1.4

Adjusted Signal

1.4

Raw Pattern Score

100%

Time Factor

—

Last Push

—

Stars

—

Language

431.1K

Lines of Code

1.2K

Files

498

Pattern Hits

2026-10-31

Scan Date

0.01

HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 5.0/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 467 finding(s).

Hallucinated Dependency & Supply Chain Risk 1.7/100 · LOW

Are imports declared and package/API names verified? 31 finding(s).

Agent Over-Engineering Ratio 4.2/100 · LOW

Are wrappers, guards, and repeated structures necessary? 372 finding(s).

PR Review Velocity Impact 6.9/100 · LOW

Which changes need focused human review? 498 finding(s).

What These Metrics Mean

Adjusted Signal: Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score: Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor: A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits: Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate: High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files: Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 11HIGH 1MEDIUM 6LOW 480

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 498 distinct pattern matches across 6 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Hyper-Verbose Identifiers372 hits · 368 pts

Severity	File	Line	Snippet	Context
LOW	extension/background.js	783	function bindCommandAckProvisional(provisional, conversationId) {	CODE
LOW	extension/background.js	983	function journalCountForConversation(conversationId) {	CODE
LOW	extension/background.js	988	async function deliverConversationJournal(conversationId) {	CODE
LOW	extension/background.js	1656	async function carryFreshReloadProvisional(tab, documentId) {	CODE
LOW	extension/background.js	1679	async function adoptFreshReloadProvisional(tab, documentId) {	CODE
LOW	extension/background.js	1943	async function rememberBackgroundPlacement(value) {	CODE
LOW	extension/background.js	2107	async function reconcileBackgroundWindow(policy) {	CODE
LOW	extension/background.js	2246	function prepareDesktopInputReceipt(tabId, id, documentId) {	CODE
LOW	extension/background.js	2581	async function currentModelCatalogTarget(nonce) {	CODE
LOW	extension/background.js	2592	async function releaseModelCatalogTarget(nonce) {	CODE
LOW	extension/background.js	2674	function inspectRequestedPluginRefresh(publications, background, browserOnly = false) {	CODE
LOW	extension/background.js	2926	async function applyRequestedBrowserPreferences(request) {	CODE
LOW	extension/background.js	4093	async function currentConversationDocument(source, conversationId) {	CODE
LOW	extension/background.js	5130	async function cachedEnvironmentDiagnostics() {	CODE
LOW	extension/background.js	5138	async function companionDiagnosticSnapshot(found) {	CODE
LOW	extension/background.js	5178	function publishCompanionDiagnostics(changed = false) {	CODE
LOW	extension/background.js	5451	function clearDeferredRevivalOffersForTab(tabId) {	CODE
LOW	extension/background.js	5458	function offerDeferredRevivalToTab(entry, tab) {	CODE
LOW	extension/background.js	5685	async function reconcileDeferredRevivalsWithApp() {	CODE
LOW	extension/fiber.js	632	function authoredAssistantMessages(messages, budget) {	CODE
LOW	extension/content.js	179	function notePresentationScrollInput(event) {	CODE
LOW	extension/content.js	901	function matchesSubmittedBootstrap(message, expected) {	CODE
LOW	extension/content.js	938	function acceptedTemporaryDecisionUser(message, decision) {	CODE
LOW	extension/content.js	1782	function claimUnrecordedGeneration(nowGenerating, observedTurns) {	CODE
LOW	extension/content.js	4244	function nativeImageCaptureOwnerCurrent(key, image, observation, heldEpoch, heldConversation) {	CODE
LOW	extension/content.js	5787	function priorStreamRootCompatible(priorKey, rendered) {	CODE
