4.0

Adjusted Signal

4.0

Raw Pattern Score

100%

Time Factor

2026-10-27

Last Push

4.4K

Stars

TypeScript

Language

376.5K

Lines of Code

1.4K

Files

651

Pattern Hits

2026-10-31

Scan Date

0.13

HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 6.0/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 408 finding(s).

Hallucinated Dependency & Supply Chain Risk 11.1/100 · LOW

Are imports declared and package/API names verified? 190 finding(s).

Agent Over-Engineering Ratio 3.5/100 · LOW

Are wrappers, guards, and repeated structures necessary? 179 finding(s).

PR Review Velocity Impact 19.5/100 · LOW

Which changes need focused human review? 651 finding(s).

What These Metrics Mean

Adjusted Signal: Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score: Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor: A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits: Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate: High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files: Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 0HIGH 176MEDIUM 50LOW 425

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 651 distinct pattern matches across 13 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Cross-Language Confusion (JS/TS)171 hits · 840 pts

Severity	File	Line	Snippet	Context
HIGH	packages/just-bash/src/interpreter/control-flow.test.ts	48	elif [ $x -eq 2 ]; then	CODE
HIGH	packages/just-bash/src/interpreter/control-flow.test.ts	50	elif [ $x -eq 3 ]; then	CODE
HIGH	…ty/prototype-pollution/prototype-pollution-awk.test.ts	61	print (1 in ${keyword}) ? "exists" : "deleted"	CODE
HIGH	…ty/prototype-pollution/prototype-pollution-awk.test.ts	73	print ("key" in ${keyword}) ? "yes" : "no"	CODE
HIGH	…ty/prototype-pollution/prototype-pollution-awk.test.ts	74	print ("missing" in ${keyword}) ? "yes" : "no"	CODE
HIGH	…y/sandbox/python-sqlite-information-disclosure.test.ts	11	print("LEAK" if bad else "SAFE")	CODE
HIGH⚡	…es/just-bash/src/commands/python3/python3.http.test.ts	183	print("no error")	CODE
HIGH⚡	…es/just-bash/src/commands/python3/python3.http.test.ts	185	print("error raised")	CODE
HIGH⚡	…es/just-bash/src/commands/python3/python3.http.test.ts	201	print("success")	CODE
HIGH⚡	…es/just-bash/src/commands/python3/python3.http.test.ts	203	print("network error")	CODE
HIGH⚡	…es/just-bash/src/commands/python3/python3.http.test.ts	222	print("success")	CODE
HIGH⚡	…es/just-bash/src/commands/python3/python3.http.test.ts	224	print("access denied")	CODE
HIGH	…es/just-bash/src/commands/python3/python3.http.test.ts	47	print(response.status_code)	CODE
HIGH	…es/just-bash/src/commands/python3/python3.http.test.ts	48	print(response.ok)	CODE
HIGH	…es/just-bash/src/commands/python3/python3.http.test.ts	73	print('content-type' in response.headers)	CODE
HIGH	…es/just-bash/src/commands/python3/python3.http.test.ts	97	print(type(data).__name__)	CODE
HIGH	…es/just-bash/src/commands/python3/python3.http.test.ts	98	print(data["key"])	CODE
HIGH	…es/just-bash/src/commands/python3/python3.http.test.ts	132	print(data["headers"].get("X-Custom", "not found"))	CODE
HIGH	…es/just-bash/src/commands/python3/python3.http.test.ts	156	print(response.status_code)	CODE
HIGH	…es/just-bash/src/commands/python3/python3.http.test.ts	157	print(response.ok)	CODE
HIGH	…es/just-bash/src/commands/python3/python3.http.test.ts	250	print(response.status_code)	CODE
HIGH	…es/just-bash/src/commands/python3/python3.http.test.ts	274	print(data["json"]["key"])	CODE
HIGH	…es/just-bash/src/commands/python3/python3.http.test.ts	301	print(response.status_code)	CODE
HIGH	…es/just-bash/src/commands/python3/python3.http.test.ts	302	print(len(response.text))	CODE
