{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-bdec3189fd1135ea", "name": "Possibly dead Python function: install", "shortDescription": {"text": "Possibly dead Python function: install"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6c2eea210dfb528b", "name": "Possibly dead Python function: populate_context_post_run", "shortDescription": {"text": "Possibly dead Python function: populate_context_post_run"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3bf5b96af7b1b2c1", "name": "Stray `console.log` in TS/JS \u2014 benchmarks/arc-agi-3/run.ts:79", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 benchmarks/arc-agi-3/run.ts:79"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7a08a9c2a400eb1b", "name": "Stray `console.log` in TS/JS \u2014 benchmarks/arc-agi-3/debug-live.ts:16", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 benchmarks/arc-agi-3/debug-live.ts:16"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-649dceb41306b96c", "name": "Stray `console.log` in TS/JS \u2014 benchmarks/arc-agi-3/src/runner.ts:586", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 benchmarks/arc-agi-3/src/runner.ts:586"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3fee780971c5e96b", "name": "Stray `console.log` in TS/JS \u2014 scripts/sync-cli-version.ts:30", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 scripts/sync-cli-version.ts:30"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a12a8de7fdef31bf", "name": "Stray `console.log` in TS/JS \u2014 packages/cli/tests/json-rpc.test.ts:2903", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/cli/tests/json-rpc.test.ts:2903"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c1c253afd0edeb88", "name": "Stray `console.log` in TS/JS \u2014 packages/cli/tests/safety/sandbox-integration.test.ts:110", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/cli/tests/safety/sandbox-integration.test.ts:110"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f349e668a7a4e336", "name": "Stray `console.log` in TS/JS \u2014 packages/cli/tests/rsi/validate.test.ts:299", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/cli/tests/rsi/validate.test.ts:299"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c24a2758bd00351f", "name": "Stray `console.log` in TS/JS \u2014 packages/cli/tests/tools/code-exec.test.ts:38", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/cli/tests/tools/code-exec.test.ts:38"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-51940080888a5383", "name": "Stray `console.log` in TS/JS \u2014 packages/desktop/tests/conversation-store.test.ts:1557", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/desktop/tests/conversation-store.test.ts:1557"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-82c478fd7145b836", "name": "Stray `console.log` in TS/JS \u2014 packages/desktop/tests/e2e/renderer-contract-runtime.spec.ts:633", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/desktop/tests/e2e/renderer-contract-runtime.spec.ts:633"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a9b526e56256336b", "name": "Stray `console.log` in TS/JS \u2014 packages/desktop/scripts/sync-release-version.ts:43", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/desktop/scripts/sync-release-version.ts:43"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f2b3e29a65f8c2e5", "name": "Stray `console.log` in TS/JS \u2014 packages/desktop/scripts/run-intent-e2e.ts:511", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/desktop/scripts/run-intent-e2e.ts:511"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c0cc147e82c46e61", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 packages/desktop/src/renderer/components/MermaidRenderer.tsx:351", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 packages/desktop/src/renderer/components/MermaidRenderer.tsx:351"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2ce39b875656ffa8", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 packages/desktop/src/renderer/components/ToolCallChip.tsx:441", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 packages/desktop/src/renderer/components/ToolCallChip.tsx:441"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2c143b84acb84f72", "name": "Insecure pattern 'node_child_process' in packages/cli/src/cli.ts:55", "shortDescription": {"text": "Insecure pattern 'node_child_process' in packages/cli/src/cli.ts:55"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-70c59e80c3d74502", "name": "Insecure pattern 'node_child_process' in packages/cli/src/auth/openai-chatgpt.ts:2", "shortDescription": {"text": "Insecure pattern 'node_child_process' in packages/cli/src/auth/openai-chatgpt.ts:2"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-98885b713f8a7ed1", "name": "Insecure pattern 'node_child_process' in packages/cli/src/rsi/validate.ts:10", "shortDescription": {"text": "Insecure pattern 'node_child_process' in packages/cli/src/rsi/validate.ts:10"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-170294a94cad02ab", "name": "Insecure pattern 'node_child_process' in packages/cli/src/tools/worker-diff-approval.ts:1", "shortDescription": {"text": "Insecure pattern 'node_child_process' in packages/cli/src/tools/worker-diff-approval.ts:1"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-47b5f90b6c219139", "name": "Insecure pattern 'node_child_process' in packages/cli/src/tools/bash.ts:2", "shortDescription": {"text": "Insecure pattern 'node_child_process' in packages/cli/src/tools/bash.ts:2"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-aea0456bcbb63336", "name": "Insecure pattern 'node_child_process' in packages/cli/src/tools/worker-runtime.ts:1", "shortDescription": {"text": "Insecure pattern 'node_child_process' in packages/cli/src/tools/worker-runtime.ts:1"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-99f5771b76244ece", "name": "Insecure pattern 'node_child_process' in packages/cli/src/tools/browser-automation.ts:3", "shortDescription": {"text": "Insecure pattern 'node_child_process' in packages/cli/src/tools/browser-automation.ts:3"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9d848756f7599dba", "name": "Insecure pattern 'node_child_process' in packages/cli/src/tools/code-exec.ts:2", "shortDescription": {"text": "Insecure pattern 'node_child_process' in packages/cli/src/tools/code-exec.ts:2"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-889b491eab985dc2", "name": "Insecure pattern 'node_child_process' in packages/cli/src/tools/spawn-agent.ts:1", "shortDescription": {"text": "Insecure pattern 'node_child_process' in packages/cli/src/tools/spawn-agent.ts:1"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-819a4f844c0be1b9", "name": "Insecure pattern 'node_child_process' in packages/desktop/resources/agent-browser/README.md:972", "shortDescription": {"text": "Insecure pattern 'node_child_process' in packages/desktop/resources/agent-browser/README.md:972"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-43264ffc85ba27f5", "name": "Insecure pattern 'node_child_process' in