LOW	extension/content.js	6564	function presentationScrollContainer(node) {	CODE
LOW	extension/content.js	6577	function presentationViewportAnchor(sourceTurns) {	CODE
LOW	extension/content.js	6607	function restorePresentationViewport(anchor) {	CODE
LOW	extension/content.js	9155	function compactionSummaryProgress() {	CODE
LOW	extension/content.js	9986	async function maybeResumePendingCompaction(forId = conversationId, forEpoch = epoch) {	CODE
LOW	extension/content.js	10012	async function releaseUndeliveredHandoff(forId, forEpoch) {	CODE
LOW	extension/content.js	10069	function resumePendingCompactionFromRepair(expectedConversationId) {	CODE
LOW	extension/content.js	10610	async function reconcileContinuationMarker(key, marked) {	CODE
LOW	extension/content.js	10684	function releaseContinuationJournal() {	CODE
LOW	extension/content.js	10693	function reconcileContinuationMarkers(markedTurns = markedContinuationTurns()) {	CODE
LOW	extension/content.js	10895	function maybeRecoverResumeGoalTurn() {	CODE
LOW	extension/content.js	10956	function maybeRecoverDurableGoalTurn() {	CODE
LOW	extension/content.js	11691	function rememberResumeGoalPending(conversation, commandId) {	CODE
LOW	extension/content.js	11755	function waitForRevivalSubmitReady(target, attempt, report = () => undefined) {	CODE
LOW	extension/content.js	11836	async function waitForDeferredRevivalCustody(id, target, attempt) {	CODE
LOW	extension/content.js	12877	function flushStreamRequestOrigins() {	CODE
LOW	extension/content.js	12896	function confirmStreamRequestOrigin(claimed, requestIds, observedAt) {	CODE
LOW	extension/content.js	13106	function publishDesktopDecisionPartial() {	CODE
LOW	extension/content.js	13120	async function confirmedProviderTerminal(recordedFinal = false) {	CODE
LOW	test/extension.test.ts	1086	const source = backgroundSource.slice(backgroundSource.indexOf('function publishCompanionDiagnostics('),	CODE
LOW	test/extension.test.ts	1087	backgroundSource.indexOf('\nchrome.runtime.onMessage.addListener', backgroundSource.indexOf('function publishCompa	CODE
LOW	test/extension.test.ts	1107	const source = backgroundSource.slice(backgroundSource.indexOf('function publishCompanionDiagnostics('),	CODE
LOW	test/extension.test.ts	1108	backgroundSource.indexOf('\nchrome.runtime.onMessage.addListener', backgroundSource.indexOf('function publishCompa	CODE
LOW	test/model-startup-wake.test.ts	7	const wake = source.slice(source.indexOf('let wakeSocket = null;'), source.indexOf('async function applyRequestedBrowser	CODE
LOW	test/plugin-refresh-workflow.test.ts	209	function registrationGatedWorkflow(action: 'current' \| 'manual' \| 'claim' \| 'fail' \| 'complete') {	CODE
LOW	test/codex-view-image-parity.test.ts	48	function pngWithCorruptDeflateAndValidChunkCrc(): Buffer {	CODE
LOW⚡	test/codex-view-image-parity.test.ts	77	function pngWithValidZlibHeaderOverGarbageDeflate(): Buffer {	CODE
LOW⚡	test/codex-view-image-parity.test.ts	82	function pngWithTruncatedPixelData(): Buffer {	CODE
LOW⚡	test/codex-view-image-parity.test.ts	87	function pngWithOversizedDecodedGeometry(): Buffer {	CODE
LOW	test/codex-view-image-parity.test.ts	143	function jpegWithScanHeaderButNoEntropyData(): Buffer {	CODE
LOW	test/codex-view-image-parity.test.ts	161	function gifWithDescriptorButNoLzwData(): Buffer {	CODE
LOW	test/codex-view-image-parity.test.ts	174	function webpWithoutImageBitstream(): Buffer {	CODE
LOW	docs/superpowers/plans/2026-10-11-app-id-attribution.md	237	export function resetConnectorIdentityForTests(): void {	CODE
LOW	…cs/superpowers/plans/2026-10-11-tab-group-placement.md	364	- `async function rememberBackgroundPlacement(value): Promise<void>` (sets and persists to `chrome.storage.local.backg	CODE
312 more matches not shown…

