meteor hacks

docs/client/commandline.html:7:<!-- XXX some intro text? -->
docs/client/api.js:1735:// XXX move these up to right place
docs/client/api.html:1652:<!-- XXX replace d6 with _.random once we have underscore 1.4.2 -->
docs/client/docs.js:7:  // XXX this is broken by the new multi-page layout.  Also, it was
docs/client/introduction.html:5:<!-- XXX by: (three headshot thumbnails w names) -->
docs/client/packages/showdown.html:5:<!-- XXX rename to markdown when we rename the package -->
docs/client/packages/showdown.html:13:<!-- XXX include an example -->
examples/unfinished/azrael/client/azrael.js:11:// XXX would be nice to eliminate this function and have people just
examples/unfinished/azrael/client/azrael.js:14:  // XXX pushstate
examples/unfinished/azrael/client/azrael.js:24:  // XXX it would be nice if this were find instead of findLive (ie,
examples/unfinished/azrael/client/azrael.js:31:    // XXX should put up dialog to get name
examples/unfinished/azrael/client/azrael.js:32:    // XXX should support automatically set created/updated timestamps
examples/unfinished/azrael/client/azrael.js:34:                                // XXX horrid syntax
examples/unfinished/azrael/client/azrael.js:37:    // XXX XXX XXX this fails to work -- it leaves edit mode after
examples/unfinished/azrael/client/azrael.js:65:    // XXX XXX doesn't generalize.. the element might very reasonably
examples/unfinished/azrael/client/azrael.js:74:    // XXX should really have a binding/validator-based pattern
examples/unfinished/azrael/client/azrael.js:75:    // XXX check to see this pattern works if you are saving
examples/unfinished/azrael/model.js:1:// XXX it is actually very dangerous to store times as Number. use
examples/unfinished/azrael/model.js:17:  // XXX should limit to just a certain amount of recent chat ..
examples/unfinished/benchmark/benchmark.js:3:// XXX settings now has public. could move stuff there and avoid this.
examples/unfinished/benchmark/benchmark.js:30:  // XXX make more efficient
examples/unfinished/benchmark/benchmark.js:81:    // XXX hardcoded time
examples/unfinished/benchmark/benchmark.js:92:  }, 3*1000); // XXX hardcoded time
examples/unfinished/benchmark/benchmark.js:101:      // Clear out 5% of the DB each time, steady state. XXX parameterize?
examples/unfinished/benchmark/benchmark.js:129:      modifer[field] = value; // XXX injection attack?
examples/unfinished/benchmark/benchmark.js:146:  // XXX publish stats
examples/unfinished/benchmark/benchmark.js:176:  // XXX count of how many docs are in local collection?
examples/unfinished/benchmark/benchmark.js:205:  // XXX very rough per client update rate. we need to measure this
examples/unfinished/benchmark/run-local.sh:18:# XXX this is gross!
examples/unfinished/benchmark/run-local.sh:28:PHANTOMSCRIPT=`mktemp -t benchmark-XXXXXXXX`
examples/unfinished/benchmark/scenarios/README.md:16:    // XXX make this a random distribution?
examples/unfinished/chat-benchmark/benchmark.js:6:// XXX settings now has public. could move stuff there and avoid this.
examples/unfinished/chat-benchmark/benchmark.js:31:  // XXX make more efficient
examples/unfinished/chat-benchmark/benchmark.js:59:  // XXX only needs to run on one server.
examples/unfinished/chat-benchmark/benchmark.js:60:  // XXX do we even need this with room deletion?
examples/unfinished/chat-benchmark/benchmark.js:69:  // XXX only needs to run on one server.
examples/unfinished/chat-benchmark/benchmark.js:123:  // XXX publish stats
examples/unfinished/chat-benchmark/benchmark.js:137:    // XXX should autorun to change rooms? meh.
examples/unfinished/chat-benchmark/benchmark.js:160:  // XXX count of how many docs are in local collection. don't 
examples/unfinished/chat-benchmark/benchmark.js:183:  // XXX very rough per client update rate. we need to measure this
examples/unfinished/chat-benchmark/run-local.sh:18:# XXX this is gross!
examples/unfinished/chat-benchmark/run-local.sh:28:PHANTOMSCRIPT=`mktemp -t benchmark-XXXXXXXX`
examples/unfinished/leaderboard-remote/client/leaderboard-remote.js:3:// XXX I'd rather this be Leaderboard.Players.. can this API be easier?
examples/unfinished/todos-underscore/client/client.js:181:      real.unshift(null); // XXX fake tag
examples/wordplay/client/wordplay.js:205:  // XXX this does not handle hot reload. In the reload case,
examples/wordplay/client/wordplay.js:228:  // XXX this is not a great idiom. meteor server does not yet have a
examples/wordplay/server/game.js:67:  // XXX need to deal with people coming back!
packages/accounts-base/accounts_common.js:22:// XXX we should add some enforcement that this is called on both the
packages/accounts-base/accounts_common.js:50:    // XXX would be nice to "crash" the client and replace the UI with an error
packages/accounts-base/accounts_common.js:84:// XXX Allow users to configure this collection name.
packages/accounts-base/accounts_client.js:201:  // XXX this is messy.
packages/accounts-base/accounts_client.js:202:  // XXX what if login gets called before the callback runs?
