OpenAI-compatible proxy that stacks the free tiers of 16 LLM providers (~1.7B tokens/month) behind one /v1 endpoint — plus any custom OpenAI-compatible endpoint. Smart routing, automatic failover, encrypted keys. Personal experimentation only.
This report presents the forensic synthetic code analysis of tashfeenahmed/freellmapi, a TypeScript project with 16,060 GitHub stars. SynthScan v2.0 examined 76,688 lines of code across 311 source files, recording 173 pattern matches distributed across 8 syntactic categories. The overall adjusted score of 4.1 places this repository in the Likely human-written band.
The scanner applied 160+ deterministic lexical heuristics, multi-line block detectors, abstract syntax tree depth profilers, and a cross-file Jaccard similarity matrix to construct a statistically normalised synthetic code estimate. All matches are individually weighted by severity coefficient and contextual multiplier before summation, and the resulting headline score is temporally discounted to account for the repository's development history relative to the commercial emergence of large language model coding tooling (November 2022 onward).
This chart maps the temporal evolution of the adjusted synthetic code score across successive scan runs. An upward trajectory indicates ongoing incorporation of AI-generated code or expanding LLM-assisted scaffolding; a stable or declining trajectory may reflect active human refactoring, code removal, or the adoption of stricter authorship policies. The dashed secondary line (right axis) independently tracks total raw pattern hit count, which can diverge from the normalised score when codebase size changes significantly between scans.
Classifies detected patterns by their diagnostic confidence and structural impact. CRITICAL patterns (coefficient 10) represent definitive synthetic signatures — hallucinated imports, explicit LLM attribution metadata — virtually never produced by human authors. HIGH (5) indicates strong structural tells such as cross-file repetition or cross-linguistic idioms. MEDIUM (2) covers recognisable conversational padding and AI-specific vocabulary. LOW (1) captures subtle indicators like tautological comments and generic boilerplate that require density to carry independent signal.
This horizontal bar chart decomposes the repository's raw synthetic code score by top-level directory, allowing you to pinpoint precisely which modules or components carry the highest AI authorship density. Directories with disproportionately high scores relative to their size warrant targeted manual review: concentrated AI signatures often trace back to mass-generated configuration layers, auto-ported test suites, LLM-scaffolded boilerplate classes, or entire subsystems authored under heavy copilot assistance. Use this view to prioritise your human code-review effort.
The scanner identified 173 distinct pattern matches across 8 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a statistically significant AI authorship indicator. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the diagnostic confidence level (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — comment-context matches receive a ×1.5 weight because LLMs systematically over-annotate. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier as dense clusters constitute far stronger evidence of synthetic authorship than isolated hits.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | desktop/src/main.ts | 74 | // ── popover IPC ────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/src/__tests__/providers/google.test.ts | 413 | // ── Streaming ────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/src/__tests__/providers/google.test.ts | 492 | // ── timeoutMs plumbing ──────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/src/lib/fallback-loop.ts | 47 | // ── Wall-clock retry budget ────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/src/lib/fallback-loop.ts | 167 | // ── Upstream 401 handling (key-fatal, not request-fatal) ───────────────────── | COMMENT |