Hallucination Indicators11 hits · 125 pts

Severity	File	Line	Snippet	Context
CRITICAL	test/browser-control-navigation.test.ts	64	expect(chrome.debugger.sendCommand.mock.calls.some(([,method])=>method==='Page.navigate')).toBe(false);	CODE
CRITICAL	test/cos-browser-sign-in-host.test.ts	79	const panelState = (panel = native.panels.at(-1)!) => panel.webContents.send.mock.calls.at(-1)?.[1];	CODE
CRITICAL	test/browser-network-stream.test.ts	110	expect(f.chrome.debugger.sendCommand.mock.calls.some(c=>c[1]==='Network.streamResourceContent'\|\|c[1]==='Network.getR	CODE
CRITICAL	test/browser-network-stream.test.ts	116	expect(f.chrome.debugger.sendCommand.mock.calls.some(c=>c[1]==='Network.streamResourceContent'\|\|c[1]==='Network.getR	CODE
CRITICAL⚡	test/browser-network-stream.test.ts	132	expect(f.chrome.debugger.sendCommand.mock.calls.some(c=>c[1]==='Network.streamResourceContent'\|\|c[1]==='Network.getR	CODE
CRITICAL⚡	test/browser-network-stream.test.ts	138	expect(f.chrome.debugger.sendCommand.mock.calls.some(c=>c[1]==='Network.streamResourceContent')).toBe(false);	CODE
CRITICAL⚡	test/browser-network-stream.test.ts	145	expect(f.chrome.debugger.sendCommand.mock.calls.some(c=>c[1]==='Network.streamResourceContent'\|\|c[1]==='Network.getR	CODE
CRITICAL	test/browser-network-stream.test.ts	307	expect(f.chrome.debugger.sendCommand.mock.calls.some(c=>c[1]==='Network.getResponseBody')).toBe(false);	CODE
CRITICAL	test/browser-network-stream.test.ts	404	expect(f.chrome.debugger.sendCommand.mock.calls.some(c=>c[1]==='Network.streamResourceContent')).toBe(false);	CODE
CRITICAL	test/browser-network-stream.test.ts	417	expect(f.chrome.debugger.sendCommand.mock.calls.some(c=>c[1]==='Network.streamResourceContent')).toBe(false);	CODE
CRITICAL	test/browser-network-stream.test.ts	442	expect(f.chrome.debugger.sendCommand.mock.calls.filter(c=>c[1]==='Network.streamResourceContent')).toHaveLength(1);	CODE

