts	262	function loopbackChatCompletionsUrl(req: Request): string {	CODE
LOW	server/src/routes/proxy.ts	1336	function completionPromptToMessages(prompt: string, suffix?: string): ChatMessage[] {	CODE
LOW	server/src/routes/responses.ts	318	export function responsesInputHasFileIdImage(req: ResponsesRequest): boolean {	CODE
LOW	server/src/routes/responses.ts	336	export function responsesInputRequestsComputerUse(req: ResponsesRequest): boolean {	CODE
LOW	server/src/routes/responses.ts	591	function buildFusionResponseObject(id: string, result: FusionResult): Record<string, unknown> {	CODE
LOW	server/src/routes/responses.ts	653	function enforceFusionResponseFormat(result: FusionResult, responseFormat: ResponseFormat \| undefined): void {	CODE
LOW	server/src/services/model-state.ts	114	export function refreshModelOverrideBaselines(db: Db, platform: string, modelId: string): void {	CODE
LOW	server/src/services/model-state.ts	199	export function recordCatalogModelTombstone(	CODE
LOW	server/src/services/model-state.ts	232	export function retireCatalogModelUpstream(	CODE
LOW	server/src/services/model-state.ts	252	export function reinstateUpstreamRetiredCatalogModel(	CODE
LOW	server/src/services/model-state.ts	269	export function clearCatalogModelTombstone(	CODE
LOW	server/src/services/model-state.ts	353	export function modelsWithOverriddenField(	CODE
LOW	server/src/services/model-state.ts	399	export function deleteTombstonedCatalogModels(db: Db): number {	CODE
LOW	server/src/services/provider-quota.ts	71	export function getQuotaObservationContext(): QuotaObservationContext \| undefined {	CODE
79 more matches not shown…

