TODO" src/
+- `docs/reference/STUB_DETECTION_IMPLEMENTATION.md:377` — TODO: Update reference links to correct repo-relative paths from docs/reference (stub-detection docs, workflows, scripts).
+- `docs/reference/STUB_DETECTION_QUICK_START.md:28` — - **10 medium** severity (marked as TODO/mock)
+- `docs/reference/STUB_DETECTION_QUICK_START.md:29` — - **179 low** severity (mostly TODO comments)
+- `docs/reference/STUB_DETECTION_QUICK_START.md:39` — | Returns null | `return null // TODO` | 🟡 Medium |
+- `docs/reference/STUB_DETECTION_QUICK_START.md:40` — | TODO comment | `// TODO: implement this` | 🟡 Medium |
+- `docs/reference/STUB_DETECTION_QUICK_START.md:41` — | Placeholder UI | `
TODO: build UI
` | 🟠 High |
+- `docs/reference/STUB_DETECTION_QUICK_START.md:57` — ### Find All TODO Comments
+- `docs/reference/STUB_DETECTION_QUICK_START.md:59` — grep -r "TODO:" src/ | grep -v test
+- `docs/reference/STUB_DETECTION_QUICK_START.md:149` — TODO: doc links below should be relative to docs/reference (use ../stub-detection/...).
+- `docs/reference/STUB_DETECTION_QUICK_START.md:173` — ### Tip 2: Create Issues Instead of TODO
+- `docs/reference/STUB_DETECTION_QUICK_START.md:176` — // TODO: add caching
+- `docs/reference/STUB_DETECTION_QUICK_START.md:238` — "code": "{ // TODO: Replace with proper database query"
+- `docs/reference/STUB_DETECTION_SUMMARY.md:44` — 4. **🟡 TODO Comments** - `// TODO:` or `// FIXME:` markers
+- `docs/reference/STUB_DETECTION_SUMMARY.md:45` — 5. **🟠 Placeholder Text** - `
TODO: build UI
`
+- `docs/reference/STUB_DETECTION_SUMMARY.md:86` — - ✅ **10 medium severity** - Some marked as TODO/mock
+- `docs/reference/STUB_DETECTION_SUMMARY.md:87` — - ✅ **179 low severity** - Mostly TODO comments
+- `docs/reference/STUB_DETECTION_SUMMARY.md:144` — ### Example 3: TODO Comment
+- `docs/reference/STUB_DETECTION_SUMMARY.md:147` — // TODO: implement processing // ← Detected: 🟡 Medium
+- `docs/reference/STUB_DETECTION_SUMMARY.md:230` — TODO: Stub-detection doc references below should be relative to docs/reference (use ../stub-detection/...).
+- `docs/reference/TESTING_IMPLEMENTATION_SUMMARY.md:7` — TODO: This file uses ../docs/... links that resolve to docs/docs; update to correct relative paths.
+- `docs/stub-detection/OVERVIEW.md:19` — - **Low**: 179 (TODO comments)
+- `docs/stub-detection/OVERVIEW.md:22` — - TODO/FIXME comments: 167
+- `docs/stub-detection/OVERVIEW.md:77` — TODO: Links below should be relative to docs/stub-detection (drop docs/ prefix).
+- `docs/stub-detection/OVERVIEW.md:108` — ### 4. TODO Comments (🟡 Medium)
+- `docs/stub-detection/OVERVIEW.md:111` — // TODO: implement this ← Detected
+- `docs/stub-detection/OVERVIEW.md:119` — return
TODO: Build dashboard
// ← Detected
+- `docs/stub-detection/OVERVIEW.md:208` — ### Fix TODO Comment
+- `docs/stub-detection/OVERVIEW.md:211` — // TODO: implement feature
+- `docs/stub-detection/QUICK_REFERENCE.md:10` — | `
TODO
` | 🟠 High | See Pattern 4 | Implement component |
+- `docs/stub-detection/QUICK_REFERENCE.md:12` — | `// TODO:` comment | 🟡 Medium | See Pattern 6 | Create issue, implement |
+- `docs/stub-detection/QUICK_REFERENCE.md:71` — ### Replace TODO Comments
+- `docs/stub-detection/QUICK_REFERENCE.md:74` — // TODO: implement feature
+- `docs/stub-detection/QUICK_REFERENCE.md:92` — # TODO comments
+- `docs/stub-detection/QUICK_REFERENCE.md:93` — grep -r "TODO\|FIXME" src/
+- `docs/stub-detection/QUICK_REFERENCE.md:154` — // TODO: implement
+- `docs/stub-detection/README.md:12` — - Contains TODO/FIXME comments indicating incomplete work
+- `docs/stub-detection/README.md:51` — return
TODO: Build dashboard
+- `docs/stub-detection/README.md:88` — | `// TODO:` or `// FIXME:` | Medium | Known issue, incomplete |
+- `docs/stub-detection/README.md:260` — return null // TODO: load config
+- `docs/stub-detection/README.md:278` — return
TODO: Build dashboard
+- `docs/stub-detection/README.md:315` — ### Pattern 6: TODO Comments