HIGH	…es/just-bash/src/commands/python3/python3.http.test.ts	324	print(response.status_code)	CODE
HIGH	…es/just-bash/src/commands/python3/python3.http.test.ts	346	print(response.status_code)	CODE
HIGH	…es/just-bash/src/commands/python3/python3.http.test.ts	368	print(response.status_code)	CODE
HIGH	…es/just-bash/src/commands/python3/python3.http.test.ts	395	print(type(r.content).__name__)	CODE
HIGH	…es/just-bash/src/commands/python3/python3.http.test.ts	396	print(list(r.content[:4]))	CODE
HIGH	…es/just-bash/src/commands/python3/python3.http.test.ts	424	print("saved")	CODE
HIGH	…ust-bash/src/commands/python3/python3.security.test.ts	143	print("VULNERABLE:", f.read()[:50])	CODE
HIGH	…ust-bash/src/commands/python3/python3.security.test.ts	145	print("SAFE: no /etc/passwd in VFS")	CODE
HIGH	…ust-bash/src/commands/python3/python3.security.test.ts	161	print("VULNERABLE:", f.read()[:50])	CODE
HIGH	…ust-bash/src/commands/python3/python3.security.test.ts	163	print("SAFE: /etc/shadow not accessible")	CODE
HIGH	…ust-bash/src/commands/python3/python3.security.test.ts	180	print("VULNERABLE: TCP connected")	CODE
HIGH	…ust-bash/src/commands/python3/python3.security.test.ts	182	print("SAFE:", e)	CODE
HIGH	…ust-bash/src/commands/python3/python3.security.test.ts	207	print("LEAKED:", leaked)	CODE
HIGH	…ust-bash/src/commands/python3/python3.security.test.ts	209	print("SAFE: no host env vars leaked")	CODE
HIGH	…ust-bash/src/commands/python3/python3.security.test.ts	235	print(files)	CODE
HIGH	…ust-bash/src/commands/python3/python3.security.test.ts	248	print(f'root={root}, files={files}')	CODE
HIGH	…ust-bash/src/commands/python3/python3.security.test.ts	262	print('exists:', p.exists())	CODE
HIGH	…ust-bash/src/commands/python3/python3.security.test.ts	263	print('content:', p.read_text().strip())	CODE
HIGH	…ust-bash/src/commands/python3/python3.security.test.ts	277	print(os.getcwd())	CODE
HIGH⚡	…ust-bash/src/commands/python3/python3.security.test.ts	301	print('HTTP_OK:', resp.status_code)	CODE
HIGH⚡	…ust-bash/src/commands/python3/python3.security.test.ts	305	print('OK: bridge works, network not configured')	CODE
HIGH⚡	…ust-bash/src/commands/python3/python3.security.test.ts	307	print('OK: bridge works, got error:', msg[:80])	CODE
HIGH	…s/just-bash/src/commands/python3/python3.files.test.ts	12	print("Hello from script")	CODE
HIGH	…s/just-bash/src/commands/python3/python3.files.test.ts	23	print(f"Args: {sys.argv[1:]}")	CODE
HIGH	…s/just-bash/src/commands/python3/python3.files.test.ts	34	print(sys.argv[0])	CODE
HIGH	…s/just-bash/src/commands/python3/python3.files.test.ts	55	print(result)	CODE
HIGH	…s/just-bash/src/commands/python3/python3.files.test.ts	69	print(json.dumps(data))	CODE
HIGH	…s/just-bash/src/commands/python3/python3.files.test.ts	80	print("hello"	CODE
HIGH	…s/just-bash/src/commands/python3/python3.files.test.ts	140	print(f"executed: {__file__}")	CODE
HIGH	…s/just-bash/src/commands/python3/python3.files.test.ts	171	print(files)	CODE
HIGH	…s/just-bash/src/commands/python3/python3.files.test.ts	205	print(mymodule.greet("World"))	CODE
HIGH	…ges/just-bash/src/commands/python3/python3.env.test.ts	82	it("should return None for undefined env var with get()", async () => {	CODE
HIGH	…ges/just-bash/src/commands/python3/python3.env.test.ts	264	print(list(data))	CODE
HIGH	…ges/just-bash/src/commands/python3/python3.env.test.ts	280	print(len(data), data[5])	CODE
HIGH⚡	…ges/just-bash/src/commands/python3/python3.env.test.ts	293	print('line1')	CODE
HIGH⚡	…ges/just-bash/src/commands/python3/python3.env.test.ts	294	print('line2')	CODE
111 more matches not shown…

