{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-dbd8a7472041c35c", "name": "Docker base image is tag-pinned but not digest-pinned: node:22", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: node:22"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-93e02e0d67c8f3e8", "name": "Docker base image is tag-pinned but not digest-pinned: node:22-slim", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: node:22-slim"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2463b8a84a0a1b72", "name": "Insecure pattern 'node_child_process' in src/session-manager.test.ts:3", "shortDescription": {"text": "Insecure pattern 'node_child_process' in src/session-manager.test.ts:3"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0ace657f18eb0166", "name": "Insecure pattern 'node_child_process' in src/session-manager.ts:1", "shortDescription": {"text": "Insecure pattern 'node_child_process' in src/session-manager.ts:1"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8cf6035de3ab5fd1", "name": "Insecure pattern 'node_child_process' in src/cli-wrapper.test.ts:6", "shortDescription": {"text": "Insecure pattern 'node_child_process' in src/cli-wrapper.test.ts:6"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-afe05796f437fb00", "name": "Insecure pattern 'node_child_process' in src/workspace-files.ts:10", "shortDescription": {"text": "Insecure pattern 'node_child_process' in src/workspace-files.ts:10"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6372cebde0220094", "name": "No auth library detected", "shortDescription": {"text": "No auth library detected"}, "fullDescription": {"text": "The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). The repo has auth/admin/session surface indicators, so auth may live in custom code, in a separate service, or be missing."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b841c61fdfcff569", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-076b03a16e76601d", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-27924aa79fa4a517", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 22 placeholder/mock markers across 4 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f439a0e04c5384e0", "name": "Commented-code block (6 lines) in src/telegram-adapter.ts:3", "shortDescription": {"text": "Commented-code block (6 lines) in src/telegram-adapter.ts:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-3e106fea1e84a942", "name": "Legacy-named symbol `aOld` in src/bridge-auto-reload.test.ts:226", "shortDescription": {"text": "Legacy-named symbol `aOld` in src/bridge-auto-reload.test.ts:226"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1c9ee657527d4c0f", "name": "Commented-code block (7 lines) in src/session-manager.test.ts:102", "shortDescription": {"text": "Commented-code block (7 lines) in src/session-manager.test.ts:102"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-02c945333f674f4a", "name": "Commented-code block (5 lines) in src/cli.ts:6", "shortDescription": {"text": "Commented-code block (5 lines) in src/cli.ts:6"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-4aabfee82dcd7f8d", "name": "Commented-code block (6 lines) in src/session-manager.ts:168", "shortDescription": {"text": "Commented-code block (6 lines) in src/session-manager.ts:168"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-e6fb906549996f12", "name": "Commented-code block (5 lines) in src/stream-buffer.ts:1", "shortDescription": {"text": "Commented-code block (5 lines) in src/stream-buffer.ts:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-f6d0686f5c9e5c11", "name": "Commented-code block (5 lines) in src/cli-wrapper.test.ts:110", "shortDescription": {"text": "Commented-code block (5 lines) in src/cli-wrapper.test.ts:110"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-2878b80e414311de", "name": "`fetch()` without try/.catch or AbortSignal \u2014 src/inbound-attachments.ts:37", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/inbound-attachments.ts:37"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-eff0d92257f86f7b", "name": "Commented-code block (6 lines) in src/discord-adapter.ts:1", "shortDescription": {"text": "Commented-code block (6 lines) in src/discord-adapter.ts:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-4ce838f3537a80b2", "name": "`fetch()` without try/.catch or AbortSignal \u2014 src/discord-adapter.ts:126", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/discord-adapter.ts:126"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-770f92dfe21f666c", "name": "Commented-code block (5 lines) in src/logger.ts:1", "shortDescription": {"text": "Commented-code block (5 lines) in src/logger.ts:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-8d5e60c149ffc4a1", "name": "Commented-code block (5 lines) in src/workspace-files.ts:4", "shortDescription": {"text": "Commented-code block (5 lines) in src/workspace-files.ts:4"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-f82ba508f7d8f7c1", "name": "Commented-code block (5 lines) in