+- `docs/stub-detection/README.md:317` — **Problem**: Code has TODO/FIXME comments indicating incomplete work
+- `docs/stub-detection/README.md:319` — **Fix**: Create GitHub issue and remove TODO from code
+- `docs/stub-detection/README.md:324` — // TODO: Add real email validation
+- `docs/stub-detection/README.md:389` — // TODO: add caching (#TBD)
+
+### `frontends` (36)
+- `frontends/nextjs/src/components/GitHubActionsFetcher.tsx:66` — // TODO: Replace with proper GitHub OAuth authentication in Next.js
+- `frontends/nextjs/src/components/GitHubActionsFetcher.tsx:140` — // TODO: Replace with Next.js API route that calls an LLM service
+- `frontends/nextjs/src/components/GitHubActionsFetcher.tsx:291` — // TODO: Replace with Next.js API route that calls an LLM service
+- `frontends/nextjs/src/components/ScreenshotAnalyzer.tsx:64` — // TODO: Replace with Next.js API route that calls an LLM service
+- `frontends/nextjs/src/components/ui/accordion.ts:2` — // TODO: Update imports to use @/components/ui directly
+- `frontends/nextjs/src/components/ui/alert-dialog.ts:2` — // TODO: Update imports to use @/components/ui directly
+- `frontends/nextjs/src/components/ui/alert.ts:2` — // TODO: Update imports to use @/components/ui directly
+- `frontends/nextjs/src/components/ui/avatar.ts:2` — // TODO: Update imports to use @/components/ui directly
+- `frontends/nextjs/src/components/ui/badge.ts:2` — // TODO: Update imports to use @/components/ui directly
+- `frontends/nextjs/src/components/ui/button.ts:2` — // TODO: Update imports to use @/components/ui directly
+- `frontends/nextjs/src/components/ui/card.ts:2` — // TODO: Update imports to use @/components/ui directly
+- `frontends/nextjs/src/components/ui/checkbox.ts:2` — // TODO: Update imports to use @/components/ui directly
+- `frontends/nextjs/src/components/ui/dialog.ts:2` — // TODO: Update imports to use @/components/ui directly
+- `frontends/nextjs/src/components/ui/dropdown-menu.ts:2` — // TODO: Update imports to use @/components/ui directly
+- `frontends/nextjs/src/components/ui/input.ts:2` — // TODO: Update imports to use @/components/ui directly
+- `frontends/nextjs/src/components/ui/label.ts:2` — // TODO: Update imports to use @/components/ui directly
+- `frontends/nextjs/src/components/ui/progress.ts:2` — // TODO: Update imports to use @/components/ui directly
+- `frontends/nextjs/src/components/ui/radio-group.ts:2` — // TODO: Update imports to use @/components/ui directly
+- `frontends/nextjs/src/components/ui/scroll-area.ts:2` — // TODO: Update imports to use @/components/ui directly
+- `frontends/nextjs/src/components/ui/select.ts:2` — // TODO: Update imports to use @/components/ui directly
+- `frontends/nextjs/src/components/ui/separator.ts:2` — // TODO: Update imports to use @/components/ui directly
+- `frontends/nextjs/src/components/ui/sheet.ts:2` — // TODO: Update imports to use @/components/ui directly
+- `frontends/nextjs/src/components/ui/skeleton.ts:2` — // TODO: Update imports to use @/components/ui directly
+- `frontends/nextjs/src/components/ui/slider.ts:2` — // TODO: Update imports to use @/components/ui directly
+- `frontends/nextjs/src/components/ui/sonner.tsx:94` — // TODO: Implement dismiss by ID
+- `frontends/nextjs/src/components/ui/switch.ts:2` — // TODO: Update imports to use @/components/ui directly
+- `frontends/nextjs/src/components/ui/table.ts:2` — // TODO: Update imports to use @/components/ui directly
+- `frontends/nextjs/src/components/ui/tabs.ts:2` — // TODO: Update imports to use @/components/ui directly
+- `frontends/nextjs/src/components/ui/textarea.ts:2` — // TODO: Update imports to use @/components/ui directly
+- `frontends/nextjs/src/hooks/useAuth.ts:28` — // TODO: Implement proper auth with backend/Prisma
+- `frontends/nextjs/src/hooks/useKV.ts:9` — // TODO: Implement proper persistent KV storage with Database/Prisma
+- `frontends/nextjs/src/lib/lua/sandboxed-lua-engine.ts:19` — // TODO: Enforce maxMemory limit in sandbox execution.