packages/desktop/scripts/run-intent-e2e.ts:1", "shortDescription": {"text": "Insecure pattern 'node_child_process' in packages/desktop/scripts/run-intent-e2e.ts:1"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3627c5344e866cac", "name": "Insecure pattern 'dangerous_innerhtml' in packages/desktop/src/renderer/components/MermaidRenderer.tsx:351", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in packages/desktop/src/renderer/components/MermaidRenderer.tsx:351"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5e39314ec09c2bed", "name": "Insecure pattern 'dangerous_innerhtml' in packages/desktop/src/renderer/components/ToolCallChip.tsx:441", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in packages/desktop/src/renderer/components/ToolCallChip.tsx:441"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8fd3fda3185c7ec4", "name": "Insecure pattern 'node_child_process' in packages/desktop/src/main/cli-process.ts:9", "shortDescription": {"text": "Insecure pattern 'node_child_process' in packages/desktop/src/main/cli-process.ts:9"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-30657b3a70c610bd", "name": "Insecure pattern 'node_child_process' in packages/desktop/src/main/automation-browser.ts:1", "shortDescription": {"text": "Insecure pattern 'node_child_process' in packages/desktop/src/main/automation-browser.ts:1"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-46c644c6227e4d4a", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1838a141491ce38c", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-461256c4f9cfd310", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-347b199f557032b0", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6ba9bfab5f283202", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cb639d9a10a47b23", "name": "package.json defines install-time lifecycle scripts", "shortDescription": {"text": "package.json defines install-time lifecycle scripts"}, "fullDescription": {"text": "preinstall/install/postinstall/prepare scripts execute during dependency installation. Review them carefully for network calls, obfuscation, shell execution, or credential access."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b5b0ad7af78ecbaa", "name": "package.json defines install-time lifecycle scripts", "shortDescription": {"text": "package.json defines install-time lifecycle scripts"}, "fullDescription": {"text": "preinstall/install/postinstall/prepare scripts execute during dependency installation. Review them carefully for network calls, obfuscation, shell execution, or credential access."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e8c0dc5066cb96c3", "name": "Very large file: packages/cli/tests/json-rpc.test.ts (4352 lines)", "shortDescription": {"text": "Very large file: packages/cli/tests/json-rpc.test.ts (4352 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f921f30a3abc274e", "name": "Very large file: packages/cli/tests/rsi/crystallize.test.ts (1501 lines)", "shortDescription": {"text": "Very large file: packages/cli/tests/rsi/crystallize.test.ts (1501 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f9a96342bfa6b6a9", "name": "Very large file: packages/cli/tests/tools/spawn-agent.test.ts (1952 lines)", "shortDescription": {"text": "Very large file: packages/cli/tests/tools/spawn-agent.test.ts (1952 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c64b191bfc88ad4d", "name": "Very large file: packages/cli/src/agent.ts (2604 lines)", "shortDescription": {"text": "Very large file: packages/cli/src/agent.ts (2604 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5459fa60daba55f8", "name": "Very large file: packages/cli/src/json-rpc/handlers.ts (2481 lines)", "shortDescription": {"text": "Very large file: packages/cli/src/json-rpc/handlers.ts (2481 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8fabd8baa8320177", "name": "Very large file: packages/desktop/tests/conversation-store.test.ts (1966 lines)", "shortDescription": {"text": "Very large file: packages/desktop/tests/conversation-store.test.ts (1966 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6a18c14390dcdd67", "name": "Very large file: packages/desktop/tests/e2e/renderer-contract.spec.ts (1446 lines)", "shortDescription": {"text": "Very large file: packages/desktop/tests/e2e/renderer-contract.spec.ts (1446 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e52d66f12f5438d0", "name": "Very large file: packages/desktop/tests/e2e/renderer-contract-runtime.spec.ts (1448 lines)", "shortDescription": {"text": "Very large file: packages/desktop/tests/e2e/renderer-contract-runtime.spec.ts (1448 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cb9548ab9ef7a45a", "name": "Very large file: packages/desktop/src/renderer/stores/conversationStore.ts (2491 lines)", "shortDescription": {"text": "Very large file: packages/desktop/src/renderer/stores/conversationStore.ts (2491 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-af7a85950da84bb2", "name": "Very large file: packages/desktop/src/shared/protocol.ts (1748 lines)", "shortDescription": {"text": "Very large file: packages/desktop/src/shared/protocol.ts (1748 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2699d5f16ae11282", "name": "Node manifest has dependencies but no lockfile: packages/shared/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/shared/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8c2e3196a4ef0cdd", "name": "Node manifest has dependencies but no lockfile: packages/cli/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/cli/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 21 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 30 placeholder/mock markers across 17 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-749d4bc1bd66df5f", "name": "Agent instructions exist but release-hardening basics are missing", "shortDescription": {"text": "Agent instructions exist but release-hardening basics are missing"}, "fullDescription": {"text": "AI-coder instruction files were found, but the repo is missing lockfile. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-0742048f785ff306", "name": "Agent authority lacks a verifier contract: packages/desktop/resources/agent-browser/skill-data/vercel-sandbox/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: packages/desktop/resources/agent-browser/skill-data/vercel-sandbox/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7159293d4fc91acb", "name": "Agent authority lacks a verifier contract: packages/desktop/resources/agent-browser/skill-data/slack/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: packages/desktop/resources/agent-browser/skill-data/slack/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9ae49d7bdc375c01", "name": "Agent authority lacks a verifier contract: packages/desktop/resources/agent-browser/skill-data/agentcore/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: packages/desktop/resources/agent-browser/skill-data/agentcore/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-06db21149929bd06", "name": "Agent authority lacks a verifier contract: packages/desktop/resources/skills/builtin/agent-browser/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: packages/desktop/resources/skills/builtin/agent-browser/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3ffaca809d603624", "name": "Agent authority lacks a verifier contract: .claude/skills/ai-sdk/references/devtools.