src/dispatcher.ts:1", "shortDescription": {"text": "Commented-code block (5 lines) in src/dispatcher.ts:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-ccb884b35bedcda6", "name": "`fetch()` without try/.catch or AbortSignal \u2014 src/internal-server.test.ts:40", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/internal-server.test.ts:40"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-47022cc8239f3254", "name": "Commented-code block (6 lines) in src/web-adapter.ts:3", "shortDescription": {"text": "Commented-code block (6 lines) in src/web-adapter.ts:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-99a01a7e36e507e0", "name": "Commented-code block (6 lines) in src/discord-adapter.test.ts:6", "shortDescription": {"text": "Commented-code block (6 lines) in src/discord-adapter.test.ts:6"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-c27645d70d4f5f9f", "name": "Commented-code block (6 lines) in src/telegram-typing.test.ts:5", "shortDescription": {"text": "Commented-code block (6 lines) in src/telegram-typing.test.ts:5"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-675be41428d6c814", "name": "Commented-code block (8 lines) in src/bridge.ts:6", "shortDescription": {"text": "Commented-code block (8 lines) in src/bridge.ts:6"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-140f959839284ce4", "name": "Commented-code block (6 lines) in src/chat-adapter.ts:3", "shortDescription": {"text": "Commented-code block (6 lines) in src/chat-adapter.ts:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-0432d92254766728", "name": "Commented-code block (10 lines) in src/workspace-chat-adapter.ts:7", "shortDescription": {"text": "Commented-code block (10 lines) in src/workspace-chat-adapter.ts:7"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-3c108f470158a637", "name": "Commented-code block (5 lines) in src/config.test.ts:220", "shortDescription": {"text": "Commented-code block (5 lines) in src/config.test.ts:220"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-2f839f28bc5409f7", "name": "Commented-code block (5 lines) in src/typing-keepalive.ts:3", "shortDescription": {"text": "Commented-code block (5 lines) in src/typing-keepalive.ts:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-8574beb3a0119fc2", "name": "Commented-code block (7 lines) in src/config.ts:16", "shortDescription": {"text": "Commented-code block (7 lines) in src/config.ts:16"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-3f6472d14cca43fb", "name": "Commented-code block (6 lines) in src/config-reloader.test.ts:116", "shortDescription": {"text": "Commented-code block (6 lines) in src/config-reloader.test.ts:116"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-c808506ac40e1263", "name": "Commented-code block (7 lines) in src/internal-server.ts:8", "shortDescription": {"text": "Commented-code block (7 lines) in src/internal-server.ts:8"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-f4c06cb35607971d", "name": "Commented-code block (5 lines) in src/dispatcher.test.ts:184", "shortDescription": {"text": "Commented-code block (5 lines) in src/dispatcher.test.ts:184"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-56d652e5e915abf6", "name": "Commented-code block (8 lines) in src/bridge.test.ts:119", "shortDescription": {"text": "Commented-code block (8 lines) in src/bridge.test.ts:119"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-6fd96d7e3ee48066", "name": "`fetch()` without try/.catch or AbortSignal \u2014 src/bridge.test.ts:78", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/bridge.test.ts:78"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e36eaecfd35fdebf", "name": "Commented-code block (6 lines) in src/opencode-rest.ts:5", "shortDescription": {"text": "Commented-code block (6 lines) in src/opencode-rest.ts:5"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-a5a55962665b5959", "name": "Commented-code block (9 lines) in src/reconciler.ts:3", "shortDescription": {"text": "Commented-code block (9 lines) in src/reconciler.ts:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-5d96ecf8dde2866a", "name": "Commented-code block (5 lines) in src/approval-link.ts:53", "shortDescription": {"text": "Commented-code block (5 lines) in src/approval-link.ts:53"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-47dd957c176b9914", "name": "Commented-code block (6 lines) in src/cli.test.ts:233", "shortDescription": {"text": "Commented-code block (6 lines) in src/cli.test.ts:233"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-d278e3e128307a71", "name": "Commented-code block (6 lines) in src/attachment.ts:4", "shortDescription": {"text": "Commented-code block (6 lines) in src/attachment.ts:4"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-5cb6d233ce334f93", "name": "Commented-code block (5 lines) in src/slack-adapter.ts:8", "shortDescription": {"text": "Commented-code block (5 lines) in src/slack-adapter.ts:8"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-4a5acb68a6817582", "name": "Commented-code block (8 lines) in src/permission-policy.ts:3", "shortDescription": {"text": "Commented-code block (8 lines) in src/permission-policy.ts:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-2dc645570dde4d47", "name": "Commented-code block (21 lines) in src/__tests__/fake-acp-child.mjs:7", "shortDescription": {"text": "Commented-code block (21 lines) in src/__tests__/fake-acp-child.mjs:7"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/24873"}, "properties": {"repository": "cerase-ai/cerase-acp", "repoUrl": "https://github.com/cerase-ai/cerase-acp", "branch": "main"}, "results": [{"ruleId": "scanner-dbd8a7472041c35c", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: node:22"}, "properties": {"repobilityId": "a71fc0f5ed07e410", "scanner": "scanner-primary", "fingerprint": "dbd8a7472041c35c", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Dockerfile"}, "region": {"startLine": 23}}}]}, {"ruleId": "scanner-93e02e0d67c8f3e8", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: node:22-slim"}, "properties": {"repobilityId": "ee3dd09670317aaa", "scanner": "scanner-primary", "fingerprint": "93e02e0d67c8f3e8", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Dockerfile"}, "region": {"startLine": 35}}}]}, {"ruleId": "scanner-2463b8a84a0a1b72", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in src/session-manager.test.ts:3"}, "properties": {"repobilityId": "039a39d413abefe2", "scanner": "scanner-primary", "fingerprint": "2463b8a84a0a1b72", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/session-manager.test.ts"}, "region": {"startLine": 3}}}]}, {"ruleId": "scanner-0ace657f18eb0166", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in src/session-manager.ts:1"}, "properties": {"repobilityId": "00deb9e3aa3217c0", "scanner": "scanner-primary", "fingerprint": "0ace657f18eb0166", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/session-manager.ts"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8cf6035de3ab5fd1", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in src/cli-wrapper.test.ts:6"}, "properties": {"repobilityId": "09cdca2c3777639b", "scanner": "scanner-primary", "fingerprint": "8cf6035de3ab5fd1", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/cli-wrapper.test.ts"}, "region": {"startLine": 6}}}]}, {"ruleId": "scanner-afe05796f437fb00", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in src/workspace-files.ts:10"}, "properties": {"repobilityId": "22ef5426ed2c7853", "scanner": "scanner-primary", "fingerprint": "afe05796f437fb00", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/workspace-files.ts"}, "region": {"startLine": 10}}}]}, {"ruleId": "scanner-6372cebde0220094", "level": "warning", "message": {"text": "No auth library detected"}, "properties": {"repobilityId": "a5b6035a5bbf8054", "scanner": "scanner-primary", "fingerprint": "6372cebde0220094", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["coverage", "auth"]}}, {"ruleId": "scanner-b841c61fdfcff569", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "83a185deafa37ffa", "scanner": "scanner-primary", "fingerprint": "b841c61fdfcff569", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/docker-publish.yml"}, "region": {"startLine": 44}}}]}, {"ruleId": "scanner-b841c61fdfcff569", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "92a252f237fefd54", "scanner": "scanner-primary", "fingerprint": "b841c61fdfcff569", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/docker-publish.yml"}, "region": {"startLine": 47}}}]}, {"ruleId": "scanner-b841c61fdfcff569", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "9865da7d2b2ff924", "scanner": "scanner-primary", "fingerprint": "b841c61fdfcff569", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/docker-publish.yml"}, "region": {"startLine": 51}}}]}, {"ruleId": "scanner-b841c61fdfcff569", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "3ced3a497e6628d3", "scanner": "scanner-primary", "fingerprint": "b841c61fdfcff569", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/docker-publish.yml"}, "region": {"startLine": 59}}}]}, {"ruleId": "scanner-b841c61fdfcff569", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "81e5f06397892af9", "scanner": "scanner-primary", "fingerprint": "b841c61fdfcff569", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/docker-publish.yml"}, "region": {"startLine": 84}}}]}, {"ruleId": "scanner-076b03a16e76601d", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "a42462ccbe3d06f2", "scanner": "scanner-primary", "fingerprint": "076b03a16e76601d", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/docker-publish.