0.8

Adjusted Signal

0.8

Raw Pattern Score

100%

Time Factor

2026-11-01

Last Push

15.6K

Stars

TypeScript

Language

582.2K

Lines of Code

2.4K

Files

408

Pattern Hits

2026-10-31

Scan Date

0.00

HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 2.6/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 299 finding(s).

Hallucinated Dependency & Supply Chain Risk 1.2/100 · LOW

Are imports declared and package/API names verified? 105 finding(s).

Agent Over-Engineering Ratio 2.5/100 · LOW

Are wrappers, guards, and repeated structures necessary? 286 finding(s).

PR Review Velocity Impact 3.8/100 · LOW

Which changes need focused human review? 408 finding(s).

What These Metrics Mean

Adjusted Signal: Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score: Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor: A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits: Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate: High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files: Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 0HIGH 6MEDIUM 7LOW 395

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 408 distinct pattern matches across 11 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Hyper-Verbose Identifiers282 hits · 282 pts

Severity	File	Line	Snippet	Context
LOW	test/delivery-store-contract.ts	293	export async function exerciseDeliveryExpiryRevive(	CODE
LOW	test/deploy-restore.test.ts	38	function persistenceFailureHarness(failMethod: "setVersionImage" \| "setEndpoint" \| "setStatus" \| "setAppliedVersion") {	CODE
LOW	test/skill-packs-routes.test.ts	76	function makeRepoWithLayerCollision(): { dir: string; sha: string } {	CODE
LOW	test/pi-opus-55.test.ts	71	async function assertMandatoryThinkingWire(t: TestContext, modelId: string): Promise<void> {	CODE
LOW	test/live-slack/scenarios-sandbox-providers.ts	118	export function selectSandboxProviderScenarios(value: string \| undefined): Scenario[] {	CODE
LOW	test/support/fake-managed-agents-service.ts	59	export async function startFakeManagedAgentsService(): Promise<FakeManagedAgentsService> {	CODE
LOW	test/support/participant-session-parity.ts	17	export async function assertParticipantSessionParity(store: SessionStore, prefix: string): Promise<void> {	CODE
LOW	test/support/file-document-listing.ts	93	export async function assertSharedRecordIdentity(store: FileArtifactStore): Promise<void> {	CODE
LOW	test/support/directory-observation-cases.ts	4	export async function directoryObservationCases(store: DirectoryStore): Promise<void> {	CODE
LOW	test/support/snapshot-stores.ts	10	export function instrumentedSnapshotStore(): InstrumentedSnapshotStore {	CODE
LOW	plugins/portal/src/index.ts	608	export function connectWrongRecipientHtml(o: { provider: string; alreadyConnected: boolean }): string {	CODE
LOW	plugins/portal/src/index.ts	794	function isDeploymentLayerPassthrough(method: string, pathname: string): boolean {	CODE
LOW	plugins/web-ui/src/pane-focus.ts	27	export function replaceChildrenPreservingFocus(container: HTMLElement, host: HTMLElement): void {	CODE
LOW	plugins/web-ui/src/deploy-permissions.ts	22	export async function openDeploymentPermissions(id: string, title: string, owner: string): Promise<void> {	CODE
LOW	plugins/web-ui/src/contexts.ts	557	async function unlinkProjectSlackChannel(context: CoreContext): Promise<void> {	CODE
LOW	plugins/web-ui/src/inbox-coalesce.ts	6	export function createInboxEventCoalescer(	CODE
LOW	plugins/web-ui/src/session-list.ts	307	export function shouldStartProactiveOpener(state: {	CODE
LOW	plugins/web-ui/src/deploy-notices.ts	10	export function withDeploymentDetailNotice(notices: DeploymentNotices, id: string, text: string): DeploymentNotices {	CODE
LOW	plugins/web-ui/src/deploy-notices.ts	14	export function withoutDeploymentDetailNotice(notices: DeploymentNotices): DeploymentNotices {	CODE
LOW	plugins/web-ui/src/split.ts	499	export function restoredCanvasNeedsSessionList(): boolean {	CODE
LOW	plugins/web-ui/src/chat.ts	524	function preserveOutgoingWorkingDot(nextThreadRef: string \| null): void {	CODE
LOW	plugins/web-ui/src/chat.ts	666	function startProactiveOpenerIfNew(	CODE
LOW	plugins/web-ui/src/chat.ts	898	function attachApprovalsWhenLoaded(	CODE