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/ai-sdk/references/devtools.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b0a9ed53c3d6bec1", "name": "Agent authority lacks a verifier contract: .claude/skills/ai-sdk/references/ai-gateway.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/ai-sdk/references/ai-gateway.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-06a72e90499e360e", "name": "Agent authority lacks a verifier contract: .claude/skills/meta-thinking/eval_queries.json", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/meta-thinking/eval_queries.json"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2c914a756da1161a", "name": "Commented-code block (5 lines) in benchmarks/arc-agi-3/tests/runner.test.ts:493", "shortDescription": {"text": "Commented-code block (5 lines) in benchmarks/arc-agi-3/tests/runner.test.ts:493"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-e45eff1d1b61c7d5", "name": "Commented-code block (5 lines) in benchmarks/arc-agi-3/src/server.ts:101", "shortDescription": {"text": "Commented-code block (5 lines) in benchmarks/arc-agi-3/src/server.ts:101"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-d74a302a24571435", "name": "Commented-code block (5 lines) in packages/cli/tests/root-dev.test.ts:61", "shortDescription": {"text": "Commented-code block (5 lines) in packages/cli/tests/root-dev.test.ts:61"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-4f311927226b29c8", "name": "Commented-code block (6 lines) in packages/cli/tests/integration/agent-skills.test.ts:336", "shortDescription": {"text": "Commented-code block (6 lines) in packages/cli/tests/integration/agent-skills.test.ts:336"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-9d02e19f2b9d3d5b", "name": "Commented-code block (6 lines) in packages/cli/tests/rsi/orchestrator.test.ts:699", "shortDescription": {"text": "Commented-code block (6 lines) in packages/cli/tests/rsi/orchestrator.test.ts:699"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-711be9f2ed5c7f7a", "name": "Commented-code block (5 lines) in packages/cli/tests/rsi/crystallize.test.ts:641", "shortDescription": {"text": "Commented-code block (5 lines) in packages/cli/tests/rsi/crystallize.test.ts:641"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-da5b82c23d2bc343", "name": "Commented-code block (6 lines) in packages/cli/tests/tools/skill-manager.test.ts:433", "shortDescription": {"text": "Commented-code block (6 lines) in packages/cli/tests/tools/skill-manager.test.ts:433"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-fc1b7a4266bcee7e", "name": "Commented-code block (6 lines) in packages/cli/tests/tools/code-exec.test.ts:215", "shortDescription": {"text": "Commented-code block (6 lines) in packages/cli/tests/tools/code-exec.test.ts:215"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-5eb4e2d26df0e105", "name": "Commented-code block (5 lines) in packages/cli/src/safety/policy.ts:65", "shortDescription": {"text": "Commented-code block (5 lines) in packages/cli/src/safety/policy.ts:65"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-04afdc79e599c9b3", "name": "`fetch()` without try/.catch or AbortSignal \u2014 packages/cli/src/auth/openai-chatgpt.ts:200", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/cli/src/auth/openai-chatgpt.ts:200"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4115f9938d954ef9", "name": "Commented-code block (6 lines) in packages/cli/src/rsi/orchestrator.ts:273", "shortDescription": {"text": "Commented-code block (6 lines) in packages/cli/src/rsi/orchestrator.ts:273"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-31c4b15faeb72eab", "name": "Commented-code block (5 lines) in packages/cli/src/tools/bash.ts:364", "shortDescription": {"text": "Commented-code block (5 lines) in packages/cli/src/tools/bash.ts:364"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-56ac43e68ec214cd", "name": "`fetch()` without try/.catch or AbortSignal \u2014 packages/cli/src/tools/web-search.ts:94", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/cli/src/tools/web-search.ts:94"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-71b22267b22c07ea", "name": "Commented-code block (6 lines) in packages/cli/src/json-rpc/server.ts:169", "shortDescription": {"text": "Commented-code block (6 lines) in packages/cli/src/json-rpc/server.ts:169"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-407ccff0fd39bfee", "name": "Commented-code block (6 lines) in packages/cli/src/json-rpc/handlers.ts:558", "shortDescription": {"text": "Commented-code block (6 lines) in packages/cli/src/json-rpc/handlers.ts:558"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-98743f9b8fdc3957", "name": "`fetch()` without try/.catch or AbortSignal \u2014 packages/cli/src/llm/provider.ts:170", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/cli/src/llm/provider.ts:170"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-117215043bef9200", "name": "Commented-code block (7 lines) in packages/desktop/electron.vite.config.ts:33", "shortDescription": {"text": "Commented-code block (7 lines) in packages/desktop/electron.vite.config.ts:33"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-5765de462c36b074", "name": "Commented-code block (7 lines) in packages/desktop/playwright.config.ts:7", "shortDescription": {"text": "Commented-code block (7 lines) in packages/desktop/playwright.config.ts:7"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-04536d83c7518fac", "name": "Commented-code block (5 lines) in packages/desktop/tests/e2e/main-process.spec.ts:170", "shortDescription": {"text": "Commented-code block (5 lines) in packages/desktop/tests/e2e/main-process.spec.ts:170"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-29ec33a7fc18c337", "name": "Commented-code block (7 lines) in packages/desktop/tests/e2e/renderer-contract.spec.ts:1017", "shortDescription": {"text": "Commented-code block (7 lines) in packages/desktop/tests/e2e/renderer-contract.spec.ts:1017"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-7c35dd874ce8f925", "name": "Commented-code block (9 lines) in packages/desktop/tests/e2e/mermaid-lightbox.spec.ts:12", "shortDescription": {"text": "Commented-code block (9 lines) in packages/desktop/tests/e2e/mermaid-lightbox.spec.ts:12"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-a36fcb8329ad97a1", "name": "Commented-code block (6 lines) in packages/desktop/tests/e2e/artifact-panel.spec.ts:136", "shortDescription": {"text": "Commented-code block (6 lines) in packages/desktop/tests/e2e/artifact-panel.spec.ts:136"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-2f5656545682d44f", "name": "Commented-code