Fake / Example Data68 hits · 70 pts

Severity	File	Line	Snippet	Context
LOW	server/src/__tests__/routes/auth-setup-code.test.ts	38	const CREDS = { email: 'admin@example.com', password: 'supersecret' };	CODE
LOW	server/src/__tests__/routes/auth.test.ts	60	const { status, body } = await call(app, 'POST', '/api/auth/setup', { email: 'admin@example.com', password: 'superse	CODE
LOW⚡	server/src/__tests__/routes/auth.test.ts	73	const ok = await call(app, 'POST', '/api/auth/login', { email: 'admin@example.com', password: 'supersecret' });	CODE
LOW⚡	server/src/__tests__/routes/auth.test.ts	77	const bad = await call(app, 'POST', '/api/auth/login', { email: 'admin@example.com', password: 'wrongpassword' });	CODE
LOW⚡	server/src/__tests__/routes/auth.test.ts	84	expect(body).toMatchObject({ needsSetup: false, authenticated: true, email: 'admin@example.com' });	CODE
LOW⚡	server/src/__tests__/routes/auth.test.ts	88	const login = await call(app, 'POST', '/api/auth/login', { email: 'admin@example.com', password: 'supersecret' });	CODE
LOW	…/src/__tests__/routes/custom-provider-multikey.test.ts	330	await post(app, '/api/keys/custom', { baseUrl: ENDPOINT, model: 'placeholder', apiKey: 'second-secret' });	CODE
LOW	…/src/__tests__/routes/custom-provider-multikey.test.ts	333	expect((await del(app, `/api/models/custom/${chatModel('placeholder')!.id}`)).status).toBe(200);	CODE
LOW	client/src/i18n/locales/tr.json	1151	"placeholder": "Sayfaları, modelleri, eylemleri arayın…",	CODE
LOW	client/src/i18n/locales/or.json	1151	"placeholder": "ପୃଷ୍ଠା, ମଡେଲ୍, କ୍ରିୟାଗୁଡିକ ସନ୍ଧାନ କରନ୍ତୁ...",	CODE
LOW	client/src/i18n/locales/hu.json	1151	"placeholder": "Keresőoldalak, modellek, akciók...",	CODE
LOW	client/src/i18n/locales/mr.json	1151	"placeholder": "पृष्ठे, मॉडेल, क्रिया शोधा…",	CODE
LOW	client/src/i18n/locales/lt.json	1151	"placeholder": "Paieškos puslapiai, modeliai, veiksmai...",	CODE
LOW	client/src/i18n/locales/bn.json	1151	"placeholder": "অনুসন্ধান পৃষ্ঠা, মডেল, কর্ম…",	CODE
LOW	client/src/i18n/locales/ha.json	1151	"placeholder": "Bincika shafuka, samfura, ayyuka…",	CODE
LOW	client/src/i18n/locales/ig.json	1151	"placeholder": "Chọọ ibe, ụdị, omume…",	CODE
LOW	client/src/i18n/locales/yo.json	1151	"placeholder": "Ṣewadii awọn oju-iwe, awọn awoṣe, awọn iṣe…",	CODE
LOW	client/src/i18n/locales/nl.json	1151	"placeholder": "Zoek pagina's, modellen, acties...",	CODE
LOW	client/src/i18n/locales/ms.json	1151	"placeholder": "Halaman carian, model, tindakan...",	CODE
LOW	client/src/i18n/locales/ja.json	1151	"placeholder": "ページ、モデル、アクションを検索します...",	CODE
LOW	client/src/i18n/locales/de.json	1151	"placeholder": "Suchseiten, Modelle, Aktionen…",	CODE
LOW	client/src/i18n/locales/ru.json	1151	"placeholder": "Поиск по страницам, моделям, действиям…",	CODE
LOW	client/src/i18n/locales/pl.json	1151	"placeholder": "Przeszukaj strony, modele, działania…",	CODE
LOW	client/src/i18n/locales/uk.json	1151	"placeholder": "Пошук сторінок, моделей, дій…",	CODE
LOW	client/src/i18n/locales/fi.json	1151	"placeholder": "Hakusivuja, malleja, toimintoja...",	CODE
LOW	client/src/i18n/locales/ta.json	1151	"placeholder": "தேடல் பக்கங்கள், மாதிரிகள், செயல்கள்...",	CODE
LOW	client/src/i18n/locales/ur.json	1151	"placeholder": "تلاش کے صفحات، ماڈل، اعمال…",	CODE
