1.2

Adjusted Signal

1.2

Raw Pattern Score

100%

Time Factor

2026-10-31

Last Push

4.8K

Stars

TypeScript

Language

537.5K

Lines of Code

2.7K

Files

368

Pattern Hits

2026-10-31

Scan Date

0.00

HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 2.5/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 203 finding(s).

Hallucinated Dependency & Supply Chain Risk 0.7/100 · LOW

Are imports declared and package/API names verified? 72 finding(s).

Agent Over-Engineering Ratio 2.7/100 · LOW

Are wrappers, guards, and repeated structures necessary? 93 finding(s).

PR Review Velocity Impact 5.4/100 · LOW

Which changes need focused human review? 368 finding(s).

What These Metrics Mean

Adjusted Signal: Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score: Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor: A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits: Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate: High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files: Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 0HIGH 0MEDIUM 115LOW 253

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 368 distinct pattern matches across 9 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Decorative Section Separators93 hits · 294 pts

Severity	File	Line	Snippet	Context
MEDIUM⚡	deploy/k8s/values.yaml	21	# =============================================================================	COMMENT
MEDIUM⚡	deploy/k8s/values.yaml	23	# =============================================================================	COMMENT
MEDIUM	deploy/k8s/values.yaml	47	# =============================================================================	COMMENT
MEDIUM	deploy/k8s/values.yaml	49	# =============================================================================	COMMENT
MEDIUM	deploy/k8s/values.yaml	64	# =============================================================================	COMMENT
MEDIUM	deploy/k8s/values.yaml	66	# =============================================================================	COMMENT
MEDIUM	deploy/k8s/values.yaml	81	# =============================================================================	COMMENT
MEDIUM	deploy/k8s/values.yaml	83	# =============================================================================	COMMENT
MEDIUM	deploy/k8s/values.yaml	138	# =============================================================================	COMMENT
MEDIUM	deploy/k8s/values.yaml	140	# =============================================================================	COMMENT
MEDIUM	deploy/k8s/values.yaml	174	# =============================================================================	COMMENT
MEDIUM	deploy/k8s/values.yaml	176	# =============================================================================	COMMENT
MEDIUM	deploy/k8s/values.yaml	209	# =============================================================================	COMMENT
MEDIUM	deploy/k8s/values.yaml	211	# =============================================================================	COMMENT
MEDIUM	deploy/k8s/values.yaml	250	# =============================================================================	COMMENT
MEDIUM	deploy/k8s/values.yaml	252	# =============================================================================	COMMENT
MEDIUM	backend/src/api/encryption-v2.test.ts	236	// ─── First-device bootstrap ─────────────────────────────────────────	COMMENT
MEDIUM	backend/src/api/encryption-v2.test.ts	401	// ─── Approve via challenge signature ────────────────────────────────	COMMENT
MEDIUM	backend/src/api/encryption-v2.test.ts	592	// ─── GET /encryption/challenge ──────────────────────────────────────	COMMENT
MEDIUM	backend/src/api/encryption-v2.test.ts	661	// ─── Wrapped-DEK keyring ────────────────────────────────────────────	COMMENT
MEDIUM	backend/src/api/encryption-v2.test.ts	740	// ─── AK rotation ────────────────────────────────────────────────────	COMMENT
MEDIUM	backend/src/api/encryption-v2.test.ts	1462	// ─── v1→v2 upgrade ──────────────────────────────────────────────────	COMMENT
MEDIUM	backend/src/api/encryption-v2.test.ts	1669	// ─── deny (challenge proof) ─────────────────────────────────────────	COMMENT
MEDIUM	backend/src/api/encryption-v2.test.ts	1715	// ─── Org escrow (THU-804) ───────────────────────────────────────────	COMMENT