| MEDIUM | server/src/lib/fallback-loop.ts | 217 | // ── Attempt trail ───────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | server/src/lib/guardrails.ts | 58 | // ── Token budget (pre-flight) ──────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/src/lib/sampling-params.ts | 103 | // ── Per-platform support policy ────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/src/routes/fallback.ts | 18 | // ── Bandit routing strategy ───────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/src/routes/anthropic.ts | 45 | // ── Request schema ────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/src/routes/anthropic.ts | 93 | // ── Response shape ────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/src/routes/anthropic.ts | 131 | // ── Auth (shared with the OpenAI route) ───────────────────────────────────── | COMMENT |
| MEDIUM | server/src/routes/anthropic.ts | 142 | // ── Request translation: Anthropic → internal (OpenAI-shaped) ─────────────── | COMMENT |
| MEDIUM | server/src/routes/anthropic.ts | 306 | // ── Response translation: internal → Anthropic ────────────────────────────── | COMMENT |
| MEDIUM | server/src/routes/anthropic.ts | 335 | // ── SSE helpers ───────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/src/routes/mcp.ts | 11 | // ───────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/src/routes/mcp.ts | 29 | // ───────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/src/routes/mcp.ts | 65 | // ── Tool implementations ───────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/src/routes/mcp.ts | 181 | // ── Tool registry ──────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/src/routes/mcp.ts | 238 | // ── JSON-RPC dispatch ──────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/src/routes/keys.ts | 365 | // ── Custom OpenAI-compatible providers (#117, #212) ─────────────────────── | COMMENT |
| MEDIUM | server/src/routes/keys.ts | 365 | // ── Custom OpenAI-compatible providers (#117, #212) ─────────────────────── | COMMENT |
| MEDIUM | server/src/routes/proxy.ts | 1173 | // ── Fusion: multi-model synthesis ────────────────────────────────────────── | COMMENT |
| MEDIUM | server/src/routes/responses.ts | 35 | // ───────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/src/routes/responses.ts | 52 | // ───────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/src/routes/responses.ts | 64 | // ── Request schema ────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/src/routes/responses.ts | 167 | // ── Translate a Responses request → internal chat messages + options ────── | COMMENT |
| MEDIUM | server/src/routes/responses.ts | 239 | // ── Build the final (non-stream) Responses object ───────────────────────── | COMMENT |
| MEDIUM | server/src/routes/auth.ts | 25 | // ── Brute-force throttle ────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/src/services/router.ts | 242 | // ── Routing strategy (persisted) ──────────────────────────────────────────── | COMMENT |
| MEDIUM | server/src/services/router.ts | 261 | // ── Custom weights (persisted) ────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/src/services/router.ts | 304 | // ── Analytics stats cache (decay-weighted) ────────────────────────────────── | COMMENT |
| MEDIUM | server/src/services/fusion.ts | 87 | // ── Saved fusion config (dashboard-managed default) ───────────────────────── | COMMENT |
| MEDIUM | server/src/services/scoring.ts | 1 | // ── Bandit routing score ──────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/src/services/scoring.ts | 53 | // ── Reliability ─────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/src/services/scoring.ts | 72 | // ── Speed (throughput + TTFB blended into one [0,1] axis) ─────────────────── | COMMENT |
| MEDIUM | server/src/services/scoring.ts | 109 | // ── Intelligence ──────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/src/services/scoring.ts | 117 | // ── Guardrail: free-quota headroom ────────────────────────────────────────── | COMMENT |
| MEDIUM | server/src/services/scoring.ts | 132 | // ── Guardrail: live rate-limit penalty ────────────────────────────────────── | COMMENT |
