Repository Analyses
Nightly hotspot reports for popular open-source repositories. Each report ranks functions by activity-weighted risk — complexity × recent commit frequency — and labels the antipatterns driving the score.
cobra's completion subsystem carries the highest activity risk — 5 functions to address first
cobra's completion layer is its most structurally fragile subsystem — one function alone calls 39 distinct callees, making any future change there a high-blast-radius event.
ChatTTS's scheduler carries the highest activity risk — 5 functions to address first
ChatTTS has 40 critical-band functions across 440 total, with its inference and scheduling layer accumulating structural debt that will bite hard the next time anyone opens those files.
awesome-cheatsheets shows a clean bill of structural risk — 9 functions, all low band
I ran a structural risk scan against awesome-cheatsheets expecting to find at least a few tangled functions worth flagging. Instead the repository came back almost entirely quiet, and that result itself is worth explaining.
OpenSpec's core and schema layers carry the highest activity risk — 5 functions to address first
OpenSpec has 91 critical functions out of 814 — and the highest-risk ones are clustered in two files. One is a structural debt bomb with CC 63 and nesting depth 9. Another is actively changing right n
Redisson's cron layer carries the highest activity risk — 5 functions to address first
Redisson's cron scheduling and async batch execution layer is both structurally extreme and actively changing — a combination that makes every commit a live regression risk right now.
iced's winit and widget layers carry the highest structural risk — 5 functions to address first
Two functions in iced's winit and widget layers carry extreme cyclomatic complexity — one topping CC 166 — making them the highest blast-radius targets before the next development push.
Xray-core's proxy layer carries the highest activity risk — 5 functions to address first
Xray-core's VLESS inbound handler is the most complex and most actively changed function in the codebase — all five top hotspots sit in the fire quadrant, making refactoring urgent.
awesome-claude-code's scripts carry the highest activity risk — 5 to address first
The scripts powering awesome-claude-code's automation are its riskiest code right now: process_resources has a cyclomatic complexity of 59 and is actively changing — a live regression risk hiding in p
dayjs's core formatter carries the highest structural debt — 5 functions to address first
dayjs's core format function has 38 independent execution paths and calls 13 distinct functions — structural debt that will bite hard the moment that code is touched again.
vercel/hyper's UI reducer and config migrator carry the highest real activity risk
Two first-party functions in vercel/hyper are both structurally complex and actively changing right now — making them live regression risks, not backlog items. Here's where the real exposure sits.
gson's type resolution and parsing carry the highest structural risk — 5 functions to address first
Five critical functions in google/gson carry extreme structural complexity — and none are being actively refactored. When the next development push arrives, the blast radius will be wide.
lapce's command dispatch carries the highest activity risk — 3 functions to address first
A CC of 294 in a function that's actively changing right now isn't a backlog item — it's a live regression risk. lapce's command dispatch layer is where structural debt and commit churn collide.
croc's core transfer layer carries the highest activity risk — 5 functions to address first
Four of croc's five riskiest functions are actively changing right now — and they all live in the same two files that orchestrate every file transfer. That's a live regression risk, not a backlog item
MediaCrawler's JS bundle dominates the top 5 hotspots — exclude to surface Python risk
Every top hotspot in MediaCrawler lives inside a single minified JS bundle — meaning the real Python risk profile is entirely hidden until that file is excluded from analysis.
hackathon-starter's auth and API layer carries the highest activity risk — 5 functions to address first
All five of hackathon-starter's top hotspots sit in the auth and API layer — and every single one is in the 'fire' quadrant, meaning complexity and active commits are colliding right now.
pretext's analysis core carries the highest activity risk — 5 functions to address first
Five functions in pretext's analysis and line-breaking core are both structurally extreme and actively changing right now — the highest-risk combination for regressions during ongoing development.
jadx's decompiler core carries the highest activity risk — 5 functions to address first
jadx has 795 critical-band functions, and its top five are all in the 'fire' quadrant — complex code that's actively changing. That combination is live regression risk, not future cleanup.
ink's output and keypress layers carry the highest risk — 4 functions to address first
ink's terminal output and keypress parsing are changing right now — and they're also the most structurally complex code in the repo. That's the combination that causes regressions.
conductor-oss/conductor's UI layer carries the highest activity risk — 5 functions to address first
conductor's biggest structural risk isn't in its Java core — it's in the UI layer, where actively-changing JSON utility functions carry cyclomatic complexity scores of 99 and 120, making them live reg
fuels-rs's docs theme carries the highest activity risk — 5 vendored functions to address first
Every one of fuels-rs's top 5 hotspots lives inside a single vendored file. The real Rust codebase deserves a closer look once that noise is filtered out.
filebrowser's frontend and HTTP layer carry the highest activity risk — 5 functions to address first
Five of filebrowser's most critical functions are complex AND actively changing simultaneously — the search API, file listing view, and config handler are live regression risks, not backlog items.
exo's benchmarking layer carries the highest activity risk — 5 functions to address first
exo has 191 critical functions out of 1,549 — and its highest-risk hotspot is a god-function with cyclomatic complexity of 93 that's actively changing right now, making it a live regression risk.
Preact's diff engine carries the highest activity risk — 3 functions to address first
Preact's virtual DOM differ is both its most structurally complex code and its most actively changed — a combination that makes every commit to src/diff/index.js a live regression risk right now.
paperclip's server layer carries the highest activity risk — 5 functions to address first
Two server files in paperclip are changing fast while carrying extreme structural complexity — the kind of combination that makes regressions nearly invisible until they're already in production.