MEDIUM	backend/src/api/encryption-v2.test.ts	1941	// ─── canary metadata (v2 shape) ─────────────────────────────────────	COMMENT
MEDIUM	backend/src/api/encryption-v2.test.ts	1976	// ─── Device–session binding (THU-873) ───────────────────────────────	COMMENT
MEDIUM	backend/src/api/encryption-v2.test.ts	2212	// ─── Security notifications + step-up request (THU-875) ─────────────	COMMENT
MEDIUM	backend/src/api/encryption.test.ts	155	// ─── POST /devices ──────────────────────────────────────────────────	COMMENT
MEDIUM	backend/src/api/encryption.test.ts	423	// ─── GET /devices/me/envelope ───────────────────────────────────────	COMMENT
MEDIUM	backend/src/api/encryption.test.ts	541	// ─── GET /encryption/canary ─────────────────────────────────────────	COMMENT
MEDIUM	backend/src/api/encryption.test.ts	586	// ─── POST /devices/me/node-id (self-enroll) ─────────────────────────	COMMENT
MEDIUM	backend/src/api/encryption.test.ts	699	// ─── GET /devices/allowlist ─────────────────────────────────────────	COMMENT
MEDIUM	backend/src/api/encryption.test.ts	794	// ─── POST /devices/bridge (register bridge) ─────────────────────────	COMMENT
MEDIUM	backend/src/dal/encryption.ts	16	// ─── Envelopes ────────────────────────────────────────────────────────	COMMENT
MEDIUM	backend/src/dal/encryption.ts	64	// ─── Org-escrow envelopes (THU-804) ───────────────────────────────────	COMMENT
MEDIUM	backend/src/dal/encryption.ts	88	// ─── Encryption metadata ──────────────────────────────────────────────	COMMENT
MEDIUM	backend/src/dal/encryption.ts	298	// ─── Wrapped keys (versioned DEK keyring) ─────────────────────────────	COMMENT
MEDIUM	backend/src/dal/encryption.ts	354	// ─── Challenge nonces ─────────────────────────────────────────────────	COMMENT
MEDIUM	scripts/reset-migrations.sh	7	# -----------------------------------------------------------------------------	COMMENT
MEDIUM	scripts/reset-migrations.sh	9	# -----------------------------------------------------------------------------	COMMENT
MEDIUM	scripts/reset-migrations.sh	21	# -----------------------------------------------------------------------------	COMMENT
MEDIUM	scripts/drop-preview-db.sh	7	# -----------------------------------------------------------------------------	COMMENT
MEDIUM	scripts/drop-preview-db.sh	9	# -----------------------------------------------------------------------------	COMMENT
MEDIUM	scripts/drop-preview-db.sh	34	# -----------------------------------------------------------------------------	COMMENT
MEDIUM⚡	.github/workflows/thunder-deep-review.yml	97	# ─────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM⚡	.github/workflows/thunder-deep-review.yml	100	# ─────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM⚡	.github/workflows/thunder-deep-review.yml	104	# ─────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM⚡	.github/workflows/thunder-deep-review.yml	111	# ─────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM⚡	.github/workflows/thunder-deep-review.yml	119	# ─────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM⚡	.github/workflows/thunder-deep-review.yml	129	# ─────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM⚡	.github/workflows/thunder-deep-review.yml	158	# ─────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM⚡	.github/workflows/thunder-deep-review.yml	164	# ─────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM⚡	.github/workflows/thunder-deep-review.yml	171	# ─────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM⚡	.github/workflows/thunder-deep-review.yml	176	# ─────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM⚡	.github/workflows/thunder-deep-review.yml	183	# ─────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	.github/workflows/thunder-deep-review.yml	1	# =============================================================================	COMMENT
MEDIUM	.github/workflows/thunder-deep-review.yml	22	# =============================================================================	COMMENT
MEDIUM	.github/workflows/thunder-deep-review.yml	143	# ─────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	.github/workflows/thunder-deep-review.yml	220	# ─────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	.github/workflows/thunder-deep-review.yml	339	# ─────────────────────────────────────────────────────────────────────	COMMENT
33 more matches not shown…