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "ae16880318b99912", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 21}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "989a74409a402368", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 24}}}]}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "845bc6c77842cef1", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "16733bf4f0e1802e", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-f439a0e04c5384e0", "level": "none", "message": {"text": "Commented-code block (6 lines) in src/telegram-adapter.ts:3"}, "properties": {"repobilityId": "60bd4a893a6431f1", "scanner": "scanner-primary", "fingerprint": "f439a0e04c5384e0", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-3e106fea1e84a942", "level": "note", "message": {"text": "Legacy-named symbol `aOld` in src/bridge-auto-reload.test.ts:226"}, "properties": {"repobilityId": "c3d90a61d327c78a", "scanner": "scanner-primary", "fingerprint": "3e106fea1e84a942", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-1c9ee657527d4c0f", "level": "none", "message": {"text": "Commented-code block (7 lines) in src/session-manager.test.ts:102"}, "properties": {"repobilityId": "ff6c98bb830ded8c", "scanner": "scanner-primary", "fingerprint": "1c9ee657527d4c0f", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-02c945333f674f4a", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/cli.ts:6"}, "properties": {"repobilityId": "ed2fe7a7b87b9728", "scanner": "scanner-primary", "fingerprint": "02c945333f674f4a", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-4aabfee82dcd7f8d", "level": "none", "message": {"text": "Commented-code block (6 lines) in src/session-manager.ts:168"}, "properties": {"repobilityId": "829b642ddd5735b4", "scanner": "scanner-primary", "fingerprint": "4aabfee82dcd7f8d", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-e6fb906549996f12", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/stream-buffer.ts:1"}, "properties": {"repobilityId": "0ba661a2c4121f63", "scanner": "scanner-primary", "fingerprint": "e6fb906549996f12", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-f6d0686f5c9e5c11", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/cli-wrapper.test.ts:110"}, "properties": {"repobilityId": "85d32e555950ac29", "scanner": "scanner-primary", "fingerprint": "f6d0686f5c9e5c11", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-2878b80e414311de", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/inbound-attachments.ts:37"}, "properties": {"repobilityId": "32efb7ca65195de6", "scanner": "scanner-primary", "fingerprint": "2878b80e414311de", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-eff0d92257f86f7b", "level": "none", "message": {"text": "Commented-code block (6 lines) in src/discord-adapter.ts:1"}, "properties": {"repobilityId": "1e4413ac7d991219", "scanner": "scanner-primary", "fingerprint": "eff0d92257f86f7b", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-4ce838f3537a80b2", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/discord-adapter.ts:126"}, "properties": {"repobilityId": "ffb44c77ed324964", "scanner": "scanner-primary", "fingerprint": "4ce838f3537a80b2", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-770f92dfe21f666c", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/logger.ts:1"}, "properties": {"repobilityId": "42d0811b44c42e4e", "scanner": "scanner-primary", "fingerprint": "770f92dfe21f666c", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-8d5e60c149ffc4a1", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/workspace-files.ts:4"}, "properties": {"repobilityId": "5a95ce2d01e89dab", "scanner": "scanner-primary", "fingerprint": "8d5e60c149ffc4a1", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-f82ba508f7d8f7c1", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/dispatcher.ts:1"}, "properties": {"repobilityId": "60bcc8046aa7d0c1", "scanner": "scanner-primary", "fingerprint": "f82ba508f7d8f7c1", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-ccb884b35bedcda6", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/internal-server.test.ts:40"}, "properties": {"repobilityId": "978e64ea017ff1f3", "scanner": "scanner-primary", "fingerprint": "ccb884b35bedcda6", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-47022cc8239f3254", "level": "none", "message": {"text": "Commented-code block (6 lines) in src/web-adapter.ts:3"}, "properties": {"repobilityId": "9809648d43bf940c", "scanner": "scanner-primary", "fingerprint": "47022cc8239f3254", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-99a01a7e36e507e0", "level": "none", "message": {"text": "Commented-code block (6 lines) in src/discord-adapter.test.ts:6"}, "properties": {"repobilityId": "5644b20cdaf53402", "scanner": "scanner-primary", "fingerprint": "99a01a7e36e507e0", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-c27645d70d4f5f9f", "level": "none", "message": {"text": "Commented-code block (6 lines) in src/telegram-typing.test.ts:5"}, "properties": {"repobilityId": "20a90556d9f924c8", "scanner": "scanner-primary", "fingerprint": "c27645d70d4f5f9f", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-675be41428d6c814", "level": "none", "message": {"text": "Commented-code block (8 lines) in src/bridge.ts:6"}, "properties": {"repobilityId": "26160fac916733b2", "scanner": "scanner-primary", "fingerprint": "675be41428d6c814", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-140f959839284ce4", "level": "none", "message": {"text": "Commented-code