{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-04f3869ca11c73c4", "name": "Possibly dead Python function: is_paused", "shortDescription": {"text": "Possibly dead Python function: is_paused"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-83fb42b953b36ed2", "name": "Possibly dead Python function: wait_if_paused", "shortDescription": {"text": "Possibly dead Python function: wait_if_paused"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c96292655ed03c6c", "name": "Stray `console.log` in TS/JS \u2014 relay/src/index.ts:94", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 relay/src/index.ts:94"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-dba77693da8ab735", "name": "Icon-only button without accessible name \u2014 ui/src/components/NodeDetailPanel.tsx:19", "shortDescription": {"text": "Icon-only button without accessible name \u2014 ui/src/components/NodeDetailPanel.tsx:19"}, "fullDescription": {"text": "A `<button>` whose only child is a single glyph or symbol needs `title=` or `aria-label=` so screen readers (and tooltips on hover) work.\n\nWhy: P3 in CHECKLIST.md \u2014 icon-only buttons skipped a title.\nRule id: fq.button.no-label"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4840f3dac3f27823", "name": "Icon-only button without accessible name \u2014 ui/src/components/MessageThread.tsx:17", "shortDescription": {"text": "Icon-only button without accessible name \u2014 ui/src/components/MessageThread.tsx:17"}, "fullDescription": {"text": "A `<button>` whose only child is a single glyph or symbol needs `title=` or `aria-label=` so screen readers (and tooltips on hover) work.\n\nWhy: P3 in CHECKLIST.md \u2014 icon-only buttons skipped a title.\nRule id: fq.button.no-label"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9710c8d059e53154", "name": "No frontend routes/components detected", "shortDescription": {"text": "No frontend routes/components detected"}, "fullDescription": {"text": "No React/Vue/Next routes were found. This is fine for backend-only repos."}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-b83828737edca586", "name": "Insecure pattern 'direct_innerhtml_assignment' in ui/src/components/Graph.tsx:83", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in ui/src/components/Graph.tsx:83"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6372cebde0220094", "name": "No auth library detected", "shortDescription": {"text": "No auth library detected"}, "fullDescription": {"text": "The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). The repo has auth/admin/session surface indicators, so auth may live in custom code, in a separate service, or be missing."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 10 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c84adc7f917a1c5b", "name": "Network/subprocess call without timeout or try/except \u2014 sdk/agentviz/session.py:56", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 sdk/agentviz/session.py:56"}, "fullDescription": {"text": "`subprocess.Popen(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-36365d6e8fc8a74c", "name": "Blocking `time.sleep(...)` inside `async def connect` \u2014 sdk/agentviz/session.py:67", "shortDescription": {"text": "Blocking `time.sleep(...)` inside `async def connect` \u2014 sdk/agentviz/session.py:67"}, "fullDescription": {"text": "Sync I/O inside an async function blocks the event loop. While `time.sleep(...)` is running, *all* other coroutines on this loop are paused \u2014 silent throughput collapse under concurrency. Use the async equivalent (`httpx.AsyncClient`, `asyncio.sleep`, `aiofiles`) or wrap with `await asyncio.to_thread(...)`."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "high", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/24152"}, "properties": {"repository": "amwine28/AgentViz", "repoUrl": "https://github.com/amwine28/AgentViz", "branch": "main"}, "results": [{"ruleId": "scanner-04f3869ca11c73c4", "level": "note", "message": {"text": "Possibly dead Python function: is_paused"}, "properties": {"repobilityId": "b175063f672bc9bb", "scanner": "scanner-primary", "fingerprint": "04f3869ca11c73c4", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "sdk/agentviz/agent.py:43"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-83fb42b953b36ed2", "level": "note", "message": {"text": "Possibly dead Python function: wait_if_paused"}, "properties": {"repobilityId": "3243a4b2360bdd06", "scanner": "scanner-primary", "fingerprint": "83fb42b953b36ed2", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "sdk/agentviz/agent.py:46"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c96292655ed03c6c", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 relay/src/index.ts:94"}, "properties": {"repobilityId": "41312dd29064feba", "scanner": "scanner-primary", "fingerprint": "c96292655ed03c6c", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-dba77693da8ab735", "level": "note", "message": {"text": "Icon-only button without accessible name \u2014 ui/src/components/NodeDetailPanel.tsx:19"}, "properties": {"repobilityId": "d6b99eb1e4a09ea1", "scanner": "scanner-primary", "fingerprint": "dba77693da8ab735", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.button.no-label"]}}, {"ruleId": "scanner-4840f3dac3f27823", "level": "note", "message": {"text": "Icon-only button without accessible name \u2014 ui/src/components/MessageThread.tsx:17"}, "properties": {"repobilityId": "2881997e20ae0d9b", "scanner": "scanner-primary", "fingerprint": "4840f3dac3f27823", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.button.no-label"]}}, {"ruleId": "scanner-9710c8d059e53154", "level": "none", "message": {"text": "No frontend routes/components detected"}, "properties": {"repobilityId": "44ca61485762e494", "scanner": "scanner-primary", "fingerprint": "9710c8d059e53154", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-b83828737edca586", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in ui/src/components/Graph.tsx:83"}, "properties": {"repobilityId": "58f691d4ddd42610", "scanner": "scanner-primary", "fingerprint": "b83828737edca586", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ui/src/components/Graph.tsx"}, "region": {"startLine": 83}}}]}, {"ruleId": "scanner-6372cebde0220094", "level": "warning", "message": {"text": "No auth library detected"}, "properties": {"repobilityId": "a5b6035a5bbf8054", "scanner": "scanner-primary", "fingerprint": "6372cebde0220094", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["coverage", "auth"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "361fedb8a0003bbb", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-c84adc7f917a1c5b", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 sdk/agentviz/session.py:56"}, "properties": {"repobilityId": "3383214d7a7bbdd8", "scanner": "scanner-primary", "fingerprint": "c84adc7f917a1c5b", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-36365d6e8fc8a74c", "level": "error", "message": {"text": "Blocking `time.sleep(...)` inside `async def connect` \u2014 sdk/agentviz/session.py:67"}, "properties": {"repobilityId": "f47709c5dc425ff0", "scanner": "scanner-primary", "fingerprint": "36365d6e8fc8a74c", "layer": "quality", "severity": "high", "confidence": 1.0, "tags": ["integrity", "sync-io-in-async", "performance"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "sdk/agentviz/session.py"}, "region": {"startLine": 67}}}]}]}]}