M4Marvin/charon

What this review found

No material or immediate-danger item was identified.

Coverage and limitations

Inventory

409 files · 2663232 bytes

Contextual coverage

2 of 2 candidates assessed

JavaScript coverage

Status

Incomplete

Candidates

329 files · 1302850 bytes

X-Ray review families

0 warning occurrences compacted to 0 evidence-preserving review families

Representations

329 raw · 1 decoded · 0 normalized · 0 bundle modules

Stage scans

329 raw signatures · 37 raw AST · 329 raw OpenGrep · 1 derived signatures · 0 derived AST · 1 derived OpenGrep

Unresolved JavaScript stages

• drizzle.config.ts — raw-ast / parse
• scripts/create-admin.ts — raw-ast / parse
• scripts/migrate-data.ts — raw-ast / parse
• scripts/migrate-image-paths.ts — raw-ast / parse
• src/components/MarkdownContent.tsx — raw-ast / parse
• src/components/RichText.tsx — raw-ast / parse
• src/components/ai/ProviderDialog.tsx — raw-ast / parse
• src/components/ai/ProviderManager.tsx — raw-ast / parse
• src/components/ai/TestMessageDialog.tsx — raw-ast / parse
• src/components/character/EmbeddedLorebookPanel.tsx — raw-ast / parse
• src/components/common/ChipInput.tsx — raw-ast / parse
• src/components/common/CommandMenu.tsx — raw-ast / parse
• src/components/common/ConfirmDialog.tsx — raw-ast / parse
• src/components/common/EmptyState.tsx — raw-ast / parse
• src/components/common/ErrorBanner.tsx — raw-ast / parse
• src/components/common/ErrorBoundary.tsx — raw-ast / parse
• src/components/common/Logo.tsx — raw-ast / parse
• src/components/common/ModelCombobox.tsx — raw-ast / parse
• src/components/common/PageHeader.tsx — raw-ast / parse
• src/components/common/RelativeTime.tsx — raw-ast / parse
• src/components/common/RowActionsMenu.tsx — raw-ast / parse
• src/components/common/SaveBar.tsx — raw-ast / parse
• src/components/common/SectionNav.tsx — raw-ast / parse
• src/components/common/Skeletons.tsx — raw-ast / parse
• src/components/common/StatChip.tsx — raw-ast / parse
• src/components/common/StatusDot.tsx — raw-ast / parse
• src/components/common/TagFilterPopover.tsx — raw-ast / parse
• src/components/lorebook/EntryEditorSheet.tsx — raw-ast / parse
• src/components/lorebook/ImportLorebookDialog.tsx — raw-ast / parse
• src/components/preset/PresetDialog.tsx — raw-ast / parse
• src/components/preset/PresetManager.tsx — raw-ast / parse
• src/components/ui/accordion.tsx — raw-ast / parse
• src/components/ui/alert-dialog.tsx — raw-ast / parse
• src/components/ui/alert.tsx — raw-ast / parse
• src/components/ui/aspect-ratio.tsx — raw-ast / parse
• src/components/ui/attachment.tsx — raw-ast / parse
• src/components/ui/avatar.tsx — raw-ast / parse
• src/components/ui/badge.tsx — raw-ast / parse
• src/components/ui/breadcrumb.tsx — raw-ast / parse
• src/components/ui/bubble.tsx — raw-ast / parse
• src/components/ui/button-group.tsx — raw-ast / parse
• src/components/ui/button.tsx — raw-ast / parse
• src/components/ui/calendar.tsx — raw-ast / parse
• src/components/ui/card.tsx — raw-ast / parse
• src/components/ui/carousel.tsx — raw-ast / parse
• src/components/ui/chart.tsx — raw-ast / parse
• src/components/ui/checkbox.tsx — raw-ast / parse
• src/components/ui/collapsible.tsx — raw-ast / parse