Over-Commented Block142 hits · 133 pts

Severity	File	Line	Snippet	Context
LOW	index.html	21	<body>	COMMENT
LOW	playwright.e2ee.config.ts	21	// the multi-minute `vite build` is pure waste on repeat runs. Requires a	COMMENT
LOW	vite.config.ts	101	// bail-out symptom: literal <Trans> at runtime with a green build), so	COMMENT
LOW	vite.config.ts	181	// `@earendil-works/pi-coding-agent` CLI — and its cross-spawn / which / undici /	COMMENT
LOW	miniapps/bunfig.toml	1	# Mini App packages install and run on their own (see the `workspaces` field in	COMMENT
LOW	crates/thunderbolt-acp-client/build.sh	1	#!/usr/bin/env bash	COMMENT
LOW	crates/thunderbolt-acp-client/.cargo/config.toml	1	# getrandom 0.3 needs an explicit backend cfg for wasm32 — without it the wasm	COMMENT
LOW	crates/thunderbolt-acp-client/src/lib.rs	1	/* This Source Code Form is subject to the terms of the Mozilla Public	COMMENT
LOW	crates/thunderbolt-acp-client/src/lib.rs	81	/// We deliberately do NOT pre-warm the relay here (no `endpoint.online()`):	COMMENT
LOW	crates/thunderbolt-acp-client/src/lib.rs	121	/// `thunderbolt iroh allow <node-id>`.	COMMENT
LOW	web/src/styles/starlight.css	501	border-radius: 0 !important;	COMMENT
LOW	deploy/docker/backend-entrypoint.sh	1	#!/bin/sh	COMMENT
LOW	deploy/docker/postgres-init/01-powersync.sh	1	#!/bin/sh	COMMENT
LOW	deploy/k8s/values.yaml	1	# -- Global image pull secrets for private registries (e.g. GHCR)	COMMENT
LOW	deploy/k8s/values.yaml	21	# =============================================================================	COMMENT
LOW	deploy/k8s/values.yaml	101	# -- Minimum compatible app semver.	COMMENT
LOW	deploy/k8s/values.yaml	121	# same place as `powersyncUrl` if you run PowerSync outside the cluster,	COMMENT
LOW	deploy/k8s/values.yaml	141	postgres:	COMMENT
LOW	deploy/k8s/values.yaml	161	passwordBase64: cG9zdGdyZXM=	COMMENT
LOW	deploy/k8s/values.yaml	181	# with tests/powersync-config_test.yaml, deploy/docker/powersync.Dockerfile, both	COMMENT
LOW	deploy/k8s/values.yaml	221	port: 8080	COMMENT
LOW	deploy/k8s/values.yaml	261	# -- Optional per-service hostnames ("preview-style" host-header routing).	COMMENT
LOW	deploy/k8s/templates/secrets.yaml	21	# signing secret (k8s base64-decodes anything under `data:` once). This entry	COMMENT
LOW	deploy/k8s/templates/backend.yaml	41	value: production	COMMENT
LOW	deploy/k8s/templates/backend.yaml	121	{{- end }}	COMMENT
LOW	deploy/iroh-relay/config.example.toml	1	# Production config for a self-hosted iroh relay (iroh-relay v1.0.x).	COMMENT
LOW	deploy/iroh-relay/docker-compose.yml	1	# Self-hosted iroh relay for local development.	COMMENT
LOW	deploy/render/public-agent.yaml	1	# Render Blueprint for a public, anonymous Thunderbolt deployment with a hosted	COMMENT
LOW	deploy/pulumi/index.ts	21	const platform = config.get('platform') \|\| 'fargate'	COMMENT