LOW	plugins/web-ui/src/chat.ts	921	function refreshTranscriptFromEntries(agent: Agent): Promise<void> {	CODE
LOW	plugins/web-ui/src/chat.ts	927	async function transcriptRefreshesSettled(): Promise<void> {	CODE
LOW	plugins/web-ui/src/chat.ts	992	async function replaceTranscriptFromEntries(agent: Agent): Promise<void> {	CODE
LOW	plugins/web-ui/src/chat.ts	1144	function adoptActiveSessionFromList(agent: Agent): void {	CODE
LOW	plugins/web-ui/src/chat.ts	2500	function consumeBackgroundPanelRequest(): void {	CODE
LOW	plugins/web-ui/src/deploy-view.ts	40	export function deploymentListRefreshCanRedraw(activeId?: string): boolean {	CODE
LOW	plugins/web-ui/src/deploy-view.ts	56	export function deploymentArchiveUndoAvailable(toastDeployment: DeploymentView): boolean {	CODE
LOW	plugins/web-ui/src/deploy-view.ts	68	export function deploymentListAfterRestoreRefresh(	CODE
LOW	plugins/web-ui/src/deploy-view.ts	96	export function deploymentTabEmptyMessage(tab: DeploymentTab): string {	CODE
LOW	plugins/web-ui/src/shell.ts	1001	function updateSidebarToggleLabels(): void {	CODE
LOW	plugins/web-ui/src/shell.ts	1010	export function replacePanePreservingFocus(host: HTMLElement): void {	CODE
LOW	plugins/web-ui/src/skill-edit-review.ts	31	export function shouldBlockRepeatedPublishClick(reviewed: boolean, clickCount: number): boolean {	CODE
LOW	plugins/web-ui/src/core-bridge.ts	1869	function deliveredFilesFromAttachments(	CODE
LOW	plugins/web-ui/src/sessions.ts	1544	export function closeSessionSelectionColor(): boolean {	CODE
LOW	plugins/web-ui/src/sessions.ts	2076	async function reconcileCachedTranscript(	CODE
LOW	plugins/web-ui/src/streaming-markdown.ts	90	function firstSafeBoundaryAtOrAfter(text: string, min: number): number {	CODE
LOW	plugins/chassis/src/redact-secrets.ts	20	function redactStructuredDiagnosticsValue(value: unknown, sensitive = false): unknown {	CODE
LOW	plugins/chassis/src/redact-secrets.ts	29	function redactStructuredDiagnostics(value: string): string {	CODE
LOW	skills-seed/email-voice-profile/scripts/fetch_sent.py	109	def strip_quotes_and_signature(text: str) -> str:	CODE
LOW	cli/src/background-work.ts	56	export function parseBackgroundWorkStatus(body: string, deploymentId: string): BackgroundWorkStatus {	CODE
LOW	cli/src/secrets.ts	785	function requiresOtherEmailTransport(config: QmConfig, condition: SecretCondition): boolean {	CODE
LOW	cli/src/live-session.ts	15	export async function checkControlledLiveSession(options: {	CODE
LOW	cli/src/terraform.ts	89	function assertSafeAssumeRoleTransition(config: QmConfig, existing: string): void {	CODE
LOW	cli/src/terraform.ts	278	export function assertTerraformScaffoldSupportsConfig(config: QmConfig, configDir: string): void {	CODE
LOW	cli/src/deployment-layer.ts	198	export function httpDeploymentLayerTransport(	CODE
LOW	cli/src/deployment-layer.ts	260	export async function currentDeploymentLayerState(opts: {	CODE
LOW	cli/src/backends/fly.ts	221	function appendGithubTimingSummary(rows: DeployTiming[]): void {	CODE
LOW⚡	cli/src/backends/fly.ts	1086	function unsetDisabledSecurityScreenToken(config: QmConfig, appPrefix: string): void {	CODE
LOW⚡	cli/src/backends/fly.ts	1094	function unsetDisabledFlyPublisherToken(config: QmConfig, appPrefix: string): void {	CODE
LOW⚡	cli/src/backends/fly.ts	1102	function unsetCorelessPluginCoreSecrets(plugins: ResolvedPlugin[], appPrefix: string): string[] {	CODE
LOW	cli/src/backends/aws.ts	590	function expectedWorkloadImageRepository(config: QmConfig, workload: string): string {	CODE
LOW	cli/src/backends/aws.ts	1314	function clearBackgroundPreparation(aws: AwsConfig): void {	CODE
LOW	cli/src/backends/aws.ts	1330	function assertBackgroundPreparationResolved(	CODE
LOW	cli/src/backends/aws.ts	1372	function reconcileBackgroundPreparation(	CODE
LOW	cli/src/backends/aws.ts	1380	function prepareBackgroundDeployment(aws: AwsConfig, preparation: BackgroundDeploymentPreparation): void {	CODE
LOW	cli/src/backends/aws.ts	1660	function currentDeploymentManifest(aws: AwsConfig): DeploymentManifest \| undefined {	CODE
LOW	cli/src/backends/aws.ts	1664	function deploymentManifestAtPointer(aws: AwsConfig, key: string): DeploymentManifest \| undefined {	CODE
222 more matches not shown…