| MEDIUM | server/src/services/scoring.ts | 144 | // ── Beta sampler (Marsaglia & Tsang via two Gamma draws) ──────────────────── | COMMENT |
| MEDIUM | server/src/services/scoring.ts | 171 | // ── The combined score ────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/src/services/model-groups.ts | 19 | // ── Settings keys ──────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/src/services/model-groups.ts | 42 | // ── Types ──────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/src/services/model-groups.ts | 60 | // ── Settings accessors ─────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/src/services/model-groups.ts | 90 | // ── Normalization ──────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/src/services/model-groups.ts | 131 | // ── Grouping ───────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/src/services/model-groups.ts | 215 | // ── DB convenience ─────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | client/src/components/model-table.tsx | 72 | // ── One row of the unified table ──────────────────────────────────────────── | COMMENT |
| MEDIUM | client/src/lib/routing.ts | 172 | // ── Grouped (unified) rendering ────────────────────────────────────────────── | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | desktop/src/preload.ts | 21 | COMMENT | |
| LOW | server/src/app.ts | 81 | app.use('/api/settings', requireAuth, settingsRouter); | COMMENT |
| LOW | server/src/middleware/rateLimit.ts | 1 | import type { Request, Response, NextFunction } from 'express'; | COMMENT |
| LOW | server/src/providers/openai-compat.ts | 161 | // (1) base URL points at a non-OpenAI-compatible API (Ollama's native | COMMENT |
| LOW | server/src/providers/google.ts | 741 | // - bad/expired key → HTTP 400 INVALID_ARGUMENT / reason API_KEY_INVALID | COMMENT |
| LOW | server/src/providers/index.ts | 101 | // emitted tool calls as text; the new router.huggingface.co meta-router | COMMENT |
| LOW | server/src/providers/index.ts | 201 | // proprietary Agnes models are currently served at $0/token: live-probed | COMMENT |
| LOW | server/src/providers/index.ts | 221 | // returned 402 on every model — "Quota exceeded and account balance is | COMMENT |
| LOW | server/src/providers/index.ts | 261 | }, | COMMENT |
| LOW | server/src/docs/docs-page.ts | 1 | // Self-contained API reference page served at `GET /v1/docs`. | COMMENT |
| LOW | server/src/docs/openapi.ts | 1 | // Hand-written OpenAPI 3.0 description of the public `/v1` surface. | COMMENT |
| LOW | …_tests__/routes/responses-fallback-convergence.test.ts | 1 | import { describe, it, expect, beforeAll, beforeEach, vi } from 'vitest'; | COMMENT |
| LOW | server/src/lib/tool-args.ts | 1 | // Schema-aware repair of double-encoded tool-call arguments. | COMMENT |
| LOW | server/src/lib/setup-code.ts | 1 | import crypto from 'crypto'; | COMMENT |
| LOW | server/src/lib/fallback-loop.ts | 1 | // One shared provider retry/fallback loop for every OpenAI-, Responses- and | COMMENT |
| LOW | server/src/lib/fallback-loop.ts | 41 | import { getSetting } from '../db/index.js'; | COMMENT |
| LOW | server/src/lib/fallback-loop.ts | 401 | COMMENT | |
| LOW | server/src/lib/fallback-loop.ts | 561 | // model behavior, not provider health — recordRetryableFailure already | COMMENT |
| LOW | server/src/lib/guardrails.ts | 1 | // Request-level guardrails: two hard limits, both OFF by default so an | COMMENT |
| LOW | server/src/lib/content.ts | 61 | // shape variations free-tier providers emit. Complements normalizeOutboundContent | COMMENT |
| LOW | server/src/lib/wake-detect.ts | 1 | // Detect that the host slept (laptop lid closed, VM paused) and give the | COMMENT |
| LOW | server/src/lib/url-guard.ts | 1 | import dns from 'node:dns'; | COMMENT |
| LOW | server/src/lib/url-guard.ts | 21 | // existing local setups keep working, but blocked when the operator | COMMENT |
| LOW | server/src/lib/proxy.ts | 321 | url: string, | COMMENT |
| LOW | server/src/lib/proxy.ts | 401 | } | COMMENT |
| LOW | server/src/lib/structured-output.ts | 1 | // Structured-output enforcement for the fallback chain (#514 follow-up). | COMMENT |