packages/accounts-base/accounts_server.js:264:// XXX see comment on Accounts.createUser in passwords_server about adding a
packages/accounts-base/accounts_server.js:279:  // XXX If the onCreateUser or validateNewUser hooks fail, we might
packages/accounts-base/accounts_server.js:321:    // XXX string parsing sucks, maybe
packages/accounts-base/accounts_server.js:330:    // XXX better error reporting for services.facebook.id duplicate, etc
packages/accounts-base/accounts_server.js:342:// XXX Find a better place for this utility function
packages/accounts-base/accounts_server.js:417:  // XXX Temporary special case for Twitter. (Issue #629)
packages/accounts-base/accounts_server.js:438:    // XXX provide an onUpdateUser hook which would let apps update
packages/accounts-base/accounts_server.js:446:    // XXX Maybe we should re-use the selector above and notice if the update
packages/accounts-base/accounts_server.js:528:    // XXX this publish is neither dedup-able nor is it optimized by our special
packages/accounts-base/accounts_server.js:560:    // XXX if service configuration is oauth-specific then this code should
packages/accounts-base/accounts_tests.js:1:// XXX it'd be cool to also test that the right thing happens if options
packages/accounts-base/localstorage_token.js:119:      Meteor.loginWithToken(currentLoginToken); // XXX should we pass a callback here?
packages/accounts-base/url_client.js:23:// XXX we don't need to use hash fragments in this case, and having
packages/accounts-base/url_server.js:1:// XXX These should probably not actually be public?
packages/accounts-oauth/oauth_tests.js:1:// XXX Add a test to ensure that successful logins call Accounts.updateOrCreateUserFromExternalService
packages/accounts-oauth/oauth_tests.js:2:// XXX Add a test to ensure that a missing or failed loginResult is handled correctly
packages/accounts-password/password_server.js:19:// XXX maybe this belongs in the check package
packages/accounts-password/password_server.js:187:  // XXX this should invalidate all login tokens other than the current one
packages/accounts-password/password_server.js:269:  // XXX refactor! This is basically identical to sendResetPasswordEmail.
packages/accounts-password/password_server.js:364:  // XXX Also generate a link using which someone can delete this
packages/accounts-password/password_server.js:486:    user.services.password = {srp: options.srp}; // XXX validate verifier
packages/accounts-password/password_server.js:529:// XXX add another argument ("server options") that gets sent to onCreateUser,
packages/accounts-password/password_server.js:538:  // XXX allow an optional callback?
packages/accounts-password/password_tests.js:5:  // XXX note, only one test can do login/logout things at once! for
packages/accounts-password/password_tests.js:396:      // XXX can we get the url from the existing connection somehow
packages/accounts-password/password_tests.js:549:  // XXX would be nice to test Accounts.config({forbidClientAccountCreation: true})
packages/accounts-ui/login_buttons.less:62:  // XXX This gradient hack causes gradients to overflow the rounded corners
packages/accounts-ui/login_buttons.less:274:  // XXX Make the dropdown and dialogs look good without a top-level
packages/accounts-ui/login_buttons.less:337:  // XXX We could use negative margins to compensate for the
packages/accounts-ui/login_buttons.less:412:  /* XXX consider replacing with DXImageTransform */
packages/accounts-ui-unstyled/accounts_ui_tests.js:1:// XXX Most of the testing of accounts-ui is done manually, across
packages/accounts-ui-unstyled/accounts_ui_tests.js:7:// XXX it'd be cool to also test that the right thing happens if options
packages/accounts-ui-unstyled/login_buttons.js:83:// XXX improve these. should this be in accounts-password instead?
packages/accounts-ui-unstyled/login_buttons.js:85:// XXX these will become configurable, and will be validated on
packages/accounts-ui-unstyled/login_buttons_dialogs.js:29:      // XXX show something if there was an error.
packages/accounts-ui-unstyled/login_buttons_dialogs.js:233:// XXX from http://epeli.github.com/underscore.string/lib/underscore.string.js
packages/accounts-ui-unstyled/login_buttons_dropdown.html:138:    <div id="forgot-password-email-label-and-input"> {{! XXX we should probably use loginButtonsFormField }}
packages/accounts-ui-unstyled/login_buttons_dropdown.js:363:    // XXX not sure how we should validate this. but this seems good enough (for now),
packages/accounts-ui-unstyled/login_buttons_session.js:4:  // XXX consider replacing these with one key that has an enum for values.
packages/accounts-ui-unstyled/login_buttons_session.js:30:// XXX This should probably be package scope rather than exported
packages/accounts-ui-unstyled/login_buttons_single.js:38:    // XXX we should allow service packages to set their capitalized name
packages/accounts-ui-unstyled/login_buttons_single.js:44:// XXX from http://epeli.github.com/underscore.string/lib/underscore.string.js
packages/backbone/package.js:6:  // XXX Backbone requires either jquery or zepto
packages/bootstrap/css/bootstrap-override.css:2: * XXX Hack to make bootstrap work when bundled. This needs to be included
packages/bootstrap/package.js:15:  // XXX this makes the paths to the icon sets absolute. it needs
packages/check/match.js:1:// XXX docs
packages/check/match.js:39:  // XXX matchers should know how to describe themselves for errors
packages/check/match.js:55:  // XXX maybe also implement a Match.match which returns more information about
packages/check/match.js:178:    // XXX this error is terrible
packages/check/match.js:199:    // XXX this error is terrible
packages/check/match.js:208:    // XXX what if .name isn't defined
packages/check/match_test.js:226:      // XXX just for FF 3.6, its JSON stringification prefers "\u000a" to "\n"
packages/code-prettify/package.js:3:// XXX this sucks. I would much rather do this processing at
packages/code-prettify/package.js:13:// XXX this code dumps symbols into the global namespace (directly
packages/coffeescript/plugin/compile-coffeescript.js:29:  // XXX relax these assumptions by doing actual JS parsing (eg with jsparse).
packages/coffeescript/plugin/compile-coffeescript.js:137:    // XXX better error handling, once the Plugin interface support it
packages/ctl/ctl.js:54:      // XXX args? env?
packages/ctl/ctl.js:152:        // XXX args? env?