block (6 lines) in packages/desktop/tests/e2e/verifier-verdict.spec.ts:127", "shortDescription": {"text": "Commented-code block (6 lines) in packages/desktop/tests/e2e/verifier-verdict.spec.ts:127"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-05237c308e046fc4", "name": "Commented-code block (5 lines) in packages/desktop/tests/e2e/real-flows.spec.ts:119", "shortDescription": {"text": "Commented-code block (5 lines) in packages/desktop/tests/e2e/real-flows.spec.ts:119"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-ce0bfd6e6d883565", "name": "Commented-code block (9 lines) in packages/desktop/src/renderer/stores/conversationStore.ts:1074", "shortDescription": {"text": "Commented-code block (9 lines) in packages/desktop/src/renderer/stores/conversationStore.ts:1074"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-52bfa73895eefe6b", "name": "Commented-code block (6 lines) in packages/desktop/src/renderer/components/VerifierVerdictChip.tsx:10", "shortDescription": {"text": "Commented-code block (6 lines) in packages/desktop/src/renderer/components/VerifierVerdictChip.tsx:10"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-8bed4bf87bb24bf6", "name": "Commented-code block (6 lines) in packages/desktop/src/renderer/components/Sidebar.tsx:225", "shortDescription": {"text": "Commented-code block (6 lines) in packages/desktop/src/renderer/components/Sidebar.tsx:225"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-122aececcee56a2b", "name": "Commented-code block (5 lines) in packages/desktop/src/main/cli-process.ts:68", "shortDescription": {"text": "Commented-code block (5 lines) in packages/desktop/src/main/cli-process.ts:68"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-8f4e98cb9eff45fc", "name": "Commented-code block (10 lines) in packages/desktop/src/main/preload.ts:164", "shortDescription": {"text": "Commented-code block (10 lines) in packages/desktop/src/main/preload.ts:164"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-51bbe863da791ba1", "name": "Commented-code block (11 lines) in packages/desktop/src/main/index.ts:210", "shortDescription": {"text": "Commented-code block (11 lines) in packages/desktop/src/main/index.ts:210"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-0c95dbb7b69516cf", "name": "Commented-code block (5 lines) in packages/desktop/src/main/ipc-handlers.ts:229", "shortDescription": {"text": "Commented-code block (5 lines) in packages/desktop/src/main/ipc-handlers.ts:229"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-4fa3b13cc25cc1f2", "name": "Commented-code block (9 lines) in packages/desktop/src/main/window.ts:101", "shortDescription": {"text": "Commented-code block (9 lines) in packages/desktop/src/main/window.ts:101"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/19194"}, "properties": {"repository": "secondorderai/ouroboros", "repoUrl": "https://github.com/secondorderai/ouroboros", "branch": "main"}, "results": [{"ruleId": "scanner-bdec3189fd1135ea", "level": "note", "message": {"text": "Possibly dead Python function: install"}, "properties": {"repobilityId": "4473b31203d31020", "scanner": "scanner-primary", "fingerprint": "bdec3189fd1135ea", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "benchmarks/terminal-bench/ouroboros_tbench_agent.py:45"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6c2eea210dfb528b", "level": "note", "message": {"text": "Possibly dead Python function: populate_context_post_run"}, "properties": {"repobilityId": "d31042df0a700755", "scanner": "scanner-primary", "fingerprint": "6c2eea210dfb528b", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "benchmarks/terminal-bench/ouroboros_tbench_agent.py:155"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3bf5b96af7b1b2c1", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 benchmarks/arc-agi-3/run.ts:79"}, "properties": {"repobilityId": "a373db3756e377b9", "scanner": "scanner-primary", "fingerprint": "3bf5b96af7b1b2c1", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-7a08a9c2a400eb1b", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 benchmarks/arc-agi-3/debug-live.ts:16"}, "properties": {"repobilityId": "6ccc8be3389b65ed", "scanner": "scanner-primary", "fingerprint": "7a08a9c2a400eb1b", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-649dceb41306b96c", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 benchmarks/arc-agi-3/src/runner.ts:586"}, "properties": {"repobilityId": "0f39b07c4427def0", "scanner": "scanner-primary", "fingerprint": "649dceb41306b96c", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-3fee780971c5e96b", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 scripts/sync-cli-version.ts:30"}, "properties": {"repobilityId": "7c3372f4d1179d82", "scanner": "scanner-primary", "fingerprint": "3fee780971c5e96b", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-a12a8de7fdef31bf", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/cli/tests/json-rpc.test.ts:2903"}, "properties": {"repobilityId": "1fa8aee4142e60e2", "scanner": "scanner-primary", "fingerprint": "a12a8de7fdef31bf", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-c1c253afd0edeb88", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/cli/tests/safety/sandbox-integration.test.ts:110"}, "properties": {"repobilityId": "557852f0b5d63fbf", "scanner": "scanner-primary", "fingerprint": "c1c253afd0edeb88", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-f349e668a7a4e336", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/cli/tests/rsi/validate.test.ts:299"}, "properties": {"repobilityId": "20737f52398cb236", "scanner": "scanner-primary", "fingerprint": "f349e668a7a4e336", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-c24a2758bd00351f", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/cli/tests/tools/code-exec.test.ts:38"}, "properties": {"repobilityId": "39ebb36b068acb26", "scanner": "scanner-primary", "fingerprint": "c24a2758bd00351f", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-51940080888a5383", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/desktop/tests/conversation-store.test.ts:1557"}, "properties": {"repobilityId": "39e546ce47c85026", "scanner": "scanner-primary", "fingerprint": "51940080888a5383", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-82c478fd7145b836", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/desktop/tests/e2e/renderer-contract-runtime.spec.ts:633"}, "properties": {"repobilityId": "07721beabe8c8fbe", "scanner": "scanner-primary", "fingerprint": "82c478fd7145b836", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-a9b526e56256336b", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/desktop/scripts/sync-release-version.ts:43"}, "properties": {"repobilityId": "fce06c46168640d7", "scanner": "scanner-primary", "fingerprint": "a9b526e56256336b", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-f2b3e29a65f8c2e5", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/desktop/scripts/run-intent-e2e.ts:511"}, "properties": {"repobilityId": "b7dc9eb6a5991555", "scanner": "scanner-primary", "fingerprint": "f2b3e29a65f8c2e5", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-c0cc147e82c46e61", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 