Over-Commented Block230 hits · 230 pts

Severity	File	Line	Snippet	Context
LOW	…website/app/components/terminal-parts/agent-command.ts	21	"<path>",	COMMENT
LOW	packages/just-bash/src/interpreter/subshell-group.ts	261	// gives the group its own fd 0, so the enclosing shell's read position has to	COMMENT
LOW	packages/just-bash/src/interpreter/builtins/local.ts	281	// Validate variable name: must start with letter/underscore, contain only alphanumeric/_	COMMENT
LOW	…ages/just-bash/src/interpreter/expansion/word-split.ts	181	// - ${v:-"AxBxC"} - entirely quoted default value, should NOT be split	COMMENT
LOW	…ages/just-bash/src/interpreter/expansion/word-split.ts	301		COMMENT
LOW	…ages/just-bash/src/interpreter/expansion/word-split.ts	321	// - split returning [] (empty array) = nothing to add, continue building	COMMENT
LOW	packages/just-bash/src/interpreter/helpers/array.ts	201	if (word.parts.length < 2) return null;	COMMENT
LOW	packages/just-bash/src/parser/lexer.ts	1361	// Heredocs opened on the current line whose (literal) bodies must be	COMMENT
LOW	packages/just-bash/src/spec-tests/grep/skips.ts	121	],	COMMENT
LOW	packages/just-bash/src/spec-tests/bash/spec.test.ts	41		COMMENT
LOW	packages/just-bash/src/spec-tests/bash/spec.test.ts	81	// "extglob-files.test.sh", // Testing	COMMENT
LOW	packages/just-bash/src/spec-tests/bash/spec.test.ts	101		COMMENT
LOW	…st-bash/src/spec-tests/bash/cases/builtin-echo.test.sh	61		COMMENT
LOW	…st-bash/src/spec-tests/bash/cases/builtin-echo.test.sh	81	# ## END	COMMENT
LOW	…st-bash/src/spec-tests/bash/cases/builtin-echo.test.sh	201	echo -en '\03777' \| od -A n -t x1 \| sed 's/ \+/ /g'	COMMENT
LOW	…st-bash/src/spec-tests/bash/cases/builtin-echo.test.sh	241	a b c d 006	COMMENT
LOW	…ust-bash/src/spec-tests/bash/cases/command-sub.test.sh	1	## compare_shells: dash bash mksh	COMMENT
LOW	…ust-bash/src/spec-tests/bash/cases/command-sub.test.sh	21	foo=FOO; echo `echo $foo`bar`echo $foo`	COMMENT
LOW	…st-bash/src/spec-tests/bash/cases/func-parsing.test.sh	1	## compare_shells: dash bash mksh	COMMENT
LOW	…st-bash/src/spec-tests/bash/cases/func-parsing.test.sh	41	## stdout: 5 0	COMMENT
LOW	…st-bash/src/spec-tests/bash/cases/func-parsing.test.sh	61	## OK dash status: 2	COMMENT
LOW	…ages/just-bash/src/spec-tests/bash/cases/alias.test.sh	441	## OK osh status: 2	COMMENT
LOW	…bash/src/spec-tests/bash/cases/assign-deferred.test.sh	101	## OK bash status: 2	COMMENT
LOW	…just-bash/src/spec-tests/bash/cases/bool-parse.test.sh	1	## oils_failures_allowed: 1	COMMENT
LOW	…st-bash/src/spec-tests/bash/cases/builtin-trap.test.sh	341	# All shells spew warnings to stderr, but don't actually exit! Bad!	COMMENT
LOW	…ust-bash/src/spec-tests/bash/cases/var-op-test.test.sh	61	#	COMMENT
LOW	…ust-bash/src/spec-tests/bash/cases/var-op-test.test.sh	141	echo empty /"${empty[@]}"/	COMMENT
LOW	…ust-bash/src/spec-tests/bash/cases/var-op-test.test.sh	221		COMMENT
LOW	…ust-bash/src/spec-tests/bash/cases/var-op-test.test.sh	821	## N-I dash STDOUT:	COMMENT
LOW	…just-bash/src/spec-tests/bash/cases/word-split.test.sh	401	argv.py at ${!a[@]}	COMMENT
LOW	…just-bash/src/spec-tests/bash/cases/ble-idioms.test.sh	1	## compare_shells: bash zsh mksh ash	COMMENT
LOW	…just-bash/src/spec-tests/bash/cases/ble-idioms.test.sh	61	321:321	COMMENT
LOW	…just-bash/src/spec-tests/bash/cases/ble-idioms.test.sh	461		COMMENT
LOW	…just-bash/src/spec-tests/bash/cases/shell-bugs.test.sh	1	## compare_shells: bash dash mksh zsh ash	COMMENT
LOW	…bash/src/spec-tests/bash/cases/paren-ambiguity.test.sh	141	## STDERR:	COMMENT
LOW	…s/just-bash/src/spec-tests/bash/cases/redirect.test.sh	41	## STDOUT:	COMMENT
LOW	…s/just-bash/src/spec-tests/bash/cases/redirect.test.sh	81		COMMENT
LOW	…s/just-bash/src/spec-tests/bash/cases/redirect.test.sh	121	#### : 3>&3 (OSH regression)	COMMENT
LOW	…s/just-bash/src/spec-tests/bash/cases/redirect.test.sh	181	#### Redirect to empty string	COMMENT
LOW	…s/just-bash/src/spec-tests/bash/cases/redirect.test.sh	441		COMMENT
LOW	…-bash/src/spec-tests/bash/cases/builtin-printf.test.sh	1	## oils_failures_allowed: 1	COMMENT
LOW	…-bash/src/spec-tests/bash/cases/builtin-printf.test.sh	41	# quote 'val' and store it in foo	COMMENT
LOW	…-bash/src/spec-tests/bash/cases/builtin-printf.test.sh	101	## STDOUT:	COMMENT
LOW	…-bash/src/spec-tests/bash/cases/builtin-printf.test.sh	441	# printf: warning: : character(s) following character constant have been ignored	COMMENT
LOW	…-bash/src/spec-tests/bash/cases/builtin-printf.test.sh	461	# 206	COMMENT
LOW	…-bash/src/spec-tests/bash/cases/builtin-printf.test.sh	801	['a b']	COMMENT
LOW	…-bash/src/spec-tests/bash/cases/builtin-printf.test.sh	1341	printf 'three %b\n' '\141' # di	COMMENT
LOW	…st-bash/src/spec-tests/bash/cases/builtin-dirs.test.sh	241	## stdout: ~ ~	COMMENT
LOW	…sh/src/spec-tests/bash/cases/known-differences.test.sh	1	## oils_failures_allowed: 0	COMMENT
LOW	…sh/src/spec-tests/bash/cases/known-differences.test.sh	21	## END	COMMENT
LOW	…bash/src/spec-tests/bash/cases/sh-options-bash.test.sh	21	1	COMMENT
LOW	…s/just-bash/src/spec-tests/bash/cases/command_.test.sh	21	./0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567	COMMENT
LOW	…s/just-bash/src/spec-tests/bash/cases/command_.test.sh	181	status=1	COMMENT
LOW	…/just-bash/src/spec-tests/bash/cases/word-eval.test.sh	1	## compare_shells: dash bash mksh	COMMENT
LOW	…es/just-bash/src/spec-tests/bash/cases/sh-func.test.sh	181		COMMENT
LOW	…-bash/src/spec-tests/bash/cases/strict-options.test.sh	1	## compare_shells: dash bash-4.4 mksh	COMMENT
LOW	…-bash/src/spec-tests/bash/cases/strict-options.test.sh	21	# version of that.	COMMENT
LOW	…ust-bash/src/spec-tests/bash/cases/builtin-set.test.sh	1	## compare_shells: bash dash mksh zsh	COMMENT
LOW	…ust-bash/src/spec-tests/bash/cases/builtin-set.test.sh	141	## stdout: []	COMMENT
LOW	…bash/src/spec-tests/bash/cases/builtin-special.test.sh	101	## OK dash/mksh/ash/yash STDERR:	COMMENT
170 more matches not shown…