Fake / Example Data100 hits · 114 pts

Severity	File	Line	Snippet	Context
LOW	test/auth-broker-claim.test.ts	148	return value === token ? { email: "user@example.com", authTime: 1, expiresAtMs: Date.now() + 60000 } : null;	CODE
LOW⚡	test/auth-broker-claim.test.ts	176	assert.equal((await post("", { email: "user@example.com", idleS: 30, absoluteS: 90 })).status, 200);	CODE
LOW⚡	test/auth-broker-claim.test.ts	178	assert.equal((await post("", { email: "user@example.com", idleS: 30, absoluteS: 90 }, undefined, false)).status, 401);	CODE
LOW⚡	test/auth-broker-claim.test.ts	179	assert.equal((await post("", { email: "user@example.com", idleS: 91, absoluteS: 90 })).status, 400);	CODE
LOW⚡	test/auth-broker-claim.test.ts	180	assert.equal((await post("/revoke", { email: "user@example.com" })).status, 401);	CODE
LOW⚡	test/auth-broker-claim.test.ts	181	assert.notEqual((await post("/revoke", { email: "other@example.com" }, "user@example.com")).status, 200);	CODE
LOW⚡	test/auth-broker-claim.test.ts	182	assert.equal((await post("/revoke", { email: "user@example.com" }, "user@example.com")).status, 200);	CODE
LOW⚡	test/auth-broker-claim.test.ts	183	assert.deepEqual(revoked, ["user@example.com"]);	CODE
LOW	test/admin-login-token.test.ts	19	assert.equal(claims.email, "admin@example.com");	CODE
LOW	test/helm-chart.test.ts	227	const explicit = { OIDC_ALLOWED_EMAILS: "other@example.org", OIDC_ALLOWED_EMAIL_DOMAIN: "example.org" };	CODE
LOW	test/app-page-views.test.ts	154	await get(h.port, "/", { Accept: "text/html", Cookie: session("guest@example.org", true) });	CODE
LOW	test/app-page-views.test.ts	161	["guest@example.org", "app_only"],	CODE
LOW	test/admin-users.test.ts	268	{ principalId: "jane@example.com", displayName: "Jane Doe", type: "internal" },	CODE
LOW	test/egress-policy.test.ts	29	assert.equal(hostMatches("api.example.com", "user@example.com"), true);	CODE
LOW⚡	test/admin-resources.test.ts	173	body: JSON.stringify({ accent: "#6366f1", mark: "Q", selfLabel: "{{qm}}", orgName: "Acme Corp" }),	CODE
LOW⚡	test/admin-resources.test.ts	182	assert.equal(readBack.branding?.orgName, "Acme Corp");	CODE
LOW⚡	test/admin-resources.test.ts	183	assert.deepEqual(await surfaceBranding(), { orgName: "Acme Corp", accent: "#6366f1", mark: "Q", selfLabel: "qm" });	CODE
LOW	test/custom-providers.test.ts	112	await store.upsert(GATEWAY, "sk-secret-123", "admin@example.com");	CODE
LOW⚡	test/custom-providers.test.ts	126	await store.upsert({ ...GATEWAY, name: "Renamed" }, undefined, "admin@example.com");	CODE
LOW⚡	test/custom-providers.test.ts	129	assert.equal(await store.delete("acme-gateway", "admin@example.com"), true);	CODE
LOW⚡	test/custom-providers.test.ts	133	assert.equal(await store.delete("never-existed", "admin@example.com"), false);	CODE
LOW	test/custom-providers.test.ts	214	await store.upsert(spec, "local", "admin@example.com");	CODE
LOW	test/branding.test.ts	11	orgName: "Acme Corp",	CODE
LOW	test/branding.test.ts	62	assert.deepEqual(await resolveBranding(config, ORG), { selfLabel: "legacy", orgName: "Acme Corp" });	CODE
LOW	test/config.test.ts	55	assert.deepEqual(loadConfig({ ORG_BRAND_ORG_NAME: "Acme Corp" }).brandingDefault, { orgName: "Acme Corp" });	CODE
LOW	test/admin-links.test.ts	15	adminCronHistoryUrl("https://portal.test", "personal:alice@example.org", "c1"),	CODE
LOW	test/admin-links.test.ts	22	adminCronHistoryUrl("https://portal.test", "personal:a/b@example.org", "c1"),	CODE
LOW⚡	test/slack-allow-from.test.ts	23	assert.equal(gate({ externalId: "josh@example.org", isExternalGuest: false }), true);	CODE