+- `frontends/nextjs/src/lib/security/secure-db/log-operation.ts:28` — // TODO: Replace with proper audit log storage
+- `frontends/nextjs/src/lib/security/secure-db/operations/get-audit-logs.ts:14` — // TODO: Replace with proper audit log storage query using the requested limit.
+- `frontends/nextjs/src/lib/security/secure-db/operations/verify-credentials.ts:16` — // TODO: Track failed login attempts and enforce account lockout/backoff.
+- `frontends/nextjs/src/lib/security/secure-db/rate-limit-store.ts:1` — // TODO: Load rate limit settings from config/DB instead of hardcoding.
+
+### `tools` (15)
+- `tools/analyze-implementation-completeness.ts:104` — if (body.includes('TODO') || body.includes('FIXME')) {
+- `tools/analyze-test-coverage.ts:292` — // Generate TODO items
+- `tools/analyze-test-coverage.ts:294` — console.log("TODO - CREATE TESTS FOR:");
+- `tools/autobot.sh:9` — codex exec --full-auto --sandbox="danger-full-access" --cd="/Users/rmac/Documents/GitHub/metabuilder/docs/todo/" "Please resolve my TODO list, Scan project for TODO items." || e...
+- `tools/check-function-coverage.js:184` — console.log(`🎯 TODO - CREATE TESTS FOR:`);
+- `tools/detect-stub-implementations.ts:24` — name: 'TODO comment in function',
+- `tools/detect-stub-implementations.ts:25` — pattern: /\/\/\s*TODO|\/\/\s*FIXME|\/\/\s*XXX|\/\/\s*HACK/i,
+- `tools/detect-stub-implementations.ts:28` — description: 'Function has TODO/FIXME comment'
+- `tools/detect-stub-implementations.ts:53` — pattern: /<[A-Z]\w*[^>]*>\s*(placeholder|TODO|FIXME|stub|mock|example|not implemented)/i,
+- `tools/detect-stub-implementations.ts:130` — if (line.match(/stub|placeholder|mock|not implemented|TODO.*implementation/i)) {
+- `tools/generate-stub-report.ts:138` — report += ' return null // TODO: implement API call\n'
+- `tools/generate-stub-report.ts:151` — report += ' return
TODO: Build dashboard
\n'
+- `tools/generate-stub-report.ts:185` — report += '- [ ] All TODO/FIXME comments reference GitHub issues\n'
+- `tools/generate-stub-report.ts:194` — report += '3. **Convert stubs to issues** - Don\'t use TODO in code, create GitHub issues\n'
+- `tools/generate-stub-report.ts:196` — report += '5. **Use linting rules** - Configure ESLint to catch console.log and TODO\n\n'
diff --git a/docs/todo/TODO_STATUS.md b/docs/todo/TODO_STATUS.md
new file mode 100644
index 000000000..50be354df
--- /dev/null
+++ b/docs/todo/TODO_STATUS.md
@@ -0,0 +1,31 @@
+# TODO List Status
+
+- Generated: `2025-12-25 20:56:07Z` (UTC)
+- Directory: `/Users/rmac/Documents/GitHub/metabuilder/docs/todo`
+- Total items: **852** (`open`=829, `done`=23)
+
+| File | Open | Done | Total |
+|------|-----:|-----:|------:|
+| `0-kickstart.md` | 8 | 0 | 8 |
+| `1-TODO.md` | 4 | 0 | 4 |
+| `10-SECURITY-TODO.md` | 40 | 2 | 42 |
+| `11-DEPLOYMENT-TODO.md` | 40 | 0 | 40 |
+| `12-DOCUMENTATION-TODO.md` | 45 | 0 | 45 |
+| `13-DECLARATIVE-UI-TODO.md` | 45 | 1 | 46 |
+| `14-MULTI-TENANT-TODO.md` | 35 | 0 | 35 |
+| `15-BUILD-FIXES-TODO.md` | 34 | 6 | 40 |
+| `16-SCRIPTS-TOOLING-TODO.md` | 37 | 3 | 40 |
+| `17-GITHUB-COPILOT-TODO.md` | 35 | 0 | 35 |
+| `18-ACCESSIBILITY-TODO.md` | 40 | 0 | 40 |
+| `19-PERFORMANCE-TODO.md` | 40 | 0 | 40 |
+| `2-TODO.md` | 27 | 0 | 27 |
+| `20-FUTURE-FEATURES-TODO.md` | 45 | 0 | 45 |
+| `21-SDLC-TODO.md` | 127 | 2 | 129 |
+| `3-TODO.md` | 16 | 0 | 16 |
+| `4-DBAL-TODO.md` | 30 | 2 | 32 |
+| `5-FRONTEND-TODO.md` | 37 | 1 | 38 |
+| `6-PACKAGES-TODO.md` | 49 | 1 | 50 |
+| `7-DATABASE-TODO.md` | 30 | 0 | 30 |
+| `8-TESTING-TODO.md` | 30 | 4 | 34 |
+| `9-LUA-SCRIPTING-TODO.md` | 35 | 1 | 36 |
+| `README.md` | 0 | 0 | 0 |
diff --git a/docs/todo/scan-project-todos.py b/docs/todo/scan-project-todos.py