block (6 lines) in src/chat-adapter.ts:3"}, "properties": {"repobilityId": "1d29cbf468b3f803", "scanner": "scanner-primary", "fingerprint": "140f959839284ce4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-0432d92254766728", "level": "none", "message": {"text": "Commented-code block (10 lines) in src/workspace-chat-adapter.ts:7"}, "properties": {"repobilityId": "e42c973cb53dbc6e", "scanner": "scanner-primary", "fingerprint": "0432d92254766728", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-3c108f470158a637", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/config.test.ts:220"}, "properties": {"repobilityId": "417e31793f2b9512", "scanner": "scanner-primary", "fingerprint": "3c108f470158a637", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-2f839f28bc5409f7", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/typing-keepalive.ts:3"}, "properties": {"repobilityId": "e2f92c970e7f4977", "scanner": "scanner-primary", "fingerprint": "2f839f28bc5409f7", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-8574beb3a0119fc2", "level": "none", "message": {"text": "Commented-code block (7 lines) in src/config.ts:16"}, "properties": {"repobilityId": "bbd3104acf407e43", "scanner": "scanner-primary", "fingerprint": "8574beb3a0119fc2", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-3f6472d14cca43fb", "level": "none", "message": {"text": "Commented-code block (6 lines) in src/config-reloader.test.ts:116"}, "properties": {"repobilityId": "40ae6a7efcba83de", "scanner": "scanner-primary", "fingerprint": "3f6472d14cca43fb", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-c808506ac40e1263", "level": "none", "message": {"text": "Commented-code block (7 lines) in src/internal-server.ts:8"}, "properties": {"repobilityId": "f6be5270b6d80ba6", "scanner": "scanner-primary", "fingerprint": "c808506ac40e1263", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-f4c06cb35607971d", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/dispatcher.test.ts:184"}, "properties": {"repobilityId": "a9ebd69e4ab3d007", "scanner": "scanner-primary", "fingerprint": "f4c06cb35607971d", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-56d652e5e915abf6", "level": "none", "message": {"text": "Commented-code block (8 lines) in src/bridge.test.ts:119"}, "properties": {"repobilityId": "4d54c11da53f9586", "scanner": "scanner-primary", "fingerprint": "56d652e5e915abf6", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-6fd96d7e3ee48066", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/bridge.test.ts:78"}, "properties": {"repobilityId": "25538761b5cd1852", "scanner": "scanner-primary", "fingerprint": "6fd96d7e3ee48066", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-e36eaecfd35fdebf", "level": "none", "message": {"text": "Commented-code block (6 lines) in src/opencode-rest.ts:5"}, "properties": {"repobilityId": "02b5a6f97cdb83a5", "scanner": "scanner-primary", "fingerprint": "e36eaecfd35fdebf", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-a5a55962665b5959", "level": "none", "message": {"text": "Commented-code block (9 lines) in src/reconciler.ts:3"}, "properties": {"repobilityId": "33ce58f22b49a2ed", "scanner": "scanner-primary", "fingerprint": "a5a55962665b5959", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-5d96ecf8dde2866a", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/approval-link.ts:53"}, "properties": {"repobilityId": "8620a48b3d2caa42", "scanner": "scanner-primary", "fingerprint": "5d96ecf8dde2866a", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-47dd957c176b9914", "level": "none", "message": {"text": "Commented-code block (6 lines) in src/cli.test.ts:233"}, "properties": {"repobilityId": "2656d5b7e8f5cba6", "scanner": "scanner-primary", "fingerprint": "47dd957c176b9914", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-d278e3e128307a71", "level": "none", "message": {"text": "Commented-code block (6 lines) in src/attachment.ts:4"}, "properties": {"repobilityId": "4d611baa299e08a1", "scanner": "scanner-primary", "fingerprint": "d278e3e128307a71", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-5cb6d233ce334f93", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/slack-adapter.ts:8"}, "properties": {"repobilityId": "2082e12198d3fa91", "scanner": "scanner-primary", "fingerprint": "5cb6d233ce334f93", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-4a5acb68a6817582", "level": "none", "message": {"text": "Commented-code block (8 lines) in src/permission-policy.ts:3"}, "properties": {"repobilityId": "8da8bd5cb79c5beb", "scanner": "scanner-primary", "fingerprint": "4a5acb68a6817582", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-2dc645570dde4d47", "level": "none", "message": {"text": "Commented-code block (21 lines) in src/__tests__/fake-acp-child.mjs:7"}, "properties": {"repobilityId": "252ea49da064e083", "scanner": "scanner-primary", "fingerprint": "2dc645570dde4d47", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}]}]}