| LOW | server/src/lib/sampling-params.ts | 1 | // Extended sampling / output-shape parameters forwarded to providers. | COMMENT |
| LOW | server/src/lib/sampling-params.ts | 101 | } | COMMENT |
| LOW | server/src/lib/sampling-params.ts | 121 | COMMENT | |
| LOW | server/src/lib/sampling-params.ts | 141 | // Cohere's OpenAI-compat endpoint covers seed/penalties/response_format; | COMMENT |
| LOW | server/src/lib/error-classify.ts | 1 | // Upstream-error classification shared by the proxy chat path, the responses | COMMENT |
| LOW | server/src/lib/error-classify.ts | 41 | // attaches err.status — this is the text fallback for errors that don't. | COMMENT |
| LOW | server/src/lib/error-classify.ts | 61 | // Dead-turn classes from the stream turn-integrity layer (#231 audit): | COMMENT |
| LOW | server/src/lib/error-classify.ts | 81 | // the same request is fine on the provider's sibling key or on another provider, | COMMENT |
| LOW | server/src/lib/process-safety-net.ts | 1 | // Process-level safety net for late network transport errors (fork-validated: | COMMENT |
| LOW | server/src/routes/anthropic.ts | 21 | import { applyTokenBudget, tokenBudgetMessage } from '../lib/guardrails.js'; | COMMENT |
| LOW | server/src/routes/anthropic.ts | 41 | // default when a client somehow omits it. | COMMENT |
| LOW | server/src/routes/anthropic.ts | 401 | COMMENT | |
| LOW | server/src/routes/anthropic.ts | 801 | // the caller speaks Anthropic (sends an `anthropic-version` header, as Claude | COMMENT |
| LOW | server/src/routes/mcp.ts | 21 | // | COMMENT |
| LOW | server/src/routes/keys.ts | 361 | notice: noModelsNotice(platform), | COMMENT |
| LOW | server/src/routes/proxy.ts | 41 | } | COMMENT |
| LOW | server/src/routes/proxy.ts | 201 | if (!token || !timingSafeStringEqual(token, unifiedKey)) { | COMMENT |
| LOW | server/src/routes/proxy.ts | 421 | parallel_tool_calls: z.boolean().nullable().optional(), | COMMENT |
| LOW | server/src/routes/proxy.ts | 441 | // properties of undefined (reading '0')", which — once the SSE stream has | COMMENT |
| LOW | server/src/routes/proxy.ts | 1361 | // changes on a success, which returns), so compute it once here. | COMMENT |
| LOW | server/src/routes/proxy.ts | 1481 | if (handoff.injected) console.log(`[Proxy] Context handoff injected (session ${sessionKey.slice(0, 8)}…, model swi | COMMENT |
| LOW | server/src/routes/proxy.ts | 1761 | // return a transport-level "success" the caller can't act on. Mirrors | COMMENT |
| LOW | server/src/routes/proxy.ts | 1801 | COMMENT | |
| LOW | server/src/routes/responses.ts | 41 | // translates it to the internal chat-message format, runs it through the SAME | COMMENT |
| LOW | server/src/services/router.ts | 1041 | // Tool-bearing requests skip models that can't emit structured tool_calls. | COMMENT |
| LOW | server/src/services/router.ts | 1061 | // max_tokens no longer excludes the model — the input must fit, not | COMMENT |
| LOW | server/src/services/anthropic-map.ts | 1 | import { z } from 'zod'; | COMMENT |
| LOW | server/src/services/ratelimit.ts | 301 | COMMENT | |
| LOW | server/src/services/ratelimit.ts | 321 | // not yet seeded — common for ollama, cloudflare, nvidia, huggingface, mistral, | COMMENT |
| LOW | server/src/services/ratelimit.ts | 361 | } | COMMENT |
| LOW | server/src/services/cache.ts | 1 | // Opt-in exact-match response cache. | COMMENT |
| LOW | server/src/services/scoring.ts | 1 | // ── Bandit routing score ──────────────────────────────────────────────────── | COMMENT |
| LOW | shared/types.ts | 61 | | 'opencode' | COMMENT |
| LOW | shared/types.ts | 81 | // BazaarLink — OpenAI-compatible aggregator. Free 'auto:free' route picks an | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | server/src/__tests__/db/migrate/roundtrip.test.ts | 119 | function getLatestAppliedMigrationName(db: Database.Database): string { | CODE |
| LOW | server/src/__tests__/db/migrate/roundtrip.test.ts | 143 | function getEnabledZenDeadPromoCount(db: Database.Database): number { | CODE |
| LOW | server/src/lib/custom-provider-cleanup.ts | 3 | export function deleteUnusedCustomEndpointKey(db: Db, keyId: number | null | undefined) { | CODE |