new file mode 100644
index 000000000..d87d1013d
--- /dev/null
+++ b/docs/todo/scan-project-todos.py
@@ -0,0 +1,205 @@
+#!/usr/bin/env python3
+
+from __future__ import annotations
+
+import re
+import subprocess
+from collections import Counter, defaultdict
+from dataclasses import dataclass
+from datetime import datetime, timezone
+from pathlib import Path
+
+
+@dataclass(frozen=True)
+class TodoMatch:
+ path: str
+ line: int
+ text: str
+
+
+PATTERN = r"\b(TODO|FIXME|HACK|XXX)\b"
+RG_GLOBS = [
+ "!docs/todo/**",
+ "!**/node_modules/**",
+ "!**/.next/**",
+ "!**/coverage/**",
+ "!**/dist/**",
+ "!**/build/**",
+ "!**/.git/**",
+]
+
+
+def _repo_root(script_dir: Path) -> Path:
+ # docs/todo -> docs -> repo root
+ return script_dir.parent.parent
+
+
+def _run_rg(repo_root: Path) -> list[TodoMatch]:
+ cmd = ["rg", "-n", "-S", PATTERN]
+ for glob in RG_GLOBS:
+ cmd.extend(["--glob", glob])
+ cmd.append(".")
+
+ completed = subprocess.run(
+ cmd,
+ cwd=repo_root,
+ text=True,
+ capture_output=True,
+ check=False,
+ )
+
+ if completed.returncode not in (0, 1):
+ raise RuntimeError(
+ "ripgrep failed\n"
+ f"cmd: {' '.join(cmd)}\n"
+ f"exit: {completed.returncode}\n"
+ f"stderr:\n{completed.stderr}"
+ )
+
+ matches: list[TodoMatch] = []
+ for raw_line in completed.stdout.splitlines():
+ # Format: path:line:text (text itself may contain ':', so split max 2)
+ file_part, sep1, rest = raw_line.partition(":")
+ if not sep1:
+ continue
+ line_part, sep2, text_part = rest.partition(":")
+ if not sep2:
+ continue
+ try:
+ line_no = int(line_part)
+ except ValueError:
+ continue
+ matches.append(
+ TodoMatch(
+ path=file_part.removeprefix("./"),
+ line=line_no,
+ text=text_part.rstrip(),
+ )
+ )
+ return matches
+
+
+def _top_level_dir(path: str) -> str:
+ if not path:
+ return "(root)"
+ if path.startswith(".github/"):
+ return ".github"
+ return path.split("/", 1)[0]
+
+
+def _marker_counts(matches: list[TodoMatch]) -> Counter[str]:
+ counts: Counter[str] = Counter()
+ marker_re = re.compile(PATTERN, re.IGNORECASE)
+ for match in matches:
+ found = marker_re.search(match.text)
+ if not found:
+ continue
+ counts[found.group(1).upper()] += 1
+ return counts
+
+
+def _render_scan_report(
+ repo_root: Path, out_path: Path, matches: list[TodoMatch]
+) -> None:
+ now = datetime.now(timezone.utc).strftime("%Y-%m-%d %H:%M:%SZ")
+
+ by_dir: dict[str, list[TodoMatch]] = defaultdict(list)
+ for match in matches:
+ by_dir[_top_level_dir(match.path)].append(match)
+
+ dir_counts = Counter({k: len(v) for k, v in by_dir.items()})
+ marker_counts = _marker_counts(matches)
+
+ lines: list[str] = []
+ lines.append("# TODO Scan Report")
+ lines.append("")
+ lines.append(f"- Generated: `{now}` (UTC)")
+ lines.append(f"- Repo root: `{repo_root}`")
+ lines.append(f"- Pattern: `{PATTERN}`")
+ lines.append(
+ "- Excludes: `docs/todo/`, `**/node_modules/`, `**/.next/`, `**/coverage/`, `**/dist/`, `**/build/`, `**/.git/`"
+ )
+ lines.append("")
+ lines.append("## Summary")
+ lines.append(f"- Total matches: **{len(matches)}**")
+ if marker_counts:
+ lines.append(
+ "- By marker: "
+ + ", ".join(
+ f"`{marker}`={marker_counts[marker]}"
+ for marker in sorted(marker_counts.keys())
+ )
+ )
+ lines.append("- By top-level directory:")
+ for directory in sorted(dir_counts.keys()):
+ lines.append(f" - `{directory}`: {dir_counts[directory]}")
+
+ lines.append("")
+ lines.append("## Matches")
+ for directory in sorted(by_dir.keys()):
+ lines.append("")
+ lines.append(f"### `{directory}` ({len(by_dir[directory])})")
+ for match in sorted(by_dir[directory], key=lambda m: (m.path, m.line)):
+ snippet = re.sub(r"\s+", " ", match.text).strip()
+ if len(snippet) > 180:
+ snippet = snippet[:177] + "..."