packages/ctl-helper/ctl-helper.js:57:  // XXX this never unsubs...
packages/ctl-helper/ctl-helper.js:104:  // XXX copied to meteor/tools/deploy-galaxy.js
packages/ctl-helper/ctl-helper.js:120:  // XXX copied to meteor/tools/deploy-galaxy.js
packages/deps/deprecated.js:5:// XXX COMPAT WITH 0.5.7
packages/deps/deprecated.js:11:// XXX COMPAT WITH 0.5.4
packages/deps/deprecated.js:15:// XXX COMPAT WITH 0.5.9
packages/deps/package.js:1:// XXX rename package?
packages/dev-bundle-fetcher/dev-bundle:40:# XXX don't hardcode linux :)
packages/dev-bundle-fetcher/dev-bundle:48:# XXX something more secure is needed in production
packages/dev-bundle-fetcher/dev-bundle:59:# XXX probably we can just trust that dependencies from last time are good
packages/domutils/package.js:7:  // XXX
packages/domutils/domutils.js:33:// XXX others? zepto?
packages/domutils/domutils.js:342:// XXX document
packages/ejson/ejson.js:356:  // XXX: Use something better than underscore's isArray
packages/email/email.js:27:      // XXX allow maxConnections to be configured?
packages/email/email.js:127:  // XXX support attachments (once we have a client/server-compatible binary
packages/email/email_tests.js:20:    // XXX brittle if mailcomposer changes header order, etc
packages/facebook/facebook_server.js:67:  // XXX which facebook error causes this behvaior?
packages/facts/facts.js:12:  // XXX make this take effect at runtime too?
packages/facts/facts.js:17:  // XXX Use a minimongo collection instead and hook up an observeChanges
packages/facts/facts.js:44:  // XXX is this safe? could somebody try to connect before Meteor.publish is
packages/facts/facts.js:47:    // XXX Also publish facts-by-package.
packages/force-ssl/force_ssl_server.js:43:    // XXX can we do better here?
packages/handlebars/package.js:18:  // XXX these should be split up into two different slices, not
packages/handlebars/package.js:24:  // XXX This package has been folded into the 'templating' package
packages/handlebars/evaluate-handlebars.js:3:// XXX we probably forgot to implement the #foo case where foo is not
packages/handlebars/evaluate-handlebars.js:6:// XXX there is a ton of stuff that needs testing! like,
packages/handlebars/evaluate-handlebars.js:31:// XXX handlebars' format for arguments is not the clearest, likely
packages/handlebars/evaluate-handlebars.js:357:          // XXX why do we call these templates in docs and partials in code?
packages/handlebars/parse-handlebars.js:144:          // XXX actually should just get the literal string the
packages/htmljs/html.js:20:// XXX find a place to document the contract for *View classes -- they
packages/htmljs/html.js:23:// XXX consider not requiring the contents to be wrapped in an
packages/htmljs/html.js:28:// XXX allow style to be set as an object
packages/http/deprecated.js:2:// XXX COMPAT WITH 0.6.4
packages/http/test_responder.js:18:    // XXX shouldn't be redirecting to a relative URL, per HTTP spec,
packages/http/httpcall_tests.js:256:          // XXX Except now it doesn't!? Not sure what changed, but
packages/jquery-layout/package.js:1:// XXX should probably nudge people toward the CSS Flexible Box Model
packages/jquery/jquery.js:7993: * - sets all responseXXX fields accordingly
packages/jquery/jquery.js:8004:	// Fill responseXXX fields
packages/jsparse/lexer.js:239:// XXXXX UPDATE DOCS
packages/jsparse/lexer.js:267:// XXXX UPDATE DOCS
packages/jsparse/parserlib.js:3:// XXX track line/col position, for errors and maybe token info
packages/less/plugin/compile-less.js:7:  // XXX annoying that this is replicated in .css, .less, and .styl
packages/less/plugin/compile-less.js:9:    // XXX in the future, might be better to emit some kind of a
packages/livedata/client_convenience.js:33:// XXX COMPAT WITH 0.6.4
packages/livedata/client_convenience.js:37:// XXX COMPAT WITH 0.6.4
packages/livedata/crossbar.js:21:  // XXX It should be legal to call fire() from inside a listen()
packages/livedata/livedata_connection.js:600:      // XXX would it be better form to do the binding in stream.on,
packages/livedata/livedata_connection.js:603:        // XXX improve error message (and how we report it)
packages/livedata/livedata_connection.js:909:    // XXX We should also block reconnect quiescence until unnamed subscriptions
packages/livedata/livedata_connection.js:1022:          // XXX memory use will grow without bound if you forget to
packages/livedata/livedata_server.js:493:      // XXX should also reject messages with unknown attributes?
packages/livedata/livedata_server.js:592:  // XXX This mixes accounts concerns (login tokens) into livedata, which is not
packages/livedata/livedata_server.js:802:    // XXX This uses an undocumented interface which only the Mongo cursor
packages/livedata/livedata_server.js:827:      // XXX we should support overlapping cursors, but that would require the
packages/livedata/livedata_server.js:996:  // XXX This mixes accounts concerns (login tokens) into livedata, which is not
packages/livedata/livedata_server.js:1049:        // XXX print stack nicely
packages/livedata/livedata_server.js:1221:        // XXX improve error message (and how we report it)
packages/livedata/livedata_server.js:1240:        // XXX is this correct?
packages/livedata/livedata_connection_tests.js:83:  // XXX: Test that the old signature of passing manager directly instead of in
packages/livedata/livedata_connection_tests.js:1595:// XXX also test:
packages/livedata/livedata_test_service.js:108:    Ledger.remove({}); // XXX can this please be Ledger.remove()?