Decorative Section Separators44 hits · 132 pts

Severity	File	Line	Snippet	Context
MEDIUM	examples/executor-tools/multi-api-agent.ts	47	// ── Inline tools ─────────────────────────────────────────────────────────	COMMENT
MEDIUM	examples/executor-tools/multi-api-agent.ts	139	// ── Turn 1: agent gathers all three pieces in parallel ──────────────────	COMMENT
MEDIUM	examples/executor-tools/multi-api-agent.ts	172	// ── Turn 2: bash composes the report from saved JSON ────────────────────	COMMENT
MEDIUM	examples/executor-tools/multi-api-agent.ts	203	// ── Turn 3: bash CLI form of the same tools ─────────────────────────────	COMMENT
MEDIUM	examples/executor-tools/multi-api-agent.ts	214	// ── Diagnostic: which tools were called ─────────────────────────────────	COMMENT
MEDIUM	examples/executor-tools/multi-turn-discovery.ts	91	// ── Turn 2: Agent calls a discovered query tool ─────────────────	COMMENT
MEDIUM	examples/executor-tools/multi-turn-discovery.ts	108	// ── Turn 3: Agent filters a list endpoint ───────────────────────	COMMENT
MEDIUM	examples/executor-tools/multi-turn-discovery.ts	123	// ── Turn 4: Agent chains tools — group by continent ─────────────	COMMENT
MEDIUM	examples/executor-tools/multi-turn-discovery.ts	145	// ── Turn 5: Agent writes results to virtual filesystem ──────────	COMMENT
MEDIUM	packages/just-bash/src/commands/awk/ast.ts	7	// ─── Expressions ───────────────────────────────────────────	COMMENT
MEDIUM	packages/just-bash/src/commands/awk/ast.ts	148	// ─── Statements ────────────────────────────────────────────	COMMENT
MEDIUM	packages/just-bash/src/commands/awk/ast.ts	250	// ─── Program Structure ─────────────────────────────────────	COMMENT
MEDIUM	packages/just-bash/src/commands/awk/builtins.ts	168	// ─── String Functions ───────────────────────────────────────────	COMMENT
MEDIUM	packages/just-bash/src/commands/awk/builtins.ts	514	// ─── Math Functions ─────────────────────────────────────────────	COMMENT
MEDIUM	packages/just-bash/src/commands/awk/builtins.ts	599	// ─── Unsupported Functions ──────────────────────────────────────	COMMENT
MEDIUM	packages/just-bash/src/commands/awk/builtins.ts	613	// ─── Printf Formatting ──────────────────────────────────────────	COMMENT
MEDIUM	packages/just-bash/src/commands/awk/builtins.ts	1009	// ─── Built-in Function Registry ─────────────────────────────────	COMMENT
MEDIUM	packages/just-bash/src/commands/awk/parser2.ts	84	// ─── Helper methods ────────────────────────────────────────	COMMENT
MEDIUM	packages/just-bash/src/commands/awk/parser2.ts	175	// ─── Program parsing ───────────────────────────────────────	COMMENT
MEDIUM	packages/just-bash/src/commands/awk/parser2.ts	341	// ─── Statement parsing ─────────────────────────────────────	COMMENT
MEDIUM	packages/just-bash/src/commands/awk/parser2.ts	552	// ─── Expression parsing (precedence climbing) ──────────────	COMMENT
MEDIUM	…h/src/commands/js-exec/js-exec.buffer-encoding.test.ts	5	// ─── Encode side ─────────────────────────────────────────────────	COMMENT
MEDIUM	…h/src/commands/js-exec/js-exec.buffer-encoding.test.ts	89	// ─── Decode side ─────────────────────────────────────────────────	COMMENT
MEDIUM	…h/src/commands/js-exec/js-exec.buffer-encoding.test.ts	184	// ─── Cross-API ───────────────────────────────────────────────────	COMMENT
MEDIUM	…h/src/commands/js-exec/js-exec.buffer-encoding.test.ts	234	// ─── Unknown encoding ─────────────────────────────────────────────	COMMENT
MEDIUM	…h/src/commands/js-exec/js-exec.buffer-encoding.test.ts	254	// ─── Aliases ─────────────────────────────────────────────────────	COMMENT
MEDIUM	…h/src/commands/js-exec/js-exec.buffer-encoding.test.ts	283	// ─── Node-compat edge cases ──────────────────────────────────────	COMMENT
MEDIUM	…ges/just-bash/src/transform/plugins/tee-plugin.test.ts	417	// ── Complex scripts ──────────────────────────────────────────────────	COMMENT
MEDIUM	packages/just-bash-executor/src/node-esm-smoke.test.ts	53	// ── 1. Each upstream plugin loads + instantiates in plain Node ESM ─────────	COMMENT
MEDIUM	packages/just-bash-executor/src/node-esm-smoke.test.ts	81	// ── 2. @just-bash/executor's plugin-loader path works for each kind ─────────	COMMENT
MEDIUM	packages/just-bash-executor/src/node-esm-smoke.test.ts	167	// ── 3. Inline tools path doesn't need any plugin at all ─────────────────────	COMMENT
MEDIUM	packages/just-bash-executor/src/tool-command.ts	21	// ── Naming ──────────────────────────────────────────────────────	COMMENT
MEDIUM	packages/just-bash-executor/src/tool-command.ts	34	// ── Arg Parsing ─────────────────────────────────────────────────	COMMENT
MEDIUM	packages/just-bash-executor/src/tool-command.ts	172	// ── Help Formatting ─────────────────────────────────────────────	COMMENT
MEDIUM	packages/just-bash-executor/src/tool-command.ts	252	// ── Command Factory ─────────────────────────────────────────────	COMMENT
MEDIUM	packages/just-bash-executor/src/tool-command.ts	341	// ── Grouping Helpers ────────────────────────────────────────────	COMMENT
MEDIUM	packages/just-bash-executor/src/tool-command.test.ts	21	// ── camelToKebab ────────────────────────────────────────────────	COMMENT
MEDIUM	packages/just-bash-executor/src/tool-command.test.ts	45	// ── parseToolCliArgs ────────────────────────────────────────────	COMMENT
MEDIUM	packages/just-bash-executor/src/tool-command.test.ts	167	// ── Integration: Bash with tool commands ────────────────────────	COMMENT
MEDIUM	…kages/just-bash-executor/src/executor-examples.test.ts	15	// ── Network isolation ──────────────────────────────────────────	COMMENT
MEDIUM	…kages/just-bash-executor/src/executor-examples.test.ts	74	// ── Custom discovery plugin tests ───────────────────────────────	COMMENT
MEDIUM	…kages/just-bash-executor/src/executor-examples.test.ts	237	// ── Tool approval tests ─────────────────────────────────────────	COMMENT
MEDIUM	…kages/just-bash-executor/src/executor-examples.test.ts	372	// ── GraphQL plugin: offline introspection → tool discovery ──────	COMMENT
MEDIUM	…kages/just-bash-executor/src/executor-examples.test.ts	499	// ── OpenAPI plugin: static spec → tool discovery ────────────────	COMMENT