LOW	deploy/pulumi/src/shared.ts	441	// each register their own `keycloak.openid.Client` resource in `per-pr-stack.ts`	COMMENT
LOW	deploy/pulumi/src/services.ts	321	essential: true,	COMMENT
LOW	backend/src/proxy/routes.ts	361	})	COMMENT
LOW	backend/src/proxy/routes.test.ts	841	)	COMMENT
LOW	backend/src/config/settings.ts	121		COMMENT
LOW	backend/src/config/settings.ts	221	// `corsAllowHeaders` is no longer consumed by any production mount: both	COMMENT
LOW	backend/src/config/settings.ts	241		COMMENT
LOW	backend/src/config/settings.ts	261	// Rollout order: docs/self-hosting/configuration.md#command-line-client-rollout.	COMMENT
LOW	backend/src/config/settings.ts	321	// Trusted proxy (controls which proxy headers are trusted for IP extraction)	COMMENT
LOW	backend/src/config/settings.ts	621	secret: 'order-book-template-dev-secret-xx',	COMMENT
LOW	backend/src/lib/step-up-otp.test.ts	121	const first = await requestStepUpOtp(db, action, cooldownEmail)	COMMENT
LOW	backend/src/api/account.ts	321	// THU-873: pin the caller to the device its session is bound to. The	COMMENT
LOW	backend/src/api/config.ts	61	// pre-cutover bundles gate `encodeForUpload` on `config.e2eeEnabled`, and	COMMENT
LOW	backend/src/api/encryption.ts	541	return { error: 'CLI device IDs must use account registration' }	COMMENT
LOW	backend/src/api/encryption.ts	581	// `deviceId`, so linking would let any session claim any	COMMENT
LOW	backend/src/api/encryption.ts	681	body: t.Object({	COMMENT
LOW	backend/src/api/encryption.ts	1081	// server access in its own transaction and replaces the AK in a second one;	COMMENT
LOW	backend/src/api/encryption.ts	1121		COMMENT
LOW	backend/src/api/encryption.ts	1161	return { nonce, expires_at: expiresAt.toISOString() }	COMMENT
LOW	backend/src/api/encryption.ts	1361	orgEnvelope: t.Optional(t.String({ maxLength: 500 })),	COMMENT
LOW	backend/src/api/encryption.ts	1761	// 1. GET /devices/me/bind-challenge → a nonce SEALED to the claimed	COMMENT
LOW	shared/e2ee-types.ts	181	],	COMMENT
LOW	shared/e2ee-types.ts	201	// Rows written before this entry existed synced as cleartext; the	COMMENT
LOW	scripts/org-escrow-decrypt.ts	461	const deks = await unwrapKeyring(	COMMENT
LOW	scripts/run-e2ee-powersync.sh	1	#!/usr/bin/env bash	COMMENT
LOW	scripts/reset-migrations.sh	1	#!/usr/bin/env bash	COMMENT
LOW	scripts/drop-preview-db.sh	1	#!/usr/bin/env bash	COMMENT
LOW	scripts/drop-preview-db.sh	21	# while the per-stack secrets and backend task definition still exist. It	COMMENT
LOW	.github/workflows/cli-release.yml	1	name: CLI Release	COMMENT
LOW	.github/workflows/desktop-build-signed.yml	1	# Build a SIGNED + notarized macOS desktop app on demand and upload it as a	COMMENT
LOW	.github/workflows/preview-deploy.yml	1	name: Preview Deploy	COMMENT
82 more matches not shown…