Over-Commented Block89 hits · 60 pts

Severity	File	Line	Snippet	Context
LOW	extension/background.js	5301	// the content script, so neither pagehide nor any later observer can retire this conversation.	COMMENT
LOW	extension/chatgpt-dom.js	281	// node — which contains the stream this extension drew into that very turn. The	COMMENT
LOW	extension/chatgpt-dom.js	3281	// The shell trigger needs MAIN ownership proof. A cold account can hydrate	COMMENT
LOW	extension/fiber.js	901	// turn. A Retry/Regenerate can leave the previous finished attempt in the same model while	COMMENT
LOW	extension/fiber.js	2501	desiredTurnStamps.set(slot.node, `${scanToken}:${index}`);	COMMENT
LOW	extension/usage.js	421	// The exception, and only within one response: ChatGPT now splits the two sides across	COMMENT
LOW	extension/content.js	21	* module returns, so a ChatGPT redesign cannot reach past it.	COMMENT
LOW	extension/content.js	2461	return { outcome: 'failed', detail: failure.text,	COMMENT
LOW	extension/content.js	2841	return turnSnapshot;	COMMENT
LOW	extension/content.js	2881	pendingObjectiveSend = opening.receipt;	COMMENT
LOW	extension/content.js	2961	}	COMMENT
LOW	extension/content.js	3021	// the live turn at sequence 2, the user message that asked for it at 3, and the	COMMENT
LOW	extension/content.js	3081	finishGeneration(ended, steering \|\| replacedUnfinished ? { ...bounded, continued: true } : bounded, false);	COMMENT
LOW	extension/content.js	3121	bindResumeGoalTurn(turnId);	COMMENT
LOW	extension/content.js	3141	// what keeps the app's `turn_start` the only one — repeating it would clear the very	COMMENT
LOW	extension/content.js	3181	// Request ownership is a page-model fact, not a rendered-row fact. React can leave the	COMMENT
LOW	extension/content.js	3221	// the conversation is next synced. Until 1.8.8 the only reader of that field ran while	COMMENT
LOW	extension/content.js	3241	// that chat twelve times over two and a half hours, each reload re-arming this clock and	COMMENT
LOW	extension/content.js	3301	(quietOutcome.outcome === 'completed' && freshOutcome.outcome !== 'completed'))	COMMENT
LOW	extension/content.js	3601	if (!generating && epoch === settledEpoch && fiberSettled === settled) void refreshFiber(settled);	COMMENT
LOW	extension/content.js	4661	const askedEpoch = epoch;	COMMENT
LOW	extension/content.js	4761	// request-id grace period for evidence we had deliberately thrown away and filed the call	COMMENT
LOW	extension/content.js	4821	// they must not repaint another response halfway through feed restoration.	COMMENT
LOW	extension/content.js	4861	//	COMMENT
LOW	extension/content.js	5001	// `request_id` across the retries within a turn — live 2026-08-21, session	COMMENT
LOW	extension/content.js	5181	// ChatGPT exposes a public message id. A thought parent is a stronger logical anchor	COMMENT
LOW	extension/content.js	5601	// Membership is by durable id and nothing else. An event naming a turn this feed	COMMENT
LOW	extension/content.js	6001	// message/thought identity (or this document's live/settled node ownership) already chose	COMMENT
LOW	extension/content.js	6781	const ids = (descriptor.thoughtNotifications \|\| [])	COMMENT
LOW	extension/content.js	6901	// rather than by the section showing it. Deliberately not `turn.id`: a section with no	COMMENT
LOW	extension/content.js	7561	function settingsView(input) {	COMMENT
LOW	extension/content.js	8621	// input listener, so typing a goal repaints nothing.	COMMENT
LOW	extension/content.js	10241	nativePhase = 'settling';	COMMENT
LOW	extension/content.js	11981	//	COMMENT
LOW	extension/content.js	12481	// Refusals decided before the native Send click: nothing reached ChatGPT (#1086).	COMMENT
LOW	extension/content.js	13061	const assistant = messages.at(-1);	COMMENT
LOW	extension/content.js	14121	const settle = settledPluginView();	COMMENT
LOW	extension/content.js	14581	}	COMMENT
LOW	test/mcp.test.ts	1001	expect(coreBytes, `core tools/list is ${coreBytes} bytes`).toBeLessThan(20_500);	COMMENT
LOW	src/renderer/main.ts	1961		COMMENT
LOW	src/renderer/styles.css	4341	.session-controls-menu { padding: 8px 0 0; margin-top: 8px; border-top: 1px solid var(--line); }	COMMENT
LOW	src/renderer/styles.css	4361	#automationSwitch .mode-edit:hover:not(:disabled) { color: var(--ink); background: var(--hover); }	COMMENT
LOW	src/main/report-scrub.ts	101	.sort((a, b) => b.length - a.length);	COMMENT
LOW	src/main/exec-hints.ts	401	* extra fact the display name intentionally throws away: whether the caller used a path.	COMMENT
LOW	src/main/agents.ts	3121	function planFinish(agent: Agent, result: string): { info: AgentInfo; report: AgentMessage } {	COMMENT
LOW	src/main/agents.ts	4361	// just as much as a call is. Refusing it made a worker whose request-id path broke unwakeable	COMMENT
LOW	src/main/agents.ts	4381	if (agent.info.state === 'detached' && source === 'call') {	COMMENT
LOW	src/main/bridge.ts	1701	if (!tool && !bare) continue;	COMMENT
LOW	src/main/bridge.ts	2661	{ error: 'secure_storage_unavailable', message: storage.detail ?? 'Secure credential storage is unavailable.' },	COMMENT
LOW	src/main/bridge.ts	3341	if (!id) return json(res, 400, { error: 'bad_conversation_id' }, origin);	COMMENT
LOW	src/main/bridge.ts	3521	await noteRecoveryObservations(id, result.sessionId, observations, result.activity);	COMMENT
LOW	src/main/bridge.ts	3601	// A browser tab closing is not evidence that the server-side ChatGPT turn has stopped.	COMMENT
LOW	src/main/bridge.ts	3861	(authored === expected \|\| authoredAsTyped === expected)) bootstrapMessageId = openingUserMessage.messageId;	COMMENT
LOW	src/main/bridge.ts	4021	200,	COMMENT
LOW	src/main/bridge.ts	4061	resetActivity,	COMMENT
LOW	src/main/bridge.ts	4081	// ChatGPT's page no longer sees a running turn's results, so the compaction barrier falls	COMMENT
LOW	src/main/bridge.ts	4101	? { recordedQuestionFirst: true } : {}),	COMMENT
LOW	src/main/bridge.ts	5101	// to redeem owns the command until its lease lapses — a second tab on the same marker	COMMENT
LOW	src/main/bridge.ts	6181	server = instance;	COMMENT
LOW	src/main/bridge.ts	6241	// outlives its run is a tab that opens later, introduces itself as a worker of	COMMENT
29 more matches not shown…