Hyper-Verbose Identifiers126 hits · 126 pts

Severity	File	Line	Snippet	Context
LOW	packages/just-bash/src/readme.test.ts	127	function renameDuplicateDeclarations(code: string): string {	CODE
LOW	packages/just-bash/src/fatal-execution-error.ts	11	export function rethrowFatalExecutionError(error: unknown): void {	CODE
LOW	packages/just-bash/src/execution-scope.ts	460	export function createCommandExecutionBudget(	CODE
LOW	packages/just-bash/src/interpreter/type-command.ts	360	function serializeFunctionWordPart(part: WordPart): string {	CODE
LOW	packages/just-bash/src/interpreter/redirections.ts	62	async function checkOutputRedirectTarget(	CODE
LOW	packages/just-bash/src/interpreter/redirections.ts	366	async function prepareRedirectionsWithState(	CODE
LOW	packages/just-bash/src/interpreter/redirections.ts	1087	export function createRedirectionTransaction(	CODE
LOW	packages/just-bash/src/interpreter/expansion.ts	475	async function expandWordWithBracesAsync(	CODE
LOW	packages/just-bash/src/interpreter/builtin-dispatch.ts	110	function createRevocableCommandContext(	CODE
LOW	…-bash/src/interpreter/defense-aware-command-context.ts	208	export function createDefenseAwareCommandContext(	CODE
LOW	…ages/just-bash/src/interpreter/assignment-expansion.ts	23	export async function expandLocalArrayAssignment(	CODE
LOW	…ages/just-bash/src/interpreter/assignment-expansion.ts	268	export async function expandScalarAssignmentArg(	CODE
LOW	…ust-bash/src/interpreter/simple-command-assignments.ts	349	async function processAssociativeArrayAssignment(	CODE
LOW	…ust-bash/src/interpreter/simple-command-assignments.ts	443	async function processIndexedArrayWithKeysAssignment(	CODE
LOW	…ust-bash/src/interpreter/simple-command-assignments.ts	558	async function processSimpleArrayAssignment(	CODE
LOW	…ust-bash/src/interpreter/simple-command-assignments.ts	611	async function processSubscriptAssignment(	CODE
LOW	…ages/just-bash/src/interpreter/process-substitution.ts	401	export async function releaseProcessSubstitutions(	CODE
LOW	packages/just-bash/src/interpreter/arithmetic.ts	39	function createArithmeticResolutionContext(): ArithmeticResolutionContext {	CODE
LOW	packages/just-bash/src/interpreter/arithmetic.ts	221	async function evaluateResolvedArithValue(	CODE
LOW	packages/just-bash/src/interpreter/arithmetic.ts	414	async function evaluateArithmeticInternal(	CODE
LOW	packages/just-bash/src/interpreter/arithmetic.ts	931	async function evalConcatPartToStringAsync(	CODE
LOW	packages/just-bash/src/interpreter/builtins/set.ts	278	function formatOptionsResetCommands(ctx: InterpreterContext): string {	CODE
LOW	…t-bash/src/interpreter/builtins/variable-assignment.ts	226	export function clearLocalVarStackForScope(	CODE
LOW	…bash/src/interpreter/expansion/arith-text-expansion.ts	16	export async function expandDollarVarsInArithText(	CODE
LOW	…bash/src/interpreter/expansion/arith-text-expansion.ts	132	export async function expandSubscriptForAssocArray(	CODE
LOW	…t-bash/src/interpreter/expansion/indirect-expansion.ts	61	export async function handleIndirectArrayExpansion(	CODE
LOW	…t-bash/src/interpreter/expansion/indirect-expansion.ts	227	async function handleIndirectArraySlicing(	CODE
LOW	…t-bash/src/interpreter/expansion/indirect-expansion.ts	287	async function handleIndirectArrayDefaultAlternative(	CODE
LOW	…t-bash/src/interpreter/expansion/indirect-expansion.ts	371	export async function handleIndirectInAlternative(	CODE
LOW	…t-bash/src/interpreter/expansion/indirect-expansion.ts	464	export async function handleIndirectionWithInnerAlternative(	CODE