packages/livedata/livedata_tests.js:1:// XXX should check error codes
packages/livedata/livedata_tests.js:11:        // XXX should check that other keys aren't present.. should
packages/livedata/livedata_tests.js:270:// this is a big hack (and XXX pollutes the global test namespace)
packages/livedata/livedata_tests.js:344:      // XXX should this be extracted as a general helper together with
packages/livedata/livedata_tests.js:689:// XXX some things to test in greater detail:
packages/livedata/package.js:15:  // XXX split this package into multiple packages or multiple slices instead
packages/livedata/server_convenience.js:40:// XXX COMPAT WITH 0.6.4
packages/livedata/stream_client_common.js:1:// XXX from Underscore.String (http://epeli.github.com/underscore.string/)
packages/livedata/stream_client_nodejs.js:39:    // XXX: Make this do something better than make the tests hang if it does not work.
packages/livedata/stream_client_nodejs.js:166:    // XXX: set up a timeout on this.
packages/livedata/stream_client_sockjs.js:192:      // XXX is this ever called?
packages/livedata/sockjs-0.3.4.js:1:// XXX METEOR changes in <METEOR>
packages/livedata/stream_tests.js:141:    // Somewhat contorted but we can't call nested expects (XXX why?)
packages/liverange/liverange.js:90:// XXX Should eventually support LiveRanges where start === end
packages/localstorage/localstorage.js:16:// XXX eliminate dependency on jQuery, detect browsers ourselves
packages/localstorage/package.js:7:  api.use('jquery', 'client'); // XXX only used for browser detection. remove.
packages/logging/logging.js:52:// XXX package
packages/logging/logging.js:61:  // XXX Some levels should be probably be sent to the server
packages/logging/logging.js:67:    // XXX Uses of Meteor._debug should probably be replaced by Log.debug or
packages/logging/logging.js:100:    // XXX probably wants to be / or .js in case no source maps
packages/logging/logging.js:117:  // XXX: if you can write the following in better way, please do it
packages/logging/logging.js:118:  // XXX: what about evals?
packages/logging/logging.js:153:    // XXX allow you to enable 'debug', probably per-package
packages/logging/logging.js:180:  // XXX should probably check fields other than 'time'
packages/meteor/fiber_helpers.js:35:// XXX break this out into an NPM module?
packages/meteor/fiber_helpers.js:36:// XXX could maybe use the npm 'schlock' module instead, which would
packages/meteor/helpers.js:8:// XXX find a better home for these? Ideally they would be _.get,
packages/meteor/package.js:31:  // XXX move into a separate package?
packages/meteor/plugin/basic-file-types.js:6:  // XXX annoying that this is replicated in .css, .less, and .styl
packages/meteor/plugin/basic-file-types.js:8:    // XXX in the future, might be better to emit some kind of a
packages/meteor/setimmediate.js:83:  // XXX use Random.id() here?
packages/meteor/timers.js:14:    // XXX report nicely (or, should we catch it at all?)
packages/meteor/timers.js:40:  // XXX consider making this guarantee ordering of defer'd callbacks, like
packages/minimongo/modify.js:1:// XXX need a strategy for passing the binding of $ into this
packages/minimongo/modify.js:6:// XXX atomicity: if one modification fails, do we roll back the whole
packages/minimongo/modify.js:48:        // XXX mongo doesn't allow mod field names to end in a period,
packages/minimongo/modify.js:120:      // XXX check valid fieldname (no $ at start, no .)
packages/minimongo/modify.js:193:      // XXX should check to make sure integer
packages/minimongo/modify.js:204:      // XXX this allows us to use a $sort whose value is an array, but that's
packages/minimongo/modify.js:295:        // XXX would be much nicer to compile this once, rather than
packages/minimongo/modify.js:300:        // XXX _compileSelector isn't up for the job, because we need
packages/minimongo/modify.js:363:    // XXX mongo only supports $bit on integers, and we only support
packages/minimongo/minimongo_tests.js:12:      // XXX super janky
packages/minimongo/minimongo_tests.js:23:        // XXX super janky
packages/minimongo/minimongo_tests.js:32:        // XXX super janky
packages/minimongo/minimongo_tests.js:66:// XXX test shared structure in all MM entrypoints
packages/minimongo/minimongo_tests.js:269:      // XXX super janky
packages/minimongo/minimongo_tests.js:283:  // XXX blog post about what I learned while writing these tests (weird
packages/minimongo/minimongo_tests.js:913:  // XXX still needs tests:
packages/minimongo/minimongo_tests.js:1463:      // XXX super janky
packages/minimongo/minimongo_tests.js:1679:  // XXX implement this functionality!
packages/minimongo/minimongo_tests.js:1718:  // XXX test case sensitivity of modops
packages/minimongo/minimongo_tests.js:1719:  // XXX for each (most) modop, test that it performs a deep copy
packages/minimongo/minimongo_tests.js:1722:// XXX test update() (selecting docs, multi, upsert..)
packages/minimongo/minimongo_tests.js:2164:    // XXX normalize order, in a way that also works for ObjectIDs?
packages/minimongo/minimongo.js:1:// XXX type checking on selectors (graceful error if malformed)
packages/minimongo/minimongo.js:63:// XXX possibly should support retrieving a subset of fields? and
packages/minimongo/minimongo.js:67:// XXX sort does not yet support subkeys ('a.b') .. fix that!
packages/minimongo/minimongo.js:68:// XXX add one more sort form: "key"
packages/minimongo/minimongo.js:69:// XXX tests
packages/minimongo/minimongo.js:215:  // XXX minimongo should not depend on mongo-livedata!
packages/minimongo/minimongo.js:247:// XXX maybe callbacks should take a list of objects, to expose transactions?