Fake / Example Data19 hits · 19 pts

Severity	File	Line	Snippet	Context
LOW	extension/browser-control-page.js	39	element.getAttribute('alt') \|\| element.getAttribute('title') \|\| element.getAttribute('placeholder') \|\|	CODE
LOW	test/ui-plain-words.test.ts	22	for (const name of ['title', 'placeholder', 'aria-label']) {	CODE
LOW	test/codex-runtime-parity.test.ts	123	await writeFile(shellFile, 'placeholder', 'utf8');	CODE
LOW	test/renderer-i18n.test.ts	312	for (const attr of ['title', 'placeholder', 'aria-label']) {	CODE
LOW	test/renderer-i18n.test.ts	373	.flatMap(node => ['title', 'aria-label', 'placeholder'].map(name => node.getAttribute(name) ?? ''))].join('\n');	CODE
LOW	test/renderer-i18n.test.ts	385	.flatMap(node => ['title', 'aria-label', 'placeholder'].map(name => node.getAttribute(name) ?? ''))].join('\n');	CODE
LOW	src/renderer/usage.ts	128	const input = document.createElement('input'); input.type = 'number'; input.min = '0'; input.step = '0.01'; ui(input	CODE
LOW	src/renderer/main.ts	1936	ui(apiKey, 'placeholder', () => next.hasApiKey ? t("•••••••• stored") : 'sk-…');	CODE
LOW	src/renderer/i18n.ts	101	type Property = 'textContent' \| 'title' \| 'placeholder' \| 'aria-label' \| 'aria-valuetext' \| 'data-usage-hint' \| 'data-em	CODE
LOW	src/renderer/i18n.ts	176	for (const property of ['title', 'placeholder', 'aria-label'] as const) {	CODE
LOW	src/renderer/chat-search.ts	232	ui(field, 'placeholder', () => t("Search chats"));	CODE
LOW	src/renderer/chat.ts	507	ui($<HTMLTextAreaElement>('chatInput'), 'placeholder', () => fileDragOver ? t('Drop to attach, up to 20 files') : read	CODE
LOW	src/renderer/chat.ts	1484	ui(field, 'placeholder', () => t("Leave empty to use ChatGPT's title"));	CODE
LOW	src/renderer/chat.ts	3438	ui($<HTMLTextAreaElement>('sessionObjective'), 'placeholder', () => loop ? t("What should each continuation focus on?"	CODE
LOW	src/renderer/chat.ts	4101	add(label?.textContent \|\| control.getAttribute('aria-label') \|\| control.getAttribute('placeholder') \|\| '');	CODE
LOW	src/renderer/chat.ts	4107	add(control.getAttribute('aria-label') \|\| control.getAttribute('placeholder') \|\| '');	CODE
LOW	src/renderer/chat.ts	8089	ui(goalKey, 'placeholder', () => state.hasGoalKey ? t("•••••••• stored") : 'sk-or-v1-…');	CODE
LOW	src/renderer/chat.ts	8099	ui(goalCustomKey, 'placeholder', () => state.hasCustomProviderKey ? t("•••••••• stored") : t("leave empty for a keyles	CODE
LOW	src/renderer/settings-search.ts	185	ui(field, 'placeholder', () => t("Search settings…"));	CODE

Modern AI Meta-Vocabulary6 hits · 12 pts

Severity	File	Line	Snippet	Context
MEDIUM	docs/worklog-2026-09-19-backlog-triage.md	80	\| [#105](https://github.com/totec448-spec/chat-on-steroids/issues/105) Feature request: Aster-style live Agent Monitor f	CODE
MEDIUM	docs/worklog-2026-09-19-backlog-triage.md	92	\| [#171](https://github.com/totec448-spec/chat-on-steroids/issues/171) Multi-agent research needs hard lifecycle control	CODE
MEDIUM	docs/worklog-2026-09-19-backlog-triage.md	94	\| [#181](https://github.com/totec448-spec/chat-on-steroids/issues/181) Let a Prime agent create other prime agents, not	CODE
MEDIUM	docs/worklog-2026-09-19-backlog-triage.md	106	\| [#208](https://github.com/totec448-spec/chat-on-steroids/issues/208) Architecture: capability parity audit for memory,	CODE
MEDIUM	docs/github-triage-2026-09-22.md	82	\| [#208](https://github.com/totec448-spec/chat-on-steroids/issues/208) Architecture: capability parity audit for memory,	CODE
MEDIUM	docs/github-triage-2026-09-22.md	102	\| [#105](https://github.com/totec448-spec/chat-on-steroids/issues/105) Feature request: Aster-style live Agent Monitor f	CODE

Magic Placeholder Names1 hit · 5 pts

Severity	File	Line	Snippet	Context
HIGH	test/secrets-shield.test.ts	68	'API_KEY=your-api-key',	CODE

totec448-spec/chat-on-steroids

Open-Source Code Quality, Security and Technical Debt Review