+ lines.append(f"- `{match.path}:{match.line}` — {snippet}")
+
+ out_path.write_text("\n".join(lines).rstrip() + "\n", encoding="utf-8")
+
+
+def _render_todo_status(todo_dir: Path, out_path: Path) -> None:
+ md_files = sorted(
+ p for p in todo_dir.glob("*.md") if p.name not in {"TODO_SCAN_REPORT.md", "TODO_STATUS.md"}
+ )
+
+ checkbox_open_re = re.compile(r"^\s*-\s*\[\s*\]\s+")
+ checkbox_done_re = re.compile(r"^\s*-\s*\[\s*x\s*\]\s+", re.IGNORECASE)
+
+ rows: list[tuple[str, int, int, int]] = []
+ total_open = 0
+ total_done = 0
+ for path in md_files:
+ open_count = 0
+ done_count = 0
+ for line in path.read_text(encoding="utf-8").splitlines():
+ if checkbox_done_re.match(line):
+ done_count += 1
+ elif checkbox_open_re.match(line):
+ open_count += 1
+ total_open += open_count
+ total_done += done_count
+ rows.append((path.name, open_count, done_count, open_count + done_count))
+
+ lines: list[str] = []
+ now = datetime.now(timezone.utc).strftime("%Y-%m-%d %H:%M:%SZ")
+ lines.append("# TODO List Status")
+ lines.append("")
+ lines.append(f"- Generated: `{now}` (UTC)")
+ lines.append(f"- Directory: `{todo_dir}`")
+ lines.append(f"- Total items: **{total_open + total_done}** (`open`={total_open}, `done`={total_done})")
+ lines.append("")
+ lines.append("| File | Open | Done | Total |")
+ lines.append("|------|-----:|-----:|------:|")
+ for filename, open_count, done_count, total in rows:
+ lines.append(f"| `{filename}` | {open_count} | {done_count} | {total} |")
+
+ out_path.write_text("\n".join(lines).rstrip() + "\n", encoding="utf-8")
+
+
+def main() -> None:
+ script_path = Path(__file__).resolve()
+ todo_dir = script_path.parent
+ repo_root = _repo_root(todo_dir)
+
+ matches = _run_rg(repo_root)
+ _render_scan_report(repo_root, todo_dir / "TODO_SCAN_REPORT.md", matches)
+ _render_todo_status(todo_dir, todo_dir / "TODO_STATUS.md")
+
+ print(f"Wrote: {todo_dir / 'TODO_SCAN_REPORT.md'}")
+ print(f"Wrote: {todo_dir / 'TODO_STATUS.md'}")
+
+
+if __name__ == "__main__":
+ main()
+
diff --git a/frontends/nextjs/src/lib/rendering/page-renderer.test.ts b/frontends/nextjs/src/lib/rendering/page-renderer.test.ts
index fb7bce2ba..ae1d78d00 100644
--- a/frontends/nextjs/src/lib/rendering/page-renderer.test.ts
+++ b/frontends/nextjs/src/lib/rendering/page-renderer.test.ts
@@ -49,8 +49,7 @@ function createMockUser(role: string, id = 'user1'): User {
return {
id,
username: `User ${id}`,
- role: role as any,
- level: role === 'public' ? 1 : role === 'user' ? 2 : role === 'admin' ? 3 : role === 'god' ? 4 : 5,
+ role: role as UserRole,
email: `${id}@test.com`,
createdAt: Date.now(),
}