packages/minimongo/minimongo.js:248:// XXX maybe support field limiting (to limit what you're notified on)
packages/minimongo/minimongo.js:263:    // XXX merge this object w/ "this" Cursor.  they're the same.
packages/minimongo/minimongo.js:290:    // XXX wrong place for this?
packages/minimongo/minimongo.js:344:      // XXX in many cases, the same observe will be recreated when
packages/minimongo/minimongo.js:418:// XXX Maybe we need a version of observe that just calls a callback if
packages/minimongo/minimongo.js:443:// XXX enforce rule that field names can't start with '$' or contain '.'
packages/minimongo/minimongo.js:445:// XXX possibly enforce that 'undefined' does not appear (we assume
packages/minimongo/minimongo.js:554:// XXX atomicity: if multi is true, and one modification fails, do
packages/minimongo/minimongo.js:583:      // XXX Should we save the original even if mod ends up being a no-op?
packages/minimongo/minimongo.js:695:// XXX the sorted-query logic below is laughably inefficient. we'll
packages/minimongo/minimongo.js:698:// XXX the logic for observing with a skip or a limit is even more
packages/minimongo/minimongo.js:1030:      // XXX could `before` be a falsy ID?  Technically
packages/minimongo/selector.js:97:// XXX can factor out common logic below
packages/minimongo/selector.js:344:          // XXX: for now, we don't calculate the actual distance between, say,
packages/minimongo/selector.js:378:  // XXX for _all and _in, consider building 'inquery' at compile time..
packages/minimongo/selector.js:404:    // XXX support some/all of these:
packages/minimongo/selector.js:422:    // XXX what is the correct sort position for Javascript code?
packages/minimongo/selector.js:424:    // XXX minkey/maxkey
packages/minimongo/selector.js:463:      // XXX need to implement this if we implement Symbol or integers, or
packages/minimongo/selector.js:526:      throw Error("Sorting not supported on regular expression"); // XXX
packages/minimongo/selector.js:536:      throw Error("Sorting not supported on Javascript code"); // XXX
packages/minimongo/selector.js:632:        // XXX This isn't 100% consistent with MongoDB in 'null' cases:
packages/minimongo/selector.js:634:        // XXX this still isn't right.  consider {a: {$ne: 5, $gt: 6}}. the
packages/mongo-livedata/collection.js:2:// XXX presently there is no way to destroy/clean up a Collection
packages/mongo-livedata/collection.js:12:    // XXX remove before 1.0
packages/mongo-livedata/collection.js:83:      // XXX This interface is pretty janky. reset probably ought to go back to
packages/mongo-livedata/collection.js:104:      // XXX better specify this interface (not in terms of a wire message)?
packages/mongo-livedata/collection.js:120:            // XXX check that replace has no $ ops
packages/mongo-livedata/collection.js:605:  // XXX Think about method namespacing. Maybe methods should be
packages/mongo-livedata/local_collection_driver.js:22:    // XXX is there a way to keep track of a connection's collections without
packages/mongo-livedata/mongo_driver.js:201:      // XXX We don't have to run this on error, right?
packages/mongo-livedata/mongo_driver.js:340:      // XXX In future we could do a real upsert for the mongo id generation
packages/mongo-livedata/mongo_driver.js:495:// XXX MongoConnection.upsert() does not return the id of the inserted document
packages/mongo-livedata/mongo_driver.js:756:  // XXX Allow overlapping callback executions if callback yields.
packages/mongo-livedata/mongo_driver.js:1250:        // XXX maybe set replay flag
packages/mongo-livedata/mongo_driver.js:1267:// XXX We probably need to find a better way to expose this. Right now
packages/mongo-livedata/observe_changes_tests.js:256:      // XXX This timeout isn't perfect but it's pretty hard to prove that an
packages/mongo-livedata/mongo_livedata_tests.js:296:    // XXX we could theoretically make map run its iterations in parallel or
packages/mongo-livedata/mongo_livedata_tests.js:416:      // XXX What if there are multiple observe handles on the LiveResultsSet?
packages/mongo-livedata/mongo_livedata_tests.js:864:    // XXX probably shouldn't use EJSON's private test symbols
packages/mongo-livedata/mongo_livedata_tests.js:1319:            // XXX skip this test for now for LocalCollection; the fact that
packages/mongo-livedata/package.js:1:// XXX We should revisit how we factor MongoDB support into (1) the
packages/mongo-livedata/package.js:50:  // XXX test order dependency: the allow_tests "partial allow" test
packages/mongo-livedata/remote_collection_driver.js:31:  // XXX bad error since it could also be set directly in METEOR_DEPLOY_CONFIG
packages/oauth/oauth_client.js:50:  // XXX what is the 22?
packages/oauth/oauth_server.js:59:// XXX we should periodically clear old entries
packages/oauth/oauth_server.js:117:    // XXX the following is actually wrong. if someone wants to
packages/oauth1/oauth1_binding.js:44:  // XXX make it a param to call, not something stashed on self? It's
packages/random/deprecated.js:4:// XXX COMPAT WITH 0.5.6
packages/random/random.js:126:      // XXX should re-throw any error except insufficient entropy
packages/reactive-dict/reactive-dict.js:1:// XXX come up with a serialization method which canonicalizes object key
packages/reactive-dict/reactive-dict.js:65:    // XXX hardcoded awareness of the 'mongo-livedata' package is not ideal
packages/reactive-dict/reactive-dict.js:75:    // XXX we could allow arrays as long as we recursively check that there
packages/reactive-dict/reactive-dict.js:120:    // XXX sanitize and make sure it's JSONible?