packages/desktop/src/renderer/components/MermaidRenderer.tsx:351"}, "properties": {"repobilityId": "be2fd4e262013133", "scanner": "scanner-primary", "fingerprint": "c0cc147e82c46e61", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-2ce39b875656ffa8", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 packages/desktop/src/renderer/components/ToolCallChip.tsx:441"}, "properties": {"repobilityId": "e93871ff44cd1018", "scanner": "scanner-primary", "fingerprint": "2ce39b875656ffa8", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-2c143b84acb84f72", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in packages/cli/src/cli.ts:55"}, "properties": {"repobilityId": "145c6a0827946217", "scanner": "scanner-primary", "fingerprint": "2c143b84acb84f72", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/cli/src/cli.ts"}, "region": {"startLine": 55}}}]}, {"ruleId": "scanner-70c59e80c3d74502", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in packages/cli/src/auth/openai-chatgpt.ts:2"}, "properties": {"repobilityId": "69129cf32345a69c", "scanner": "scanner-primary", "fingerprint": "70c59e80c3d74502", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/cli/src/auth/openai-chatgpt.ts"}, "region": {"startLine": 2}}}]}, {"ruleId": "scanner-98885b713f8a7ed1", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in packages/cli/src/rsi/validate.ts:10"}, "properties": {"repobilityId": "facb18e5cf2015e7", "scanner": "scanner-primary", "fingerprint": "98885b713f8a7ed1", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/cli/src/rsi/validate.ts"}, "region": {"startLine": 10}}}]}, {"ruleId": "scanner-170294a94cad02ab", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in packages/cli/src/tools/worker-diff-approval.ts:1"}, "properties": {"repobilityId": "ff141517a460f91e", "scanner": "scanner-primary", "fingerprint": "170294a94cad02ab", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/cli/src/tools/worker-diff-approval.ts"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-47b5f90b6c219139", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in packages/cli/src/tools/bash.ts:2"}, "properties": {"repobilityId": "48729958b60d4b2a", "scanner": "scanner-primary", "fingerprint": "47b5f90b6c219139", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/cli/src/tools/bash.ts"}, "region": {"startLine": 2}}}]}, {"ruleId": "scanner-aea0456bcbb63336", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in packages/cli/src/tools/worker-runtime.ts:1"}, "properties": {"repobilityId": "f4c797a24ffcc82e", "scanner": "scanner-primary", "fingerprint": "aea0456bcbb63336", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/cli/src/tools/worker-runtime.ts"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-99f5771b76244ece", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in packages/cli/src/tools/browser-automation.ts:3"}, "properties": {"repobilityId": "d5f34b102834ce62", "scanner": "scanner-primary", "fingerprint": "99f5771b76244ece", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/cli/src/tools/browser-automation.ts"}, "region": {"startLine": 3}}}]}, {"ruleId": "scanner-9d848756f7599dba", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in packages/cli/src/tools/code-exec.ts:2"}, "properties": {"repobilityId": "130d5eedf90a5414", "scanner": "scanner-primary", "fingerprint": "9d848756f7599dba", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/cli/src/tools/code-exec.ts"}, "region": {"startLine": 2}}}]}, {"ruleId": "scanner-889b491eab985dc2", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in packages/cli/src/tools/spawn-agent.ts:1"}, "properties": {"repobilityId": "edb9f4c9cb7f1a1a", "scanner": "scanner-primary", "fingerprint": "889b491eab985dc2", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/cli/src/tools/spawn-agent.ts"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-819a4f844c0be1b9", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in packages/desktop/resources/agent-browser/README.md:972"}, "properties": {"repobilityId": "f7a633650b31ac09", "scanner": "scanner-primary", "fingerprint": "819a4f844c0be1b9", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/desktop/resources/agent-browser/README.md"}, "region": {"startLine": 972}}}]}, {"ruleId": "scanner-43264ffc85ba27f5", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in packages/desktop/scripts/run-intent-e2e.ts:1"}, "properties": {"repobilityId": "a2a8573fa2c8f102", "scanner": "scanner-primary", "fingerprint": "43264ffc85ba27f5", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/desktop/scripts/run-intent-e2e.ts"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3627c5344e866cac", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in packages/desktop/src/renderer/components/MermaidRenderer.tsx:351"}, "properties": {"repobilityId": "97e4b3d88088231d", "scanner": "scanner-primary", "fingerprint": "3627c5344e866cac", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/desktop/src/renderer/components/MermaidRenderer.tsx"}, "region": {"startLine": 351}}}]}, {"ruleId": "scanner-5e39314ec09c2bed", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in packages/desktop/src/renderer/components/ToolCallChip.tsx:441"}, "properties": {"repobilityId": "6348aa38f447c6b7", "scanner": "scanner-primary", "fingerprint": "5e39314ec09c2bed", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/desktop/src/renderer/components/ToolCallChip.tsx"}, "region": {"startLine": 441}}}]}, {"ruleId": "scanner-8fd3fda3185c7ec4", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in packages/desktop/src/main/cli-process.ts:9"}, "properties": {"repobilityId": "5413fab3511de8b1", "scanner": "scanner-primary", "fingerprint": "8fd3fda3185c7ec4", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/desktop/src/main/cli-process.ts"}, "region": {"startLine": 9}}}]}, {"ruleId": "scanner-30657b3a70c610bd", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in packages/desktop/src/main/automation-browser.ts:1"}, "properties": {"repobilityId": "cd713cf6c7513eeb", "scanner": "scanner-primary", "fingerprint": "30657b3a70c610bd", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/desktop/src/main/automation-browser.ts"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "04f6c832d67a7838", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 18}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "cedbda24771e393e", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 21}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f0c3d4499b6cd885", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 