Fake / Example Data72 hits · 74 pts

Severity	File	Line	Snippet	Context
LOW	backend/src/waitlist/README.md	14	{ "email": "user@example.com" }	CODE
LOW	backend/src/auth/utils.test.ts	52	const result = buildVerifyUrl('https://app.thunderbolt.io', 'user@example.com', '12345678')	CODE
LOW	backend/src/auth/utils.test.ts	57	const result = buildVerifyUrl('https://app.thunderbolt.io', 'user@example.com', '12345678', 'abc-123-def')	CODE
LOW	backend/src/auth/auth.test.ts	96	name: 'John Doe',	CODE
LOW	backend/src/auth/waitlist-integration.test.ts	219	body: { email: 'user@example.com', type: 'sign-in' },	CODE
LOW	backend/src/dal/otp-challenge.test.ts	141	const result = await validateOtpChallenge(db, 'wrong@example.com', 'fake-token')	CODE
LOW	shared/agent-core/confidential-model.test.ts	90	apiKey: 'placeholder',	CODE
LOW	shared/agent-core/build-app-harness.test.ts	72	apiKey: 'placeholder',	CODE
LOW	docs/internals/widgets.md	535	image="https://example.com/image.jpg" author="John Doe" publishDate="2024-01-01" />	CODE
LOW	.github/qa/layout-probe.js	51	clean(el.getAttribute('placeholder')) \|\|	CODE
LOW	src/artifacts/harness.ts	319	el.getAttribute('placeholder') \|\| el.getAttribute('name');	CODE
LOW	src/debug-transcript/build-payload.test.ts	71	authSession: { user: { id: 'user-1', email: 'user@example.com', isAnonymous: false } },	CODE
LOW	src/debug-transcript/build-payload.test.ts	86	expect(payload.identity).toEqual({ userId: 'user-1', email: 'user@example.com' })	CODE
LOW	src/debug-transcript/api.test.ts	18	identity: { userId: 'user-1', email: 'user@example.com' },	CODE
LOW	src/integrations/thunderbolt-pro/tools.test.ts	85	author: 'John Doe',	CODE
LOW	src/integrations/thunderbolt-pro/tools.test.ts	250	author: 'Jane Doe',	CODE
LOW	src/integrations/thunderbolt-pro/tools.test.ts	279	author: 'Jane Doe',	CODE
LOW	src/integrations/thunderbolt-pro/tools.test.ts	291	expect(sourceCollector[0].author).toBe('Jane Doe')	CODE
LOW	src/integrations/google/tools.test.ts	312	from: { name: 'John Doe', email: 'john@example.com' },	CODE
LOW	src/components/sidebar-footer.test.tsx	117	session: { user: { id: 'real-1', email: 'user@example.com', name: 'Real User', isAnonymous: false } },	CODE
LOW	src/components/sidebar-footer.test.tsx	294	session: { user: { id: 'real-1', email: 'user@example.com', name: 'Real User', isAnonymous: false } },	CODE
LOW	src/components/magic-link-verify.test.tsx	124	renderComponent('user@example.com', undefined)	CODE
LOW⚡	src/components/magic-link-verify.test.tsx	149	renderComponent('user@example.com', '123456')	CODE
LOW⚡	src/components/magic-link-verify.test.tsx	157	renderComponent('user@example.com', '123456')	CODE
LOW⚡	src/components/magic-link-verify.test.tsx	164	renderComponent('user@example.com', '123456')	CODE
LOW⚡	src/components/magic-link-verify.test.tsx	168	email: 'user@example.com',	CODE
LOW⚡	src/components/magic-link-verify.test.tsx	177	renderComponent('user@example.com', '123456', 'challenge-abc')	CODE
LOW	src/components/magic-link-verify.test.tsx	188	const { getLastPathname } = renderComponent('user@example.com', '123456')	CODE
LOW	src/components/magic-link-verify.test.tsx	200	renderComponent('user@example.com', '123456')	CODE
LOW	src/components/magic-link-verify.test.tsx	214	renderComponent('user@example.com', '123456')	CODE
LOW	src/components/magic-link-verify.test.tsx	226	renderComponent('user@example.com', '123456')	CODE