packages/reload/deprecated.js:3:// XXX COMPAT WITH 0.6.4
packages/reload/reload.js:29:// XXX when making this API public, also expose a flag for the app
packages/reload/reload.js:53:  // Meteor._debug("XXX UNSUPPORTED BROWSER");
packages/showdown/package.js:3:// XXX rename to 'markdown' and credit showdown some other way?
packages/spark/patch.js:31:    // XXX inefficient to scan for match for every node!
packages/spark/spark.js:1:// XXX adjust Spark API so that the modules (eg, list, events) could
packages/spark/spark.js:4:// XXX rename isolate to reflect that it is the only root of
packages/spark/spark.js:7:// XXX specify flush order someday (context dependencies? is this in
packages/spark/spark.js:10:// XXX if not on IE6-8, don't do the extra work (traversals for event
packages/spark/spark.js:13:// XXX flag errors if you have two landmarks with the same branch
packages/spark/spark.js:17:// XXX should functions with an htmlFunc use try/finally inside?
packages/spark/spark.js:19:// XXX test that non-Spark.render case works for each function (eg,
packages/spark/spark.js:23:// XXX in landmark-demo, if Template.timer.created throws an exception,
packages/spark/spark.js:56:// XXX document contract for each type of annotation?
packages/spark/spark.js:66:// XXX why do we need, eg, _ANNOTATION_ISOLATE? it has no semantics?
packages/spark/spark.js:361:// XXX expose in the public API, eg as Spark.introduce(), so the user
packages/spark/spark.js:408:    // XXX unify with notifyWatchers. maybe remove _ANNOTATION_WATCH
packages/spark/spark.js:541:// XXX debugging
packages/spark/spark.js:554:  // XXX should we?
packages/spark/spark.js:633:      // XXX check for this sooner; hard to reason about this function
packages/spark/spark.js:653:      // XXX this will destroy all liveranges, including ones
packages/spark/spark.js:895:// XXX duplicated code from minimongo.js.  It's small though.
packages/spark/spark.js:1000:  // XXX This is not the final solution.  1) This code should be unified
packages/spark/spark.js:1143:  // XXX what happens if the user doesn't use the return value, or
packages/spark/spark_tests.js:1:// XXX make sure that when tests use id="..." to trigger patching, "preserve" happens
packages/spark/spark_tests.js:2:// XXX test that events inside constant regions still work after patching
packages/spark/spark_tests.js:3:// XXX test arguments to landmark rendered callback
packages/spark/spark_tests.js:4:// XXX test variable wrapping (eg TR vs THEAD) inside each branch of Spark.list?
packages/spark/spark_tests.js:3133:  // XXX test intermediate unkeyed chunks;
packages/srp/biginteger.js:104:/* XXX METEOR XXX
packages/srp/sha256.js:3:// XXX this should get packaged and moved into the Meteor.crypto
packages/srp/srp.js:120:  // XXX check for missing / bad parameters.
packages/srp/srp.js:232:  // XXX check for missing / bad parameters.
packages/stylus/plugin/compile-stylus.js:7:  // XXX annoying that this is replicated in .css, .less, and .styl
packages/stylus/plugin/compile-stylus.js:9:    // XXX in the future, might be better to emit some kind of a
packages/templating/deftemplate.js:12:// XXX Handlebars hooking is janky and gross
packages/templating/deftemplate.js:89:// XXX forms hooks into this to add "bind"?
packages/templating/deftemplate.js:155:          // XXX Forms needs to run a hook before and after raw_func
packages/templating/deftemplate.js:202:  // XXX hack.. copy all of Handlebars' built in helpers over to
packages/templating/package.js:22:  // XXX would like to do the following only when the first html file
packages/templating/plugin/compile-templates.js:4:  // XXX use archinfo rather than rolling our own
packages/templating/plugin/compile-templates.js:6:    // XXX might be nice to throw an error here, but then we'd have to
packages/templating/plugin/compile-templates.js:13:  // XXX the way we deal with encodings here is sloppy .. should get
packages/templating/plugin/compile-templates.js:45:    // XXX generate a source map
packages/templating/plugin/html_scanner.js:88:        // XXX we don't HTML unescape the attribute value
packages/test-helpers/async_multi.js:113:  // XXX Tests on remote browsers are _slow_. We need a better solution.
packages/templating/templating_tests.js:12:  Session.set("stuff", true); // XXX bad form to use Session in a test?
packages/templating/templating_tests.js:147:  // XXX for debugging
packages/test-helpers/try_all_permutations_test.js:1:// XXX SECTION: Meta tests
packages/test-in-browser/package.js:8:  // XXX this should go away, and there should be a clean interface
packages/test-in-browser/driver.js:435:      // XXX XXX We need something better than stringify!
packages/test-in-console/reporter.js:19:    // XXX Could do a more precise validation here; reports are complex!
packages/tinytest/tinytest.js:108:  // XXX eliminate 'message' and 'not' arguments
packages/tinytest/tinytest.js:115:    // XXX remove cruft specific to liverange
packages/tinytest/tinytest.js:153:      this.fail({type: "instanceOf"}); // XXX what other data?
packages/tinytest/tinytest.js:164:  // XXX nodejs assert.throws can take an expected error, as a class,
packages/tinytest/tinytest.js:265:  // XXX should change to lengthOf to match vowsjs
packages/tinytest/tinytest.js:411:        // XXX you want the "name" and "message" fields on the
packages/tinytest/tinytest.js:416:            message: exception.message, // XXX empty???
packages/tinytest/tinytest.js:417:            stack: exception.stack // XXX portability
packages/tinytest/tinytest_client.js:45:      // XXX better report error
packages/tinytest/tinytest_server.js:30:    // XXX using private API === lame
packages/tinytest/tinytest_server.js:64:      // XXX this doesn't actually notify the client that it has been
packages/twitter/twitter_client.js:4:// @param options {optional}  XXX support options.requestPermissions
packages/underscore/package.js:13:  // XXX Now the *.js handler is intrinsic rather than coming from the
packages/weibo/weibo_client.js:22:  // XXX need to support configuring access_type and scope
packages/webapp/webapp_server.js:21:// XXX This should really be part of the boot script, not the webapp package.