| LOW⚡ | server/src/lib/guardrails.ts | 49 | export function getRequestMaxTokensBudget(): number { | CODE |
| LOW⚡ | server/src/lib/guardrails.ts | 54 | export function getMaxConsecutiveUpstreamFails(): number { | CODE |
| LOW | server/src/lib/crypto.ts | 156 | export function isEncryptionKeyInitialized(): boolean { | CODE |
| LOW | server/src/lib/error-redaction.ts | 14 | export function sanitizeProviderErrorMessage(message: unknown): string { | CODE |
| LOW | server/src/lib/sampling-params.ts | 193 | export function platformDropsResponseFormat(platform: string): boolean { | CODE |
| LOW | server/src/lib/sampling-params.ts | 214 | export function supportedParametersForPlatforms(platforms: string[], caps: { tools?: boolean } = {}): string[] { | CODE |
| LOW | server/src/lib/error-classify.ts | 123 | export function isDailyQuotaExhaustedError(err: any): boolean { | CODE |
| LOW | server/src/lib/error-classify.ts | 132 | export function isProviderBadRequestError(err: any): boolean { | CODE |
| LOW | server/src/lib/error-classify.ts | 170 | export function isModelAccessForbiddenError(err: any): boolean { | CODE |
| LOW | server/src/db/migrate/cli.ts | 104 | function updateDefaultMigrationRegistry(filename: string): void { | CODE |
| LOW | server/src/db/migrate/runner.ts | 98 | function initializeMigrationTracking(db: Db): void { | CODE |
| LOW | server/src/db/migrate/runner.ts | 173 | function runLatestDownMigrationSync( | CODE |
| LOW | server/src/db/migrate/runner.ts | 213 | function getDefaultMigrationRecords(): MigrationRecord[] { | CODE |
| LOW | server/src/db/migrate/runner.ts | 262 | function getMigrationFileExtension(options: MigrationRunnerOptions): '.ts' | '.js' { | CODE |
| LOW | server/src/routes/proxy.ts | 585 | function completionPromptToMessages(prompt: string, suffix?: string): ChatMessage[] { | CODE |
| LOW | server/src/services/model-state.ts | 77 | export function recordCatalogModelTombstone( | CODE |
| LOW | server/src/services/model-state.ts | 93 | export function clearCatalogModelTombstone( | CODE |
| LOW | server/src/services/model-state.ts | 164 | export function deleteTombstonedCatalogModels(db: Db): number { | CODE |
| LOW | server/src/services/provider-quota.ts | 80 | export function getQuotaObservationContext(): QuotaObservationContext | undefined { | CODE |
| LOW | server/src/services/provider-quota.ts | 209 | export function parseQuotaObservationsFromResponse( | CODE |
| LOW | server/src/services/provider-quota.ts | 388 | export function recordQuotaObservationsFromResponse( | CODE |
| LOW | server/src/services/provider-quota.ts | 404 | function normalizeExpiredQuotaState(db: ReturnType<typeof getDb>): void { | CODE |
| LOW | server/src/services/router.ts | 423 | function usableKeyCountsByPlatform(db: Db): Map<string, number> { | CODE |
| LOW | server/src/services/router.ts | 839 | export function resolveModelGroupCandidates(memberDbIds: number[]): ChainRow[] { | CODE |
| LOW | server/src/services/context-handoff.ts | 111 | export function maybeInjectContextHandoff(params: { | CODE |
| LOW | server/src/services/declarative-config.ts | 380 | export function applyDeclarativeConfigFromEnv(): DeclarativeConfigResult { | CODE |
| LOW | server/src/services/ratelimit.ts | 193 | export function getProviderDailyRequestCap(platform: string): number | null { | CODE |
| LOW | server/src/services/ratelimit.ts | 202 | function countPersistedProviderRequests( | CODE |
| LOW | server/src/services/ratelimit.ts | 222 | export function providerDailyRequestCount(platform: string, keyId: number, now = Date.now()): number { | CODE |
| LOW | server/src/services/ratelimit.ts | 376 | export function getCooldownDurationForLimit( | CODE |
| LOW | server/src/services/model-groups.ts | 201 | export function resolveRequestedIdToMembers(requested: string, groups: ModelGroup[]): number[] | null { | CODE |
| LOW | server/src/services/request-retention.ts | 35 | export function getRequestAnalyticsRetentionConfig(): RequestAnalyticsRetentionConfig { | CODE |