LOW	…bash/src/interpreter/expansion/array-word-expansion.ts	44	export function handleSimpleArrayExpansion(	CODE
LOW	…bash/src/interpreter/expansion/array-word-expansion.ts	107	export function handleNamerefArrayExpansion(	CODE
LOW	…st-bash/src/interpreter/expansion/pattern-expansion.ts	19	export function patternHasCommandSubstitution(pattern: string): boolean {	CODE
LOW	…st-bash/src/interpreter/expansion/pattern-expansion.ts	54	function findCommandSubstitutionEnd(pattern: string, startIdx: number): number {	CODE
LOW	…st-bash/src/interpreter/expansion/pattern-expansion.ts	105	async function executeCommandSubstitutionFromString(	CODE
LOW	…st-bash/src/interpreter/expansion/pattern-expansion.ts	263	function expandVariablesInDoubleQuotedPattern(	CODE
LOW	…st-bash/src/interpreter/expansion/pattern-expansion.ts	327	export async function expandVariablesInPatternAsync(	CODE
LOW	…st-bash/src/interpreter/expansion/pattern-expansion.ts	457	async function expandVariablesInDoubleQuotedPatternAsync(	CODE
LOW	…s/just-bash/src/interpreter/expansion/parameter-ops.ts	109	export function assertDefaultAssignmentTarget(parameter: string): void {	CODE
LOW	…-bash/src/interpreter/expansion/word-glob-expansion.ts	218	async function handleBraceExpansionResults(	CODE
LOW	…-bash/src/interpreter/expansion/word-glob-expansion.ts	250	async function handleArrayExpansionCases(	CODE
LOW	…-bash/src/interpreter/expansion/word-glob-expansion.ts	408	function handleVarNamePrefixExpansion(	CODE
LOW	…-bash/src/interpreter/expansion/word-glob-expansion.ts	458	async function handlePositionalExpansionCases(	CODE
LOW	…-bash/src/interpreter/expansion/word-glob-expansion.ts	520	async function handleUnquotedExpansionCases(	CODE
LOW	…-bash/src/interpreter/expansion/word-glob-expansion.ts	639	function findWordProducingExpansion(	CODE
LOW	…-bash/src/interpreter/expansion/word-glob-expansion.ts	678	async function expandDoubleQuotedWithWordProducing(	CODE
LOW	…st-bash/src/interpreter/expansion/array-pattern-ops.ts	66	export async function handleArrayPatternReplacement(	CODE
LOW	…st-bash/src/interpreter/expansion/array-pattern-ops.ts	168	export async function handleArrayPatternRemoval(	CODE
LOW	…ckages/just-bash/src/interpreter/expansion/variable.ts	39	function normalizeAssociativeSubscript(	CODE
LOW	…-bash/src/interpreter/expansion/pattern-replacement.ts	7	export function applyPatternReplacementBounded(	CODE
LOW	…ages/just-bash/src/interpreter/expansion/word-split.ts	116	async function hasMixedQuotedDefaultValue(	CODE
LOW	…ages/just-bash/src/interpreter/expansion/word-split.ts	488	async function smartWordSplitWithUnquotedLiterals(	CODE
LOW	…ckages/just-bash/src/interpreter/expansion/analysis.ts	71	export function isOperationWordEntirelyQuoted(	CODE
LOW	…-bash/src/interpreter/expansion/array-prefix-suffix.ts	214	export async function handleArrayPatternWithPrefixSuffix(	CODE
LOW	…-bash/src/interpreter/expansion/array-prefix-suffix.ts	396	export async function handleArrayWithPrefixSuffix(	CODE
LOW	packages/just-bash/src/interpreter/expansion/tilde.ts	58	export function applyAssignmentTildeExpansion(	CODE
LOW	…t-bash/src/interpreter/expansion/unquoted-expansion.ts	189	export async function handleUnquotedArrayPatternReplacement(	CODE
LOW	…t-bash/src/interpreter/expansion/unquoted-expansion.ts	372	export async function handleUnquotedArrayPatternRemoval(	CODE
LOW	…t-bash/src/interpreter/expansion/unquoted-expansion.ts	511	export async function handleUnquotedPositionalPatternRemoval(	CODE
LOW	…t-bash/src/interpreter/expansion/unquoted-expansion.ts	650	export async function handleUnquotedPositionalSlicing(	CODE
66 more matches not shown…