LOW	src/components/magic-link-verify.test.tsx	238	renderComponent('user@example.com', '123456')	CODE
LOW	src/components/magic-link-verify.test.tsx	250	renderComponent('user@example.com', '123456')	CODE
LOW	src/components/magic-link-verify.test.tsx	260	renderComponent('user@example.com', '123456')	CODE
LOW	src/components/magic-link-verify.test.tsx	272	const { getLastPathname } = renderComponent('user@example.com', '123456')	CODE
LOW	src/components/magic-link-verify.test.tsx	288	renderComponent('user@example.com', '123456')	CODE
LOW	src/components/magic-link-verify.test.tsx	302	renderComponent('user@example.com', '123456')	CODE
LOW	src/components/magic-link-verify.test.tsx	309	renderComponent('user@example.com', '123456')	CODE
LOW	src/components/device-approval.test.tsx	27	const authedSession = { user: { id: 'user-1', email: 'user@example.com' } }	CODE
LOW	…nts/settings/agents/create-agent-detail-panel.test.tsx	36	session: { user: { id: 'user-1', email: 'user@example.com', name: 'User', isAnonymous: false } },	CODE
LOW	…ug-transcript/use-share-debug-transcript-state.test.ts	107	session: { user: { id: 'user-1', email: 'user@example.com' } },	CODE
LOW	…ebug-transcript/share-debug-transcript-dialog.test.tsx	73	'placeholder',	CODE
LOW	src/components/chat/chat-messages.test.tsx	115	session: { user: { id: 'user-1', email: 'user@example.com' } },	CODE
LOW	src/components/onboarding/onboarding-name-step.test.tsx	85	fireEvent.change(input, { target: { value: 'John Doe' } })	CODE
LOW	src/components/onboarding/onboarding-name-step.test.tsx	88	expect(input).toHaveValue('John Doe')	CODE
LOW	src/components/onboarding/onboarding-name-step.test.tsx	135	expect(input).toHaveAttribute('placeholder', 'Enter your name')	CODE
LOW	src/components/onboarding/onboarding-name-step.test.tsx	153	expect(input).toHaveAttribute('placeholder', 'Enter your name')	CODE
LOW	src/components/onboarding/onboarding-name-step.test.tsx	162	fireEvent.change(input, { target: { value: 'John Doe' } })	CODE
LOW	src/components/onboarding/onboarding-name-step.test.tsx	280	fireEvent.change(input, { target: { value: 'John Doe' } })	CODE
LOW	src/components/onboarding/onboarding-name-step.test.tsx	305	fireEvent.change(input, { target: { value: 'John Doe' } })	CODE
LOW	src/components/onboarding/onboarding-name-step.test.tsx	308	expect(mockActions.setNameValue).toHaveBeenCalledWith('John Doe')	CODE
LOW	src/components/onboarding/onboarding-name-step.test.tsx	412	fireEvent.change(input, { target: { value: 'John Doe' } })	CODE
LOW	src/components/onboarding/onboarding-name-step.test.tsx	425	fireEvent.change(input, { target: { value: 'John Doe' } })	CODE
LOW	src/components/onboarding/onboarding-name-step.test.tsx	428	expect(mockActions.setNameValue).toHaveBeenCalledWith('John Doe')	CODE
LOW	…/onboarding/wrappers/OnboardingLocationStepWrapper.tsx	16	nameValue: 'John Doe',	CODE
LOW	src/hooks/use-onboarding-state.test.ts	137	result.current.actions.setNameValue('John Doe')	CODE
LOW	src/hooks/use-onboarding-state.test.ts	140	expect(result.current.state.nameValue).toBe('John Doe')	CODE
LOW	src/hooks/use-onboarding-state.test.ts	264	await result.current.actions.submitName('John Doe')	CODE
LOW	src/hooks/use-onboarding-state.test.ts	268	expect(result.current.state.nameValue).toBe('John Doe')	CODE
LOW	src/hooks/use-onboarding-state.test.ts	282	await result.current.actions.submitName('John Doe')	CODE
12 more matches not shown…