| LOW | client/src/lib/utils.ts | 21 | export function formatSqliteUtcToLocalTime( | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | server/src/__tests__/lib/guardrails.test.ts | 3 | // Unit tests for the request guardrails (ported from @coffcoe's fork): the | COMMENT |
| MEDIUM | server/src/__tests__/routes/custom-provider.test.ts | 361 | // #470: custom models used to register with supports_tools = 0, so agentic | COMMENT |
| MEDIUM | server/src/__tests__/routes/custom-provider.test.ts | 361 | // #470: custom models used to register with supports_tools = 0, so agentic | COMMENT |
| MEDIUM | server/src/__tests__/routes/proxy-auto-model.test.ts | 145 | // #282: clients read a model's context window from /v1/models; advertise it | COMMENT |
| MEDIUM | server/src/lib/guardrails.ts | 1 | // Request-level guardrails: two hard limits, both OFF by default so an | COMMENT |
| MEDIUM | server/src/db/model-pricing.ts | 64 | // Groq (compound is an agentic pipeline — estimated at its underlying | COMMENT |
| MEDIUM | server/src/routes/fallback.ts | 20 | // breakdown (reliability / speed / intelligence + guardrails). | COMMENT |
| MEDIUM | server/src/routes/settings.ts | 82 | // Get the request guardrails (per-request token budget + failover circuit | COMMENT |
| MEDIUM | server/src/routes/settings.ts | 83 | // breaker). Both default to 0 = disabled; see lib/guardrails.ts. | COMMENT |
| MEDIUM | server/src/routes/settings.ts | 96 | // Update the guardrails. Partial: send just the knob you want to change. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | client/src/pages/MediaDetailPage.tsx | 44 | const key = keyData?.apiKey || 'YOUR_API_KEY' | CODE |
| HIGH | client/src/pages/ModelDetailPage.tsx | 112 | -H "Authorization: Bearer ${keyData?.apiKey || 'YOUR_API_KEY'}" \\ | CODE |
| HIGH | client/src/pages/EmbeddingDetailPage.tsx | 49 | const key = keyData?.apiKey || 'YOUR_API_KEY' | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | server/src/__tests__/routes/auth-setup-code.test.ts | 37 | const CREDS = { email: 'admin@example.com', password: 'supersecret' }; | CODE |
| LOW | server/src/__tests__/routes/auth.test.ts | 58 | const { status, body } = await call(app, 'POST', '/api/auth/setup', { email: 'admin@example.com', password: 'superse | CODE |
| LOW⚡ | server/src/__tests__/routes/auth.test.ts | 71 | const ok = await call(app, 'POST', '/api/auth/login', { email: 'admin@example.com', password: 'supersecret' }); | CODE |
| LOW⚡ | server/src/__tests__/routes/auth.test.ts | 75 | const bad = await call(app, 'POST', '/api/auth/login', { email: 'admin@example.com', password: 'wrongpassword' }); | CODE |
| LOW⚡ | server/src/__tests__/routes/auth.test.ts | 82 | expect(body).toMatchObject({ needsSetup: false, authenticated: true, email: 'admin@example.com' }); | CODE |
| LOW⚡ | server/src/__tests__/routes/auth.test.ts | 86 | const login = await call(app, 'POST', '/api/auth/login', { email: 'admin@example.com', password: 'supersecret' }); | CODE |
| LOW | client/src/i18n/locales/zh-CN.json | 545 | "placeholder": "搜索页面、模型、操作…", | CODE |
| LOW | client/src/i18n/locales/en.json | 562 | "placeholder": "Search pages, models, actions…", | CODE |
| LOW | client/src/i18n/locales/it.json | 545 | "placeholder": "Cerca pagine, modelli, azioni…", | CODE |
| LOW | client/src/i18n/locales/fr.json | 545 | "placeholder": "Rechercher des pages, modèles, actions…", | CODE |
| LOW | client/src/i18n/locales/pt-BR.json | 545 | "placeholder": "Buscar páginas, modelos, ações…", | CODE |
| LOW | client/src/i18n/locales/es.json | 545 | "placeholder": "Buscar páginas, modelos, acciones…", | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | server/src/lib/error-classify.ts | 10 | // This structured check is the robust primary signal; the message-substring | COMMENT |
| MEDIUM | server/src/services/fusion.ts | 68 | // the whole request — a panel is robust to missing members by design. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | server/src/__tests__/lib/structured-output.test.ts | 26 | const r = enforceJsonContent('Sure! Here is the requested JSON: {"name":"Ada","tags":["a","b"]} Let me know if you n | CODE |