LOW	client/src/i18n/locales/zh-CN.json	1151	"placeholder": "搜索页面、模型、操作…",	CODE
LOW	client/src/i18n/locales/sk.json	1151	"placeholder": "Vyhľadávajte stránky, modely, akcie...",	CODE
LOW	client/src/i18n/locales/ml.json	1151	"placeholder": "പേജുകൾ, മോഡലുകൾ, പ്രവർത്തനങ്ങൾ എന്നിവ തിരയുക...",	CODE
LOW	client/src/i18n/locales/az.json	1151	"placeholder": "Axtarış səhifələri, modellər, fəaliyyətlər...",	CODE
LOW	client/src/i18n/locales/en.json	1190	"placeholder": "Search pages, models, actions…",	CODE
LOW	client/src/i18n/locales/ka.json	1151	"placeholder": "მოძებნეთ გვერდები, მოდელები, მოქმედებები…",	CODE
LOW	client/src/i18n/locales/pa.json	1151	"placeholder": "ਖੋਜ ਪੰਨੇ, ਮਾਡਲ, ਕਾਰਵਾਈਆਂ…",	CODE
LOW	client/src/i18n/locales/my.json	1151	"placeholder": "စာမျက်နှာများ၊ မော်ဒယ်များ၊ လုပ်ဆောင်ချက်များကို ရှာဖွေပါ...",	CODE
LOW	client/src/i18n/locales/pt-PT.json	1151	"placeholder": "Páginas de pesquisa, modelos, ações...",	CODE
LOW	client/src/i18n/locales/km.json	1151	"placeholder": "ទំព័រស្វែងរក ម៉ូដែល សកម្មភាព...",	CODE
LOW	client/src/i18n/locales/it.json	1151	"placeholder": "Cerca pagine, modelli, azioni…",	CODE
LOW	client/src/i18n/locales/sr.json	1151	"placeholder": "Претражи странице, моделе, акције…",	CODE
LOW	client/src/i18n/locales/hr.json	1151	"placeholder": "Pretraži stranice, modele, akcije...",	CODE
LOW	client/src/i18n/locales/tl.json	1151	"placeholder": "Mga pahina ng paghahanap, mga modelo, mga aksyon...",	CODE
LOW	client/src/i18n/locales/kn.json	1151	"placeholder": "ಪುಟಗಳು, ಮಾದರಿಗಳು, ಕ್ರಿಯೆಗಳನ್ನು ಹುಡುಕಿ...",	CODE
LOW	client/src/i18n/locales/ne.json	1151	"placeholder": "पृष्ठ, नमूना, कार्य खोजी गर्नुहोस्...",	CODE
LOW	client/src/i18n/locales/fr.json	1151	"placeholder": "Rechercher des pages, modèles, actions…",	CODE
LOW	client/src/i18n/locales/am.json	1151	"placeholder": "የፍለጋ ገጾች፣ ሞዴሎች፣ ድርጊቶች...",	CODE
LOW	client/src/i18n/locales/gu.json	1151	"placeholder": "શોધ પૃષ્ઠો, મોડેલો, ક્રિયાઓ...",	CODE
LOW	client/src/i18n/locales/el.json	1151	"placeholder": "Αναζήτηση σελίδων, μοντέλων, ενεργειών...",	CODE
LOW	client/src/i18n/locales/bg.json	1151	"placeholder": "Страници за търсене, модели, действия...",	CODE
LOW	client/src/i18n/locales/ro.json	1151	"placeholder": "Pagini de căutare, modele, acțiuni...",	CODE
LOW	client/src/i18n/locales/hi.json	1151	"placeholder": "खोज पृष्ठ, मॉडल, क्रियाएँ...",	CODE
LOW	client/src/i18n/locales/si.json	1151	"placeholder": "පිටු, ආකෘති, ක්‍රියා සොයන්න...",	CODE
LOW	client/src/i18n/locales/pt-BR.json	1151	"placeholder": "Buscar páginas, modelos, ações…",	CODE
LOW	client/src/i18n/locales/ko.json	1151	"placeholder": "페이지, 모델, 작업 검색…",	CODE
LOW	client/src/i18n/locales/he.json	1151	"placeholder": "דפי חיפוש, דגמים, פעולות...",	CODE
LOW	client/src/i18n/locales/zh-TW.json	1151	"placeholder": "搜尋頁面、模型、操作...",	CODE
LOW	client/src/i18n/locales/vi.json	1151	"placeholder": "Tìm kiếm trang, mô hình, hành động…",	CODE
LOW	client/src/i18n/locales/fa.json	1151	"placeholder": "جستجوی صفحات، مدل‌ها، اقدامات…",	CODE
LOW	client/src/i18n/locales/cs.json	1151	"placeholder": "Hledejte stránky, modely, akce...",	CODE
LOW	client/src/i18n/locales/te.json	1151	"placeholder": "శోధన పేజీలు, నమూనాలు, చర్యలు...",	CODE
LOW	client/src/i18n/locales/id.json	1151	"placeholder": "Cari halaman, model, tindakan…",	CODE
8 more matches not shown…