66}}}]}, {"ruleId": "scanner-1838a141491ce38c", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "b8fd4f5048f96576", "scanner": "scanner-primary", "fingerprint": "1838a141491ce38c", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-461256c4f9cfd310", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "38e9cf342251a874", "scanner": "scanner-primary", "fingerprint": "461256c4f9cfd310", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release-cli.yml"}, "region": {"startLine": 18}}}]}, {"ruleId": "scanner-461256c4f9cfd310", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "bd91f07777e3a808", "scanner": "scanner-primary", "fingerprint": "461256c4f9cfd310", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release-cli.yml"}, "region": {"startLine": 21}}}]}, {"ruleId": "scanner-461256c4f9cfd310", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "21ade9592d2a6ac1", "scanner": "scanner-primary", "fingerprint": "461256c4f9cfd310", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release-cli.yml"}, "region": {"startLine": 44}}}]}, {"ruleId": "scanner-461256c4f9cfd310", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "38e9cf342251a874", "scanner": "scanner-primary", "fingerprint": "461256c4f9cfd310", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release-cli.yml"}, "region": {"startLine": 60}}}]}, {"ruleId": "scanner-461256c4f9cfd310", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "bd91f07777e3a808", "scanner": "scanner-primary", "fingerprint": "461256c4f9cfd310", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release-cli.yml"}, "region": {"startLine": 63}}}]}, {"ruleId": "scanner-461256c4f9cfd310", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "21ade9592d2a6ac1", "scanner": "scanner-primary", "fingerprint": "461256c4f9cfd310", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release-cli.yml"}, "region": {"startLine": 93}}}]}, {"ruleId": "scanner-347b199f557032b0", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "0010d41fe98dc5ef", "scanner": "scanner-primary", "fingerprint": "347b199f557032b0", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release-cli.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6ba9bfab5f283202", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "8811572ae4b8ca5d", "scanner": "scanner-primary", "fingerprint": "6ba9bfab5f283202", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/build.yml"}, "region": {"startLine": 19}}}]}, {"ruleId": "scanner-6ba9bfab5f283202", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "fbc2ae0568568dcc", "scanner": "scanner-primary", "fingerprint": "6ba9bfab5f283202", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/build.yml"}, "region": {"startLine": 22}}}]}, {"ruleId": "scanner-6ba9bfab5f283202", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "b7d0896f775b62a6", "scanner": "scanner-primary", "fingerprint": "6ba9bfab5f283202", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/build.yml"}, "region": {"startLine": 68}}}]}, {"ruleId": "scanner-6ba9bfab5f283202", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "8811572ae4b8ca5d", "scanner": "scanner-primary", "fingerprint": "6ba9bfab5f283202", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/build.yml"}, "region": {"startLine": 81}}}]}, {"ruleId": "scanner-6ba9bfab5f283202", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "fbc2ae0568568dcc", "scanner": "scanner-primary", "fingerprint": "6ba9bfab5f283202", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/build.yml"}, "region": {"startLine": 84}}}]}, {"ruleId": "scanner-cb639d9a10a47b23", "level": "note", "message": {"text": "package.json defines install-time lifecycle scripts"}, "properties": {"repobilityId": "b86179956da3a4a8", "scanner": "scanner-primary", "fingerprint": "cb639d9a10a47b23", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "npm", "install-scripts"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b5b0ad7af78ecbaa", "level": "note", "message": {"text": "package.json defines install-time lifecycle scripts"}, "properties": {"repobilityId": "fbb60162b999a92f", "scanner": "scanner-primary", "fingerprint": "b5b0ad7af78ecbaa", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "npm", "install-scripts"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/desktop/resources/agent-browser/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e8c0dc5066cb96c3", "level": "note", "message": {"text": "Very large file: packages/cli/tests/json-rpc.test.ts (4352 lines)"}, "properties": {"repobilityId": "cbf4393bcbf46a85", "scanner": "scanner-primary", "fingerprint": "e8c0dc5066cb96c3", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-f921f30a3abc274e", "level": "note", "message": {"text": "Very large file: packages/cli/tests/rsi/crystallize.test.ts (1501 lines)"}, "properties": {"repobilityId": "d413e0609f45b121", "scanner": "scanner-primary", "fingerprint": "f921f30a3abc274e", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-f9a96342bfa6b6a9", "level": "note", "message": {"text": "Very large file: packages/cli/tests/tools/spawn-agent.test.ts (1952 lines)"}, "properties": {"repobilityId": "ed59fa2f75c50777", "scanner": "scanner-primary", "fingerprint": "f9a96342bfa6b6a9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-c64b191bfc88ad4d", "level": "note", "message": {"text": "Very large file: packages/cli/src/agent.ts (2604 lines)"}, "properties": {"repobilityId": "3175af733c890bfb", "scanner": "scanner-primary", "fingerprint": "c64b191bfc88ad4d", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-5459fa60daba55f8", "level": "note", "message": {"text": "Very large file: packages/cli/src/json-rpc/handlers.ts (2481 lines)"}, "properties": {"repobilityId": "7ea762381f84cd4c", "scanner": "scanner-primary", "fingerprint": "5459fa60daba55f8", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-8fabd8baa8320177", "level": "note", "message": {"text": "Very large file: packages/desktop/tests/conversation-store.test.ts (1966 lines)"}, "properties": {"repobilityId": "7fcc8b9d7359ad1e", "scanner": "scanner-primary", "fingerprint": "8fabd8baa8320177", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-6a18c14390dcdd67", "level": "note", "message": {"text": "Very large file: packages/desktop/tests/e2e/renderer-contract.spec.ts (1446 lines)"}, "properties": {"repobilityId": "4f4008b362f86181", "scanner": "scanner-primary", "fingerprint": "6a18c14390dcdd67", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-e52d66f12f5438d0", "level": "note", "message": {"text": "Very large file: packages/desktop/tests/e2e/renderer-contract-runtime.spec.ts (1448 lines)"}, "properties": {"repobilityId": "9040b288ba9173a8", "scanner": "scanner-primary", "fingerprint": "e52d66f12f5438d0", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-cb9548ab9ef7a45a", "level": "note", "message": {"text": "Very large file: packages/desktop/src/renderer/stores/conversationStore.ts (2491 lines)"}, "properties": {"repobilityId": "c92e2bd00136cb6d", "scanner": "scanner-primary", "fingerprint": "cb9548ab9ef7a45a", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-af7a85950da84bb2", "level": "note", "message": {"text": "Very large file: packages/desktop/src/shared/protocol.ts (1748 