AI Slop Vocabulary20 hits · 60 pts

Severity	File	Line	Snippet	Context
MEDIUM	bunfig.toml	3	# The Pi harness packages (the in-browser agent engine) are actively released and	COMMENT
MEDIUM	miniapps/bunfig.toml	4	# is the host app's React harness and has no business here.	COMMENT
MEDIUM	powersync-service/docker-compose.yml	14	# Defaults preserve dev behaviour; the E2EE harness overrides via	COMMENT
MEDIUM	cli/bunfig.toml	7	# The Pi harness packages are actively released and pinned to an exact version	COMMENT
MEDIUM	scripts/run-e2ee-powersync.sh	7	# Boots the PowerSync + Postgres harness (docker-compose) on dedicated ports,	COMMENT
MEDIUM	scripts/run-e2ee-powersync.sh	14	# --keep Leave the Docker harness running after the tests instead of	COMMENT
MEDIUM	.github/workflows/e2e.yml	88	# harness on dedicated ports (5434/8081), then runs playwright.e2ee.config.ts.	COMMENT
MEDIUM	.github/workflows/e2e.yml	91	# Each shard boots its own harness (~4 min fixed) + its slice of the suite.	COMMENT
MEDIUM	.github/qa/scripts/explore.sh	13	# .github/qa/scripts/explore.sh harness <session> <dir> CI: a native session's gate, hook and config in <di	COMMENT
MEDIUM	.github/qa/scripts/explore.sh	30	# In CI c7's second browser can write anywhere in the checkout, so nothing the session runs may come from it. `harness`	COMMENT
MEDIUM	.github/qa/scripts/explore.sh	131	# With a harness every path below is absolute, and claude, the hook and the gate start in an empty dir: a process	COMMENT
MEDIUM	.github/qa/scripts/explore.sh	182	# With a harness the checkout may have been rewritten, and this step holds the key: no repo code runs now.	COMMENT
MEDIUM	e2e/e2ee/helpers.ts	635	// A seamless upgrade never routes through first-device bootstrap — that step	COMMENT
MEDIUM	e2e/e2ee/migration.spec.ts	82	// The seamless upgrade: absorb CK as "v1", mint primary "0", CAS-flip.	COMMENT
MEDIUM	e2e/e2ee/attacks/primary-keyid-steering.spec.ts	96	// account around its keys, then run the seamless upgrade so the keyring	COMMENT
MEDIUM	src/app.tsx	360	// We may need to refactor the database classes to make this more robust.	COMMENT
MEDIUM	src/components/ui/header.tsx	101	// Absolutely positioned so the macOS traffic-light clearance on the left	COMMENT
MEDIUM	src/voice/audio/endpointer.ts	32	// fail to commit (dead air). More sustained frames = more robust against residual	COMMENT
MEDIUM	src/hooks/use-sync-setup.ts	188	// routes into the seamless migration — never a reset.	COMMENT
MEDIUM	src/hooks/use-e2ee-ready.test.tsx	63	// THE regression. The seamless v1→v2 migration runs fire-and-forget from	COMMENT

Structural Annotation Overuse22 hits · 38 pts

Severity	File	Line	Snippet	Context
LOW	.thunderbot/references/pr-workflow.md	129	### Step 1: Collect All Issues in One Pass	COMMENT
LOW	.thunderbot/references/pr-workflow.md	142	### Step 2: Fix All Issues (Batch)	COMMENT
LOW	.thunderbot/references/pr-workflow.md	167	### Step 3: Wait for CI	COMMENT
LOW	.thunderbot/references/pr-workflow.md	175	### Step 4: Reply, Resolve, and Mark Complete	COMMENT
LOW	.thunderbot/references/pr-workflow.md	213	### Step 5: Verify Clean	COMMENT
LOW	backend/src/auth/sso-desktop-callback.ts	68	// Step 1: System browser navigates here → internally calls Better Auth → redirects to IdP	COMMENT
LOW	backend/src/auth/sso-desktop-callback.ts	131	// Step 2: After SSO completes → read session cookie → redirect to loopback with token	COMMENT
LOW⚡	backend/src/haystack/acp-server.test.ts	188	// Step 1: search_sessions bootstrap.	COMMENT
LOW⚡	backend/src/haystack/acp-server.test.ts	194	// Step 2: chat-stream.	COMMENT
LOW	docs/internals/widgets.md	47	### Step 1: Create Widget Directory	COMMENT
LOW	docs/internals/widgets.md	53	### Step 2: Create Required Files	COMMENT
LOW	docs/internals/widgets.md	148	### Step 3: Register in Central Registry	COMMENT
LOW⚡	src/hooks/use-onboarding-state.ts	23	// Step 1: Privacy	COMMENT
LOW⚡	src/hooks/use-onboarding-state.ts	25	// Step 2: Auth	COMMENT
LOW⚡	src/hooks/use-onboarding-state.ts	29	// Step 3: Name	COMMENT
LOW⚡	src/hooks/use-onboarding-state.ts	33	// Step 4: Location	COMMENT
LOW	src/hooks/use-app-initialization.ts	227	// Step 0: Fire-and-forget `/config` fetch. On success `fetchConfig` hydrates	COMMENT
LOW	src/hooks/use-app-initialization.ts	258	// Step 6: HTTP client initialization (use provided client or create one)	COMMENT
LOW	src/hooks/use-app-initialization.ts	291	// Step 1: App directory creation	COMMENT
LOW	src/hooks/use-app-initialization.ts	305	// Step 2: Database initialization	COMMENT
LOW	src/hooks/use-app-initialization.ts	409	// Step 3: Wait for PowerSync initial sync only when sync is	COMMENT
LOW	src/hooks/use-app-initialization.ts	434	// Step 4: Reconcile defaults (uses `modelsDefaults` picked above step 2c	COMMENT