LOW⚡	test/slack-allow-from.test.ts	24	assert.equal(gate({ externalId: "Josh@example.org", isExternalGuest: false }), true);	CODE
LOW⚡	test/slack-allow-from.test.ts	28	assert.equal(gate({ externalId: "josh@example.org", isExternalGuest: true }), false);	CODE
LOW	plugins/portal/test/broker-proxy.test.ts	240	{ k: "session", sub: "user@example.com", org: "acme", iat: now, exp: now + 60000 },	CODE
LOW	plugins/portal/test/entry.test.ts	84	{ OIDC_ALLOWED_EMAILS: "admin@example.com" },	CODE
LOW	plugins/portal/test/entry.test.ts	112	OIDC_ALLOWED_EMAILS: "admin@example.com",	CODE
LOW	plugins/portal/test/entry.test.ts	143	OIDC_ALLOWED_EMAILS: "admin@example.com",	CODE
LOW	plugins/portal/test/entry.test.ts	179	OIDC_ALLOWED_EMAILS: "admin@example.com",	CODE
LOW⚡	plugins/portal/test/oidc.test.ts	252	userinfo: { email: "admin@example.com", email_verified: true },	CODE
LOW⚡	plugins/portal/test/oidc.test.ts	254	{ sub: "admin@example.com" },	CODE
LOW⚡	plugins/portal/test/oidc.test.ts	263	const rule = { claim: "email" as const, allowedEmailDomain: "example.com", allowedEmails: ["admin@example.com"] };	CODE
LOW	plugins/portal/test/oidc.test.ts	275	assert.deepEqual(await resolvePrincipal(rule, verified("Admin@Example.com"), invited), { sub: "admin@example.com" });	CODE
LOW	plugins/portal/test/oidc.test.ts	291	{ claim: "email", allowedEmails: ["admin@example.com"] },	CODE
LOW	plugins/auth/README.md	168	`POST /v1/auth/broker/sessions/revoke` accepts `{ "email": "user@example.com" }`	CODE
LOW	plugins/auth/test/smtp.test.ts	110	to: "admin@example.com",	CODE
LOW	plugins/auth/test/email.test.ts	33	to: "admin@example.com",	CODE
LOW	plugins/auth/test/email.test.ts	46	to: "admin@example.com",	CODE
LOW	plugins/auth/test/email.test.ts	65	assert.equal(await ok.send({ to: "admin@example.com", subject: "s", text: "t", html: "<p>h</p>" }), "re_123");	CODE
LOW	plugins/auth/test/email.test.ts	70	to: ["admin@example.com"],	CODE
LOW	plugins/auth/test/flow.test.ts	38	const submit = form({ request, email: email ?? "admin@example.com" });	CODE
LOW	plugins/auth/test/flow.test.ts	107	assert.equal(h.mailer.sent[0]!.to, "admin@example.com");	CODE
LOW⚡	plugins/auth/test/flow.test.ts	126	assert.equal(claims.email, "admin@example.com");	CODE
LOW⚡	plugins/auth/test/flow.test.ts	133	assert.equal(userinfo.email, "admin@example.com");	CODE
LOW⚡	plugins/auth/test/flow.test.ts	142	const submitted = await fetch(`${h.base}/authorize`, form({ email: "admin@example.com" }));	CODE
LOW	plugins/auth/test/flow.test.ts	174	assert.equal(claims.email, "admin@example.com");	CODE
LOW⚡	plugins/auth/test/flow.test.ts	339	await requestLink(h, { email: "stranger@example.org" });	CODE
LOW⚡	plugins/auth/test/flow.test.ts	342	const permitted = await startHarness({ env: { AUTH_ALLOWED_EMAILS: "stranger@example.org" } });	CODE
LOW⚡	plugins/auth/test/flow.test.ts	344	await requestLink(permitted, { email: "stranger@example.org" });	CODE
LOW⚡	plugins/auth/test/flow.test.ts	347	const narrowed = await startHarness({ env: { AUTH_ALLOWED_EMAILS: "admin@example.com" } });	CODE
LOW	plugins/auth/test/flow.test.ts	364	await requestLink(h, { email: "admin@example.com" });	CODE
LOW	plugins/auth/test/flow.test.ts	403	assert.equal(await bodyFor("admin@example.com"), await bodyFor("nobody@elsewhere.test"));	CODE
LOW	plugins/auth/test/flow.test.ts	444	assert.ok(!id.includes("admin@example.com"), id);	CODE
LOW	plugins/auth/test/flow.test.ts	446	!id.includes(createHash("sha256").update("admin@example.com").digest("base64url").slice(0, 22)),	CODE
40 more matches not shown…