lines)"}, "properties": {"repobilityId": "ea78470cebe69a71", "scanner": "scanner-primary", "fingerprint": "af7a85950da84bb2", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-2699d5f16ae11282", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/shared/package.json"}, "properties": {"repobilityId": "37ac218a4ef9b430", "scanner": "scanner-primary", "fingerprint": "2699d5f16ae11282", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/shared/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8c2e3196a4ef0cdd", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/cli/package.json"}, "properties": {"repobilityId": "2faf23490612d7a6", "scanner": "scanner-primary", "fingerprint": "8c2e3196a4ef0cdd", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/cli/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "a2700739bef7ce0f", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "f8dd3d2617f43d4e", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "07eabdd01bf88578", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-749d4bc1bd66df5f", "level": "warning", "message": {"text": "Agent instructions exist but release-hardening basics are missing"}, "properties": {"repobilityId": "69e4cb388e327d30", "scanner": "scanner-primary", "fingerprint": "749d4bc1bd66df5f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "428aef5efec6d097", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "fb24f29247b22486", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-0742048f785ff306", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: packages/desktop/resources/agent-browser/skill-data/vercel-sandbox/SKILL.md"}, "properties": {"repobilityId": "f2b65ed06c44ea76", "scanner": "scanner-primary", "fingerprint": "0742048f785ff306", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/desktop/resources/agent-browser/skill-data/vercel-sandbox/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7159293d4fc91acb", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: packages/desktop/resources/agent-browser/skill-data/slack/SKILL.md"}, "properties": {"repobilityId": "cefae728db99c08f", "scanner": "scanner-primary", "fingerprint": "7159293d4fc91acb", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/desktop/resources/agent-browser/skill-data/slack/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9ae49d7bdc375c01", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: packages/desktop/resources/agent-browser/skill-data/agentcore/SKILL.md"}, "properties": {"repobilityId": "480415b4b122c71f", "scanner": "scanner-primary", "fingerprint": "9ae49d7bdc375c01", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/desktop/resources/agent-browser/skill-data/agentcore/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-06db21149929bd06", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: packages/desktop/resources/skills/builtin/agent-browser/SKILL.md"}, "properties": {"repobilityId": "d6eda5f78a7bc8dc", "scanner": "scanner-primary", "fingerprint": "06db21149929bd06", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/desktop/resources/skills/builtin/agent-browser/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3ffaca809d603624", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/ai-sdk/references/devtools.md"}, "properties": {"repobilityId": "19a748b20bd537e4", "scanner": "scanner-primary", "fingerprint": "3ffaca809d603624", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/ai-sdk/references/devtools.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b0a9ed53c3d6bec1", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/ai-sdk/references/ai-gateway.md"}, "properties": {"repobilityId": "7d8c9f2955c998a9", "scanner": "scanner-primary", "fingerprint": "b0a9ed53c3d6bec1", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/ai-sdk/references/ai-gateway.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-06a72e90499e360e", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/meta-thinking/eval_queries.json"}, "properties": {"repobilityId": "3b9c884b9b0f6143", "scanner": "scanner-primary", "fingerprint": "06a72e90499e360e", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/meta-thinking/eval_queries.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2c914a756da1161a", "level": "none", "message": {"text": "Commented-code block (5 lines) in benchmarks/arc-agi-3/tests/runner.test.ts:493"}, "properties": {"repobilityId": "55d5cf17a20e62b6", "scanner": "scanner-primary", "fingerprint": "2c914a756da1161a", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-e45eff1d1b61c7d5", "level": "none", "message": {"text": "Commented-code block (5 lines) in benchmarks/arc-agi-3/src/server.ts:101"}, "properties": {"repobilityId": "d36058d40f8766e8", "scanner": "scanner-primary", "fingerprint": "e45eff1d1b61c7d5", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-d74a302a24571435", "level": "none", "message": {"text": "Commented-code block (5 lines) in packages/cli/tests/root-dev.test.ts:61"}, "properties": {"repobilityId": "ac017ace99efe31a", "scanner": "scanner-primary", "fingerprint": "d74a302a24571435", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-4f311927226b29c8", "level": "none", "message": {"text": "Commented-code block (6 lines) in packages/cli/tests/integration/agent-skills.test.ts:336"}, "properties": {"repobilityId": "59908b52d77f5445", "scanner": "scanner-primary", "fingerprint": "4f311927226b29c8", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-9d02e19f2b9d3d5b", "level": "none", "message": {"text": "Commented-code block (6 lines) in packages/cli/tests/rsi/orchestrator.test.ts:699"}, "properties": {"repobilityId": "2aa957f355e053cc", "scanner": "scanner-primary", "fingerprint": "9d02e19f2b9d3d5b", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-711be9f2ed5c7f7a", "level": "none", "message": {"text": "Commented-code block (5 lines) in packages/cli/tests/rsi/crystallize.test.ts:641"}, "properties": {"repobilityId": "aa4ded9d60672224", "scanner": "scanner-primary", "fingerprint": "711be9f2ed5c7f7a", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-da5b82c23d2bc343", "level": "none", "message": {"text": "Commented-code block (6 lines) in packages/cli/tests/tools/skill-manager.test.ts:433"}, "properties": {"repobilityId": "5ff3de32d0ee53fb", "scanner": "scanner-primary", "fingerprint": "da5b82c23d2bc343", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-fc1b7a4266bcee7e", "level": "none", "message": {"text": "Commented-code block (6 lines) in packages/cli/tests/tools/code-exec.test.ts:215"}, "properties": {"repobilityId": "11550518c34323ef", "scanner": "scanner-primary", "fingerprint": "fc1b7a4266bcee7e", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-5eb4e2d26df0e105", "level": "none", "message": {"text": "Commented-code block (5 lines) in