packages/webapp/webapp_server.js:370:      // XXX do we need a "root: clientDir" field here? it used to be here but
packages/webapp/webapp_server.js:474:  // XXX also support galaxy-based lookup
packages/webapp/webapp_server.js:486:  // XXX rename pid argument to bindTo.
scripts/admin/bless-release.js:51:// XXX should we have a smart package for these? 'process'?
scripts/admin/build-tools-tarballs.sh:11:TOOLS_TMPDIR=$(mktemp -d -t meteor-build-release-XXXXXXXX)
scripts/admin/publish-release.sh:26:PUBLISH_TMPDIR=$(mktemp -d -t meteor-publish-release-XXXXXXXX)
scripts/admin/publish-release.sh:41:# XXX when we support third-party packages use that mechanism instead
scripts/admin/publish-release.sh:44:# XXX it would be cool to be able to not listen on any port here. instead
scripts/admin/publish-release/server/publish-release.js:44:// XXX should we have a smart package for these? 'process'?
scripts/admin/upgrade-to-engine/build-fake-release.sh:20:FAKE_TMPDIR=$(mktemp -d -t meteor-build-release-XXXXXXXX)
scripts/admin/upgrade-to-engine/meteor.spec:30:# XXX XXX
scripts/generate-dev-bundle.sh:63:DIR=`mktemp -d -t generate-dev-bundle-XXXXXXXX`
scripts/cli-test.sh:50:TEST_TMPDIR=`mktemp -d -t meteor-cli-test-XXXXXXXX`
scripts/cli-test.sh:143:sleep 2 # XXX XXX lame
scripts/cli-test.sh:154:sleep 10 # XXX XXX lame. have to wait for inner app to die via keepalive!
scripts/cli-test.sh:165:sleep 2 # XXX XXX lame
scripts/cli-test.sh:171:sleep 10 # XXX XXX lame. have to wait for inner app to die via keepalive!
scripts/cli-test.sh:202:sleep 2 # XXX XXX lame
scripts/cli-test.sh:208:sleep 10 # XXX XXX lame. have to wait for inner app to die via keepalive!
scripts/generate-mongo-ssl-binaries.sh:38:    DIR=`mktemp -d -t generate-dev-bundle-XXXXXXXX`
scripts/generate-mongo-ssl-binaries.sh:40:    DIR="$1/`mktemp generate-mongo-ssl-XXXXXXXX`"
scripts/run-tools-tests.sh:12:  mktemp -d -t $1.XXXXXX
tools/builder.js:57:  // XXX cleaner error handling. don't make the humans read an
tools/builder.js:321:        // XXX This is somewhat broken: what if the reason we're in
tools/builder.js:362:        // XXX avoid reading whole file into memory
tools/builder.js:432:    // XXX Alternatively, we could just keep buildPath around, and make
tools/buildmessage.js:53:            // XXX maybe exclude unless specifically requested (eg,
tools/buildmessage.js:63:      // XXX line wrapping would be nice..
tools/buildmessage.js:378:    // XXX this may be the wrong place to do this, but it makes syntax errors in
tools/bundler.js:16://    XXX in the future this will also contain instructions for
tools/bundler.js:41:// XXX in the future one program (which must be a server-type
tools/bundler.js:91:// XXX Subject to change! This will likely change to a shell script
tools/bundler.js:353:    // XXX hack
tools/bundler.js:455:      if (self.minifyCss) // XXX a bit of a hack
tools/bundler.js:616:            // XXX might be nice to throw an error here, but then we'd
tools/bundler.js:620:            // XXX XXX can't we easily do that in the css handler in
tools/bundler.js:678:      // XXX assumes that this merges cleanly
tools/bundler.js:836:        // XXX When we can, drop all of this and just use the SourceMap
tools/bundler.js:924:  // XXX throw an error if the image includes any "app-style" code
tools/bundler.js:931:    // XXX This is mostly duplicated from server/boot.js, as is Npm.require
tools/bundler.js:1005:        // XXX XXX Get the actual source file path -- item.targetPath
tools/bundler.js:1067:        // XXX this code is very similar to saveAsUnipackage.
tools/bundler.js:1079:        // XXX same hack as setTargetPathFromRelPath
tools/bundler.js:1165:      // XXX this is the same code as initFromUnipackage
tools/bundler.js:1255:    // XXX base it on the name of the target
tools/bundler.js:1342:  // XXX should probably use sanitize: true, but that will have
tools/bundler.js:1794:// XXX return an 'errors' key for symmetry with bundle(), rather than
tools/bundler.js:1812:// XXX currently any symbols exported by the plugin will get mapped
tools/deploy-galaxy.js:59:// XXX copied from galaxy/tool/galaxy.js
tools/deploy-galaxy.js:129:// XXX refactor this to separate the "maybe bundle" part from "actually deploy"
tools/deploy-galaxy.js:209:  // XXX copied from galaxy/tool/galaxy.js
tools/deploy.js:226:// XXX shared w/ proxy.js
tools/deploy.js:345:  // XXX we've been using `inFiber` as needed, but I wish we'd instead
tools/deploy.js:355:      // XXX in theory we should JSON parse the result, and use
tools/files.js:42:    // XXX HUGE HACK --
tools/files.js:86:    // XXX once we are done with the transition to engine, this should
tools/files.js:317:          // XXX reads full file into memory.. lame.
