geoffmiller/ratatat

• Repository: https://github.com/geoffmiller/ratatat
• Commit: 7215cd4bc7bea1e1bcbd0c813d7326f49b26e14b
• Generated: 2026-11-13T23:58:17+00:00
• Scorer 0.1.0, scoring prov-4+qual-2+sec-2, report schema v2

Scores

AI provenance

Weak signals consistent with AI-assisted development.

• Explicitly attributed share (lower bound): 0.0%

• Unattributed share in AI-consistent velocity bursts: 19.2%

• Estimated AI-generated share: 0.0%

• Stylometry index: 0.15 per 1,000 lines (narrated steps 0, placeholders 0, assistant phrasing 0, emoji 8). Reported as a signal, not scored.

Evidence

• 2,041 lines of first-party code in ~2.7h (768 lines/hour, 11 commit session) (2eee41140e8e)
• 6,847 lines of first-party code in ~11.4h (598 lines/hour, 50 commit session) (18aead124f30)
• 1,127 lines of first-party code in ~2.0h (571 lines/hour, 7 commit session) (4b1ff623a52a)

AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.

Code quality

Code quality is poor: test-to-source ratio 0.79, no CI test run detected; 19% of function code in complex or long functions; 16% duplicated lines. Weakest area: lint.

• Functions: 1,665; mean complexity 2.6, 90th percentile 5; 25 complex and 9 long functions
• Duplicated lines: 15.9% of 18,258 compared
• Tests: 20,999 test lines for 26,489 source lines (ratio 0.79); CI test commands: none detected; 14% of recent source commits also change tests
• Docs missing or thin: contributing, changelog

Most complex functions:

• requireNative in packages/core/index.cjs: complexity 165, 462 lines
• requireNative in packages/core/native.cjs: complexity 165, 462 lines
• applyFlexStyles in packages/ink/src/styles.ts: complexity 49, 124 lines
• handleData in packages/core/src/input.ts: complexity 45, 118 lines
• parseKeypress in packages/ink/src/parse-keypress.ts: complexity 44, 93 lines

Security

Security posture is weak: 114 known vulnerabilities in 25 dependencies. Weakest area: posture.

• Known vulnerabilities: 114 in 25 packages (critical 2, high 49, medium 52, low 11)

• Posture checks passed: none; missing: security policy, dependency updates, signed commits, lockfiles

Top findings

Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.

Repository profile

• Source lines: 26,489; test lines: 20,999

[![RepoTrust ai](https://repotrust.synapticcyber.com/badge/github.com/geoffmiller/ratatat/ai.svg)](https://repotrust.synapticcyber.com/r/github.com/geoffmiller/ratatat/)

[![RepoTrust quality](https://repotrust.synapticcyber.com/badge/github.com/geoffmiller/ratatat/quality.svg)](https://repotrust.synapticcyber.com/r/github.com/geoffmiller/ratatat/)

[![RepoTrust security](https://repotrust.synapticcyber.com/badge/github.com/geoffmiller/ratatat/security.svg)](https://repotrust.synapticcyber.com/r/github.com/geoffmiller/ratatat/)