Verbosity Indicators17 hits · 37 pts

Severity	File	Line	Snippet	Context
LOW⚡	packages/just-bash/src/interpreter/assoc-array.test.ts	236	// Step 0: Check declare -p output	COMMENT
LOW⚡	packages/just-bash/src/interpreter/assoc-array.test.ts	244	// Step 1: Single quoted assignment & lookup	COMMENT
LOW	packages/just-bash/src/parser/expansion-parser.ts	662	// We need to check if this is arithmetic (closes with )) or command sub (closes with ) ))	COMMENT
LOW⚡	…ust-bash/src/agent-examples/debugging-workflow.test.ts	58	// Step 1: Validate order	COMMENT
LOW⚡	…ust-bash/src/agent-examples/debugging-workflow.test.ts	61	// Step 2: Check inventory	COMMENT
LOW⚡	…ust-bash/src/agent-examples/debugging-workflow.test.ts	64	// Step 3: Process payment	COMMENT
LOW⚡	…ust-bash/src/agent-examples/debugging-workflow.test.ts	67	// Step 4: Confirm order	COMMENT
LOW⚡	…ust-bash/src/agent-examples/debugging-workflow.test.ts	70	// Step 5: Send notification	COMMENT
LOW	packages/just-bash/src/commands/find/matcher.ts	628	// For expressions with stat-dependent parts, we need to check if the	COMMENT
LOW⚡	packages/just-bash/src/commands/tar/bzip2-compress.ts	461	// Step 1: RLE1 encoding	COMMENT
LOW⚡	packages/just-bash/src/commands/tar/bzip2-compress.ts	464	// Step 2: BWT	COMMENT
LOW⚡	packages/just-bash/src/commands/tar/bzip2-compress.ts	470	// Step 3: Determine symbols in use	COMMENT
LOW⚡	packages/just-bash/src/commands/tar/bzip2-compress.ts	504	// Step 4: MTF	COMMENT
LOW⚡	packages/just-bash/src/commands/tar/bzip2-compress.ts	510	// Step 5: RLE2	COMMENT
LOW⚡	packages/just-bash/src/commands/tar/bzip2-compress.ts	520	// Step 6: Build Huffman table(s)	COMMENT
LOW⚡	…sh/src/fs/read-write-fs/read-write-fs.security.test.ts	1163	// Step 2: Try to mv the directory (should be blocked by Fix 2)	COMMENT
LOW⚡	…sh/src/fs/read-write-fs/read-write-fs.security.test.ts	1170	// Step 3: Even if mv somehow succeeded, writing through the symlink	COMMENT

Structural Annotation Overuse15 hits · 34 pts

Severity	File	Line	Snippet	Context
LOW⚡	packages/just-bash/src/interpreter/assoc-array.test.ts	236	// Step 0: Check declare -p output	COMMENT
LOW⚡	packages/just-bash/src/interpreter/assoc-array.test.ts	244	// Step 1: Single quoted assignment & lookup	COMMENT
LOW⚡	…ust-bash/src/agent-examples/debugging-workflow.test.ts	58	// Step 1: Validate order	COMMENT
LOW⚡	…ust-bash/src/agent-examples/debugging-workflow.test.ts	61	// Step 2: Check inventory	COMMENT
LOW⚡	…ust-bash/src/agent-examples/debugging-workflow.test.ts	64	// Step 3: Process payment	COMMENT
LOW⚡	…ust-bash/src/agent-examples/debugging-workflow.test.ts	67	// Step 4: Confirm order	COMMENT
LOW⚡	…ust-bash/src/agent-examples/debugging-workflow.test.ts	70	// Step 5: Send notification	COMMENT
LOW⚡	packages/just-bash/src/commands/tar/bzip2-compress.ts	461	// Step 1: RLE1 encoding	COMMENT
LOW⚡	packages/just-bash/src/commands/tar/bzip2-compress.ts	464	// Step 2: BWT	COMMENT
LOW⚡	packages/just-bash/src/commands/tar/bzip2-compress.ts	470	// Step 3: Determine symbols in use	COMMENT
LOW⚡	packages/just-bash/src/commands/tar/bzip2-compress.ts	504	// Step 4: MTF	COMMENT
LOW⚡	packages/just-bash/src/commands/tar/bzip2-compress.ts	510	// Step 5: RLE2	COMMENT
LOW⚡	packages/just-bash/src/commands/tar/bzip2-compress.ts	520	// Step 6: Build Huffman table(s)	COMMENT
LOW⚡	…sh/src/fs/read-write-fs/read-write-fs.security.test.ts	1163	// Step 2: Try to mv the directory (should be blocked by Fix 2)	COMMENT
LOW⚡	…sh/src/fs/read-write-fs/read-write-fs.security.test.ts	1170	// Step 3: Even if mv somehow succeeded, writing through the symlink	COMMENT

Magic Placeholder Names5 hits · 25 pts

Severity	File	Line	Snippet	Context
HIGH	…/just-bash/src/agent-examples/python-scripting.test.ts	421	API_KEY=your-api-key-here	CODE
HIGH	…s/just-bash/src/agent-examples/config-analysis.test.ts	43	API_KEY=your-api-key-here	CODE
HIGH	…s/just-bash/src/agent-examples/config-analysis.test.ts	145	API_KEY=your-api-key-here	CODE
HIGH	…s/just-bash/src/agent-examples/config-analysis.test.ts	206	your-api-key-here	CODE
HIGH	…s/just-bash/src/agent-examples/config-analysis.test.ts	228	API_KEY: your-api-key-here	CODE

Fake / Example Data14 hits · 18 pts

Severity	File	Line	Snippet	Context
LOW⚡	examples/custom-command/commands.ts	94	* Generate lorem ipsum text	COMMENT
LOW⚡	examples/custom-command/commands.ts	100	"Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor incididunt ut labore et dolore magna	CODE
LOW⚡	examples/custom-command/commands.ts	100	"Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor incididunt ut labore et dolore magna	CODE
LOW⚡	examples/custom-command/main.ts	51	// Lorem ipsum	COMMENT
LOW⚡	examples/custom-command/main.ts	52	console.log("4. Generate lorem ipsum (2 paragraphs):");	CODE
LOW⚡	examples/custom-command/main.ts	57	console.log("5. Count words in lorem ipsum:");	CODE
LOW	examples/custom-command/README.md	9	- lorem - Generate lorem ipsum text (`lorem 3` for 3 paragraphs)	CODE
LOW	…/just-bash/src/agent-examples/python-scripting.test.ts	230	expect(output[0].name).toBe("John Doe");	CODE
LOW	…t-bash/src/agent-examples/refactoring-workflow.test.ts	66	expect(formatUserName('John', 'Doe')).toBe('John Doe');	CODE
LOW	…t-bash/src/agent-examples/refactoring-workflow.test.ts	95	/project/src/tests/string.test.ts: expect(formatUserName('John', 'Doe')).toBe('John Doe');	CODE
LOW	…t-bash/src/agent-examples/refactoring-workflow.test.ts	216	/project/src/tests/string.test.ts: expect(formatUserName('John', 'Doe')).toBe('John Doe');	CODE
LOW	…ust-bash/src/commands/sqlite3/sqlite3.fixtures.test.ts	195	"sqlite3 -readonly users.db \"INSERT INTO users (name, email, age) VALUES ('Test', 'test@test.com', 99)\"",	CODE
LOW	…ust-bash/src/commands/sqlite3/sqlite3.fixtures.test.ts	215	"sqlite3 users.db \"INSERT INTO users (name, email, age) VALUES ('Test', 'test@test.com', 99)\"",	CODE
LOW	…ust-bash/src/commands/sqlite3/sqlite3.fixtures.test.ts	220	"sqlite3 users.db \"SELECT name FROM users WHERE email = 'test@test.com'\"",	CODE