Modern AI Meta-Vocabulary14 hits · 41 pts

Severity	File	Line	Snippet	Context
MEDIUM	server/src/__tests__/lib/unified-max-tokens.test.ts	9	// way guardrails.test.ts drives its knobs.	COMMENT
MEDIUM	server/src/__tests__/lib/guardrails.test.ts	3	// Unit tests for the request guardrails (ported from @coffcoe's fork): the	COMMENT
MEDIUM	server/src/__tests__/routes/custom-provider.test.ts	466	// #470: custom models used to register with supports_tools = 0, so agentic	COMMENT
MEDIUM	server/src/__tests__/routes/custom-provider.test.ts	466	// #470: custom models used to register with supports_tools = 0, so agentic	COMMENT
MEDIUM	server/src/__tests__/routes/proxy-auto-model.test.ts	175	// #282: clients read a model's context window from /v1/models; advertise it	COMMENT
MEDIUM	server/src/__tests__/services/scoring.test.ts	166	// The two guardrails agree wherever the remaining fraction agrees.	COMMENT
MEDIUM	server/src/lib/guardrails.ts	1	// Request-level guardrails: two hard limits, both OFF by default so an	COMMENT
MEDIUM	server/src/db/model-pricing.ts	59	// Groq (compound is an agentic pipeline — estimated at its underlying	COMMENT
MEDIUM	server/src/routes/fallback.ts	33	// breakdown (reliability / speed / intelligence + guardrails).	COMMENT
MEDIUM	server/src/routes/settings.ts	328	// Get the request guardrails (per-request token budget + failover circuit	COMMENT
MEDIUM	server/src/routes/settings.ts	329	// breaker). Both default to 0 = disabled; see lib/guardrails.ts.	COMMENT
MEDIUM	server/src/routes/settings.ts	455	// Update the guardrails. Partial: send just the knob you want to change.	COMMENT
MEDIUM	server/src/routes/responses.ts	967	// Responses translation/guardrails so Codex and other Responses clients can	COMMENT
MEDIUM	docs/CHANGELOG.md	10	\| `eab992f` \| 2026-09-05 \| docs: per-language layout `docs/{en,zh-cn}`, Chinese README, redirect stubs at the old paths	CODE

Magic Placeholder Names3 hits · 15 pts

Severity	File	Line	Snippet	Context
HIGH	client/src/pages/MediaDetailPage.tsx	46	const key = keyData?.apiKey \|\| 'YOUR_API_KEY'	CODE
HIGH	client/src/pages/ModelDetailPage.tsx	226	-H "Authorization: Bearer ${keyData?.apiKey \|\| 'YOUR_API_KEY'}" \\	CODE
HIGH	client/src/pages/EmbeddingDetailPage.tsx	49	const key = keyData?.apiKey \|\| 'YOUR_API_KEY'	CODE

AI Slop Vocabulary3 hits · 9 pts

Severity	File	Line	Snippet	Context
MEDIUM	server/src/lib/error-classify.ts	10	// This structured check is the robust primary signal; the message-substring	COMMENT
MEDIUM	server/src/services/fusion.ts	111	// the whole request — a panel is robust to missing members by design.	COMMENT
MEDIUM	…src/components/keys/provider-checklist-signup.test.tsx	65	// Wait (polling, so it is robust to how many microtask hops the query	COMMENT

Verbosity Indicators2 hits · 3 pts

Severity	File	Line	Snippet	Context
LOW	server/src/providers/modelscope.ts	102	// Step 1: pick a live model id for the auth probe. This call is NOT the	COMMENT
LOW	server/src/providers/modelscope.ts	120	// Step 2: the actual auth check — a minimal 1-token completion.	COMMENT

Structural Annotation Overuse2 hits · 3 pts

Severity	File	Line	Snippet	Context
LOW	server/src/providers/modelscope.ts	102	// Step 1: pick a live model id for the auth probe. This call is NOT the	COMMENT
LOW	server/src/providers/modelscope.ts	120	// Step 2: the actual auth check — a minimal 1-token completion.	COMMENT

Slop Phrases1 hit · 2 pts

Severity	File	Line	Snippet	Context
MEDIUM	server/src/__tests__/lib/structured-output.test.ts	26	const r = enforceJsonContent('Sure! Here is the requested JSON: {"name":"Ada","tags":["a","b"]} Let me know if you n	CODE

tashfeenahmed/freellmapi

Open-Source Code Quality, Security and Technical Debt Review