• src/components/ui/combobox.tsx — raw-ast / parse
• src/components/ui/command.tsx — raw-ast / parse
• src/components/ui/context-menu.tsx — raw-ast / parse
• src/components/ui/dialog.tsx — raw-ast / parse
• src/components/ui/direction.tsx — raw-ast / parse
• src/components/ui/drawer.tsx — raw-ast / parse
• src/components/ui/dropdown-menu.tsx — raw-ast / parse
• src/components/ui/empty.tsx — raw-ast / parse
• src/components/ui/field.tsx — raw-ast / parse
• src/components/ui/hover-card.tsx — raw-ast / parse
• src/components/ui/input-group.tsx — raw-ast / parse
• src/components/ui/input-otp.tsx — raw-ast / parse
• src/components/ui/input.tsx — raw-ast / parse
• src/components/ui/item.tsx — raw-ast / parse
• src/components/ui/kbd.tsx — raw-ast / parse
• src/components/ui/label.tsx — raw-ast / parse
• src/components/ui/marker.tsx — raw-ast / parse
• src/components/ui/menubar.tsx — raw-ast / parse
• src/components/ui/message-scroller.tsx — raw-ast / parse
• src/components/ui/message.tsx — raw-ast / parse
• src/components/ui/navigation-menu.tsx — raw-ast / parse
• src/components/ui/pagination.tsx — raw-ast / parse
• src/components/ui/popover.tsx — raw-ast / parse
• src/components/ui/progress.tsx — raw-ast / parse
• src/components/ui/radio-group.tsx — raw-ast / parse
• src/components/ui/resizable.tsx — raw-ast / parse
• src/components/ui/scroll-area.tsx — raw-ast / parse
• src/components/ui/select.tsx — raw-ast / parse
• src/components/ui/separator.tsx — raw-ast / parse
• src/components/ui/sheet.tsx — raw-ast / parse
• src/components/ui/sidebar.tsx — raw-ast / parse
• src/components/ui/skeleton.tsx — raw-ast / parse
• src/components/ui/slider.tsx — raw-ast / parse
• src/components/ui/sonner.tsx — raw-ast / parse
• src/components/ui/spinner.tsx — raw-ast / parse
• src/components/ui/switch.tsx — raw-ast / parse
• src/components/ui/table.tsx — raw-ast / parse
• src/components/ui/tabs.tsx — raw-ast / parse
• src/components/ui/textarea.tsx — raw-ast / parse
• src/components/ui/toggle-group.tsx — raw-ast / parse
• src/components/ui/toggle.tsx — raw-ast / parse
• src/components/ui/tooltip.tsx — raw-ast / parse
• src/db/__tests__/aiProviders.repo.test.ts — raw-ast / parse
• src/db/__tests__/character-data.ts — raw-ast / parse
• src/db/__tests__/characters.repo.test.ts — raw-ast / parse
• src/db/__tests__/chats.repo.test.ts — raw-ast / parse
• src/db/__tests__/helpers.ts — raw-ast / parse
• src/db/__tests__/lorebook-data.ts — raw-ast / parse
• src/db/__tests__/lorebooks.repo.test.ts — raw-ast / parse
• src/db/__tests__/personas.repo.test.ts — raw-ast / parse
• src/db/__tests__/userLorebookSettings.repo.test.ts — raw-ast / parse
• src/db/__tests__/userSettings.repo.test.ts — raw-ast / parse

Tools

• inventory 0.1.0 — completed
• tavernkeeper-static 5 — completed
• gitleaks 8.30.1 — completed
• opengrep 1.26.0 — completed
• javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1 — completed
• osv-scanner 2.4.0 — completed
• zizmor 1.28.0 — completed
• malcontent 1.25.7 — completed

Limitations

• This advisory review cannot prove the absence of unknown behavior.
• JavaScript analysis was incomplete, so this first-filter scan supports no clean conclusion about unobserved behavior.