tools/files.js:480:  // XXX 'files' is not the ideal place for this but it'll do for now
tools/files.js:572:      // XXX it'd be nice to runInNewContext so that the code can't
tools/files.js:609:          // XXX this duplicates code in computeGlobalReferences
tools/library.js:117:      // XXX support for putting unipackages in a local package dir is
tools/library.js:182:    // XXX revisit this later. What about unicode package names?
tools/library.js:323:  // XXX Hack: If errors occur while generating the list (which could
tools/library.js:376:    // XXX refactor to combine logic with list()? important difference
tools/linker.js:193:    // XXX prettyprint!
tools/linker.js:487://     sourceMap (a string) (XXX)
tools/meteor.js:289:      // XXX this is an inelegant place to put these checks, but it is pretty
tools/meteor.js:358:  // XXX when the pass unexpected argument or unrecognized flags, print
tools/meteor.js:659:      // XXX add app packages to .meteor/packages here for linker upgrade!
tools/meteor.js:664:      // XXX This doesn't include package-specific notices for packages that
tools/meteor.js:822:      // XXX if they pass a file that doesn't end in .tar.gz or .tgz,
tools/meteor.js:825:      // XXX output, to stderr, the name of the file written to (for
tools/meteor.js:828:      // XXX name the root directory in the bundle based on the basename
tools/meteor.js:1046:      // XXX once Galaxy is released, document -f
tools/meteor.js:1149:        // XXX The call to list() here is unfortunate, because list()
tools/meteor.js:1341:  // XXX We really should have a better logging system.
tools/meteor.js:1370:    // XXX fork kexec and make it take an array instead of using shell
tools/project.js:91:    // XXX assume no special regexp characters
tools/packages.js:223:      // XXX hack
tools/packages.js:253:        // XXX This is pretty confusing, especially if you've
tools/packages.js:331:      // XXX for now, these handlers must only generate portable code
tools/packages.js:342:      // XXX we handle encodings in a rather cavalier way and I
tools/packages.js:346:      // XXX addAsset probably wants to be able to set MIME type and
tools/packages.js:349:      // XXX Some handlers process languages that have the concept of
tools/packages.js:359:      // XXX in the future we should give plugins an easy and clean
tools/packages.js:367:        // XXX duplicates _pathForSourceMap() in linker
tools/packages.js:489:      // XXX this assumes this is not overwriting something different
tools/packages.js:573:      // XXX report an error if there is a package called global-imports
tools/packages.js:586:        data: new Buffer(file.source, 'utf8'), // XXX encoding
tools/packages.js:643:    // XXX we used to include our own extensions only if we were the
tools/packages.js:690:          // XXX eventually get rid of backward-compatibility "raw" name
tools/packages.js:691:          // XXX COMPAT WITH 0.6.4
tools/packages.js:744:// XXX This object conflates two things that now seem to be almost
tools/packages.js:876:      // XXX need improvement. The user should get a graceful error
tools/packages.js:938:  // XXX remove?
tools/packages.js:978:        // (XXX we do, if the unipackage was locally built, which is
tools/packages.js:1028:        // XXX assumes that this merges cleanly
tools/packages.js:1175:      // XXX COMPAT WITH 0.6.4
tools/packages.js:1225:        // XXX probably want further type checking
tools/packages.js:1233:        // XXX make npmDependencies be per slice, so that production
tools/packages.js:1253:        // XXX use something like seal or lockdown to have *complete*
tools/packages.js:1495:              // XXX be unicode-friendlier
tools/packages.js:1507:          // XXX COMPAT WITH 0.6.4
tools/packages.js:1516:          // XXX COMPAT WITH 0.6.4
tools/packages.js:1551:    // XXX maybe there should be separate NPM dirs for use vs test?
tools/packages.js:1587:        // XXX add a better API for js-analyze to declare itself here
tools/packages.js:1654:      // XXX this read has a race with the actual reads that are used
tools/packages.js:1844:    // XXX should comprehensively sanitize (eg, typecheck) everything
tools/packages.js:1911:      // XXX should refactor so that we can have plugins of multiple
tools/packages.js:2109:      // XXX Remove this once we can.
tools/run.js:25://XXX: Refactor to not have globals anymore?
tools/run.js:124:      // XXX formatting! text/plain is bad
tools/run.js:267:      // XXX should actually use archinfo.mostSpecificMatch instead of
tools/run.js:277:      // XXX probably not the correct error handling
tools/run.js:286:  // XXX deal with test server logging differently?!
tools/run.js:392:// XXX leave a pidfile and check if we are already running
tools/server/boot.js:104:          // XXX better message
tools/server/boot.js:161:  // XXX hack. we should know the package that contains main.
tools/server/boot.js:182:  // XXX hack, needs a better way to keep alive
tools/tests/test_bundler_assets.js:92:  var meteor = path.join(__dirname, "..", "..", "meteor"); // XXX is this allowed?
tools/tests/test_bundler_npm.js:168:  // XXX this seems wrong!
tools/tests/test_bundler_npm.js:213:  // XXX this seems wrong!
tools/updater.js:41:    // XXX in the future support release channels other than stable
tools/warehouse.js:120:  // XXX make errors prettier
tools/warehouse.js:124:    // XXX in the future support release channels other than stable
tools/warehouse.js:342:    // XXX this sucks. We store all the tarballs in memory. This is huge.
tools/watch.js:53:// XXX Symlinks are currently treated transparently: we treat them as the thing
tools/watch.js:142:      // XXX this doesn't deep-clone the directory, but I think these objects
tools/watch.js:229:      // XXX Does the treatment of symlinks make sense?
tools/watch.js:239:    // XXX if we're on windows, I guess it's possible for files to end with '/'.
tools/watch.js:526:// XXX We should eventually rewrite the whole meteor tools to use yielding fs