packages/cli/src/safety/policy.ts:65"}, "properties": {"repobilityId": "e958383e2f79a2c8", "scanner": "scanner-primary", "fingerprint": "5eb4e2d26df0e105", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-04afdc79e599c9b3", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/cli/src/auth/openai-chatgpt.ts:200"}, "properties": {"repobilityId": "650930672908f93d", "scanner": "scanner-primary", "fingerprint": "04afdc79e599c9b3", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-4115f9938d954ef9", "level": "none", "message": {"text": "Commented-code block (6 lines) in packages/cli/src/rsi/orchestrator.ts:273"}, "properties": {"repobilityId": "f3edb9debe22c6b6", "scanner": "scanner-primary", "fingerprint": "4115f9938d954ef9", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-31c4b15faeb72eab", "level": "none", "message": {"text": "Commented-code block (5 lines) in packages/cli/src/tools/bash.ts:364"}, "properties": {"repobilityId": "a7ee44a93d876ec9", "scanner": "scanner-primary", "fingerprint": "31c4b15faeb72eab", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-56ac43e68ec214cd", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/cli/src/tools/web-search.ts:94"}, "properties": {"repobilityId": "88f4025959cfb2a1", "scanner": "scanner-primary", "fingerprint": "56ac43e68ec214cd", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-71b22267b22c07ea", "level": "none", "message": {"text": "Commented-code block (6 lines) in packages/cli/src/json-rpc/server.ts:169"}, "properties": {"repobilityId": "889f0a824bef64c6", "scanner": "scanner-primary", "fingerprint": "71b22267b22c07ea", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-407ccff0fd39bfee", "level": "none", "message": {"text": "Commented-code block (6 lines) in packages/cli/src/json-rpc/handlers.ts:558"}, "properties": {"repobilityId": "c15ddc9dea6b0817", "scanner": "scanner-primary", "fingerprint": "407ccff0fd39bfee", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-98743f9b8fdc3957", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/cli/src/llm/provider.ts:170"}, "properties": {"repobilityId": "1ab94621397b2829", "scanner": "scanner-primary", "fingerprint": "98743f9b8fdc3957", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-117215043bef9200", "level": "none", "message": {"text": "Commented-code block (7 lines) in packages/desktop/electron.vite.config.ts:33"}, "properties": {"repobilityId": "31676ebf7f22114c", "scanner": "scanner-primary", "fingerprint": "117215043bef9200", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-5765de462c36b074", "level": "none", "message": {"text": "Commented-code block (7 lines) in packages/desktop/playwright.config.ts:7"}, "properties": {"repobilityId": "5f789c267c2b90b5", "scanner": "scanner-primary", "fingerprint": "5765de462c36b074", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-04536d83c7518fac", "level": "none", "message": {"text": "Commented-code block (5 lines) in packages/desktop/tests/e2e/main-process.spec.ts:170"}, "properties": {"repobilityId": "952fb5b2be1306cd", "scanner": "scanner-primary", "fingerprint": "04536d83c7518fac", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-29ec33a7fc18c337", "level": "none", "message": {"text": "Commented-code block (7 lines) in packages/desktop/tests/e2e/renderer-contract.spec.ts:1017"}, "properties": {"repobilityId": "167a71e4b174723e", "scanner": "scanner-primary", "fingerprint": "29ec33a7fc18c337", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-7c35dd874ce8f925", "level": "none", "message": {"text": "Commented-code block (9 lines) in packages/desktop/tests/e2e/mermaid-lightbox.spec.ts:12"}, "properties": {"repobilityId": "ff7e60c5f43c49e4", "scanner": "scanner-primary", "fingerprint": "7c35dd874ce8f925", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-a36fcb8329ad97a1", "level": "none", "message": {"text": "Commented-code block (6 lines) in packages/desktop/tests/e2e/artifact-panel.spec.ts:136"}, "properties": {"repobilityId": "ac462b0ab6ac3d80", "scanner": "scanner-primary", "fingerprint": "a36fcb8329ad97a1", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-2f5656545682d44f", "level": "none", "message": {"text": "Commented-code block (6 lines) in packages/desktop/tests/e2e/verifier-verdict.spec.ts:127"}, "properties": {"repobilityId": "77bdf36d59ae9392", "scanner": "scanner-primary", "fingerprint": "2f5656545682d44f", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-05237c308e046fc4", "level": "none", "message": {"text": "Commented-code block (5 lines) in packages/desktop/tests/e2e/real-flows.spec.ts:119"}, "properties": {"repobilityId": "9443d8212ea63b76", "scanner": "scanner-primary", "fingerprint": "05237c308e046fc4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-ce0bfd6e6d883565", "level": "none", "message": {"text": "Commented-code block (9 lines) in packages/desktop/src/renderer/stores/conversationStore.ts:1074"}, "properties": {"repobilityId": "3a6ee41750127f28", "scanner": "scanner-primary", "fingerprint": "ce0bfd6e6d883565", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-52bfa73895eefe6b", "level": "none", "message": {"text": "Commented-code block (6 lines) in packages/desktop/src/renderer/components/VerifierVerdictChip.tsx:10"}, "properties": {"repobilityId": "625e2deb83274f87", "scanner": "scanner-primary", "fingerprint": "52bfa73895eefe6b", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-8bed4bf87bb24bf6", "level": "none", "message": {"text": "Commented-code block (6 lines) in packages/desktop/src/renderer/components/Sidebar.tsx:225"}, "properties": {"repobilityId": "38fba26046bc4352", "scanner": "scanner-primary", "fingerprint": "8bed4bf87bb24bf6", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-122aececcee56a2b", "level": "none", "message": {"text": "Commented-code block (5 lines) in packages/desktop/src/main/cli-process.ts:68"}, "properties": {"repobilityId": "96faaadc5e7b40e6", "scanner": "scanner-primary", "fingerprint": "122aececcee56a2b", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-8f4e98cb9eff45fc", "level": "none", "message": {"text": "Commented-code block (10 lines) in packages/desktop/src/main/preload.ts:164"}, "properties": {"repobilityId": "e4aafd4dd6f5cfaa", "scanner": "scanner-primary", "fingerprint": "8f4e98cb9eff45fc", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-51bbe863da791ba1", "level": "none", "message": {"text": "Commented-code block (11 lines) in packages/desktop/src/main/index.ts:210"}, "properties": {"repobilityId": "17a52060088eba9b", "scanner": "scanner-primary", "fingerprint": "51bbe863da791ba1", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-0c95dbb7b69516cf", "level": "none", "message": {"text": "Commented-code block (5 lines) in packages/desktop/src/main/ipc-handlers.ts:229"}, "properties": {"repobilityId": "fcf4bfe177d732d0", "scanner": "scanner-primary", "fingerprint": "0c95dbb7b69516cf", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-4fa3b13cc25cc1f2", "level": "none", "message": {"text": "Commented-code block (9 lines) in packages/desktop/src/main/window.ts:101"}, "properties": {"repobilityId": "e3affc66b9a9af19", "scanner": "scanner-primary", "fingerprint": "4fa3b13cc25cc1f2", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}]}]}