Cross-Language Confusion (JS/TS)5 hits · 32 pts

Severity	File	Line	Snippet	Context
HIGH	test/gmail-mime.test.ts	20	print(json.dumps({"contentType": msg.get_content_type(), "parts": parts}))	CODE
HIGH⚡	scripts/monitor-smoke.ts	52	print("PHASE: loading/downloading segmind/tiny-sd", flush=True)	CODE
HIGH⚡	scripts/monitor-smoke.ts	56	print("PHASE: model ready; generating a 256x256 image on CPU", flush=True)	CODE
HIGH⚡	scripts/monitor-smoke.ts	59	print("PHASE: image saved diffusion-out.png", flush=True)	CODE
HIGH	scripts/git-cli-smoke.ts	83	elif [ "${requiredGlabFlag}" = 1 ]; then	CODE

Modern AI Meta-Vocabulary3 hits · 8 pts

Severity	File	Line	Snippet	Context
MEDIUM	test/custom-provider-e2e.test.ts	81	// 2. guardrails	COMMENT
MEDIUM	docs/deploy-directory.md	236	`https://<proxy hostname>`. Update vendored Terraform from the current scaffold	CODE
MEDIUM	cli/test/init.test.ts	66	// The scaffold names anthropic as the base model provider, so its key is required	COMMENT

Over-Commented Block6 hits · 6 pts

Severity	File	Line	Snippet	Context
LOW	plugins/web-ui/src/admin/admin.css	1581	#app-view #view-governance .dd > button,	COMMENT
LOW	plugins/web-ui/src/admin/admin.css	1701	#app-view #view-governance #card-external-slack .posture-choice,	COMMENT
LOW	deploy/egress-proxy/envoy.yaml	1	# The forced egress proxy's data plane. Envoy terminates HTTP CONNECT and	COMMENT
LOW	deploy/do-managed-agents/register-template.sh	1	#!/usr/bin/env bash	COMMENT
LOW	cli/src/provider-scaffold.ts	41	"contract": 1,	COMMENT
LOW	cli/src/provider-scaffold.ts	61	// The vendor supplying the base model: "anthropic", "openai", or "openrouter"	COMMENT

Synthetic Comment Markers1 hit · 5 pts

Severity	File	Line	Snippet	Context
HIGH	skills-seed/popular-web-designs/templates/replicate.md	302	- "Create a manifesto section on Replicate Dark (#202020) with 'Imagine what you can build.' at 128px rb-freigeist-neue	CODE

AI Slop Vocabulary2 hits · 4 pts

Severity	File	Line	Snippet	Context
MEDIUM	plugins/web-ui/package-lock.json	5621	"resolved": "https://registry.npmjs.org/robust-predicates/-/robust-predicates-3.0.3.tgz",	CODE
MEDIUM	src/wiring.ts	1924	`DO $$ BEGIN IF to_regclass('swarms') IS NOT NULL THEN UPDATE swarms SET json = json #- '{template,harness}' WHERE	CODE

Deep Nesting4 hits · 4 pts

Severity	File	Line	Context
LOW	desktop/desk/tests/manual/background-input.py	32	CODE
LOW	skills-seed/google-workspace/scripts/gmail.py	176	CODE
LOW	skills-seed/email-voice-profile/scripts/fetch_sent.py	109	CODE
LOW	src/files/upload-client.py	93	CODE

Excessive Try-Catch Wrapping3 hits · 4 pts

Severity	File	Line	Snippet	Context
LOW	skills-seed/browse/SKILL.md	206	except Exception:	CODE
LOW	src/files/upload-client.py	195	except Exception as error:	CODE
MEDIUM	src/files/upload-client.py	28	def error_code(content):	CODE

Decorative Section Separators1 hit · 3 pts

Severity	File	Line	Snippet	Context
MEDIUM	test/wake-steering.test.ts	676	// ── Orphaned-signal replay: a steer that loses the pickup race is never dropped ────────────────	COMMENT

Overly Generic Function Names1 hit · 1 pts

Severity	File	Line	Snippet	Context
LOW	src/slack/dev-introspection.ts	187	async function handleRequest(	CODE

yc-software/qm

Open-Source Code Quality, Security and Technical Debt Review