Verbosity Indicators14 hits · 26 pts

Severity	File	Line	Snippet	Context
LOW	backend/src/auth/sso-desktop-callback.ts	68	// Step 1: System browser navigates here → internally calls Better Auth → redirects to IdP	COMMENT
LOW	backend/src/auth/sso-desktop-callback.ts	131	// Step 2: After SSO completes → read session cookie → redirect to loopback with token	COMMENT
LOW⚡	backend/src/haystack/acp-server.test.ts	188	// Step 1: search_sessions bootstrap.	COMMENT
LOW⚡	backend/src/haystack/acp-server.test.ts	194	// Step 2: chat-stream.	COMMENT
LOW⚡	src/hooks/use-onboarding-state.ts	23	// Step 1: Privacy	COMMENT
LOW⚡	src/hooks/use-onboarding-state.ts	25	// Step 2: Auth	COMMENT
LOW⚡	src/hooks/use-onboarding-state.ts	29	// Step 3: Name	COMMENT
LOW⚡	src/hooks/use-onboarding-state.ts	33	// Step 4: Location	COMMENT
LOW	src/hooks/use-app-initialization.ts	227	// Step 0: Fire-and-forget `/config` fetch. On success `fetchConfig` hydrates	COMMENT
LOW	src/hooks/use-app-initialization.ts	258	// Step 6: HTTP client initialization (use provided client or create one)	COMMENT
LOW	src/hooks/use-app-initialization.ts	291	// Step 1: App directory creation	COMMENT
LOW	src/hooks/use-app-initialization.ts	305	// Step 2: Database initialization	COMMENT
LOW	src/hooks/use-app-initialization.ts	409	// Step 3: Wait for PowerSync initial sync only when sync is	COMMENT
LOW	src/hooks/use-app-initialization.ts	434	// Step 4: Reconcile defaults (uses `modelsDefaults` picked above step 2c	COMMENT

Redundant / Tautological Comments3 hits · 5 pts

Severity	File	Line	Snippet	Context
LOW	.thunderbot/setup.sh	36	# Check if already installed	COMMENT
LOW⚡	deploy/k8s/values.yaml	17	# Set it to pin workloads to a particular node pool, e.g.	COMMENT
LOW	.github/workflows/create-version-tag.yml	161	# Check if tag already exists	COMMENT

Modern AI Meta-Vocabulary1 hit · 3 pts

Severity	File	Line	Snippet	Context
MEDIUM	RELEASE.md	431	### Release orchestration	COMMENT

Slop Phrases1 hit · 3 pts

Severity	File	Line	Snippet	Context
MEDIUM	src/ai/streaming/util.ts	31	* Note: This is a basic implementation for common use cases	COMMENT

thunderbird/thunderbolt

Open-Source Code Quality, Security and Technical Debt Review