TODO Padding9 hits · 11 pts

Severity	File	Line	Snippet	Context
LOW	packages/just-bash/src/readme.test.ts	515	"/src/app.ts": "// TODO: implement\nexport const x = 1;",	CODE
LOW	…s/just-bash/src/spec-tests/bash/cases/dbracket.test.sh	133	# TODO: Add tests for this	COMMENT
LOW	…h/src/agent-examples/text-processing-workflows.test.ts	19	// TODO: Add error handling	COMMENT
LOW	…kages/just-bash/src/agent-examples/code-review.test.ts	17	// TODO: Add error handling	COMMENT
LOW	…kages/just-bash/src/agent-examples/code-review.test.ts	22	"/project/src/user.ts": `// TODO: Add validation	CODE
LOW	…kages/just-bash/src/agent-examples/code-review.test.ts	66	).toBe(`/project/src/index.ts:// TODO: Add error handling	CODE
LOW	…kages/just-bash/src/agent-examples/code-review.test.ts	67	/project/src/user.ts:// TODO: Add validation	CODE
LOW	…kages/just-bash/src/agent-examples/code-review.test.ts	87	// TODO: Add error handling	COMMENT
LOW	…ages/just-bash/src/commands/grep/grep.advanced.test.ts	473	"/src/b.js": "// Regular comment\n// TODO: implement\n",	CODE

Excessive Try-Catch Wrapping9 hits · 11 pts

Severity	File	Line	Snippet	Context
LOW⚡	…urity/attacks/exploit-fixtures/python-worker-escape.sh	10	except Exception:	CODE
LOW⚡	…urity/attacks/exploit-fixtures/python-worker-escape.sh	16	except Exception:	CODE
LOW⚡	…urity/attacks/exploit-fixtures/python-worker-escape.sh	25	except Exception:	CODE
LOW⚡	…urity/attacks/exploit-fixtures/python-worker-escape.sh	31	except Exception:	CODE
LOW⚡	…es/just-bash/src/commands/python3/python3.http.test.ts	184	except Exception as e:	CODE
LOW⚡	…es/just-bash/src/commands/python3/python3.http.test.ts	202	except Exception as e:	CODE
LOW⚡	…es/just-bash/src/commands/python3/python3.http.test.ts	223	except Exception as e:	CODE
LOW⚡	…ust-bash/src/commands/python3/python3.security.test.ts	302	except Exception as e:	CODE
LOW	packages/just-bash/src/commands/python3/worker.ts	1444	except Exception as e:	CODE

Self-Referential Comments3 hits · 9 pts

Severity	File	Line	Snippet	Context
MEDIUM	…ust-bash/src/security/limits/memory-exhaustion.test.ts	291	# Create a moderate sized array	COMMENT
MEDIUM	…bash/src/spec-tests/bash/cases/builtin-process.test.sh	18	# Create the helper script inline - it uses exec to redirect stdin from here-doc	COMMENT
MEDIUM	…kages/just-bash/src/spec-tests/bash/cases/loop.test.sh	370	# Create the test data files inline	COMMENT

AI Slop Vocabulary3 hits · 9 pts

Severity	File	Line	Snippet	Context
MEDIUM	…st-bash/src/spec-tests/bash/cases/builtin-dirs.test.sh	174	# Can't use the OSH test harness for this because	COMMENT
MEDIUM	…s/just-bash/src/spec-tests/bash/cases/comments.test.sh	3	# NOTE: The test harness isn't good for this test; it strips lines that start	COMMENT
MEDIUM	…ash/src/spec-tests/bash/cases/spec-harness-bug.test.sh	3	#### osh-native duplicates stdin - is this a test harness issue?	COMMENT

Redundant / Tautological Comments5 hits · 8 pts

Severity	File	Line	Snippet	Context
LOW	…st-bash/src/spec-tests/bash/cases/builtin-kill.test.sh	118	# Check if at least the HUP flag is reported. The output format of all shells	COMMENT
LOW	…s/just-bash/src/spec-tests/bash/cases/redirect.test.sh	153	#### Open file on descriptor 3 and write to it many times	COMMENT
LOW	…s/just-bash/src/spec-tests/bash/cases/redirect.test.sh	167	#### Open file on descriptor 4 and write to it many times	COMMENT
LOW	…ges/just-bash/src/spec-tests/bash/cases/append.test.sh	11	#### Append array to array	COMMENT
LOW	packages/just-bash/src/commands/python3/worker.ts	994	# Set cwd to host mount	COMMENT

vercel-labs/just-bash

Open-Source Code Quality, Security and Technical Debt Review