{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-6416b6ee686e0c70", "name": "Stray `console.log` in TS/JS \u2014 scripts/claude-proxy.ts:72", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 scripts/claude-proxy.ts:72"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e163c9c8296ffbab", "name": "Stray `console.log` in TS/JS \u2014 scripts/count-loc.ts:171", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 scripts/count-loc.ts:171"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4c22642510ede5ff", "name": "Stray `console.log` in TS/JS \u2014 scripts/release.ts:190", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 scripts/release.ts:190"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7e73f2e7cf5ab25f", "name": "Stray `console.log` in TS/JS \u2014 scripts/l10n-audit.ts:440", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 scripts/l10n-audit.ts:440"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-10902980b4584a92", "name": "TODO/FIXME marker in shipping code \u2014 src/client/openai/chat-completion-client.ts:314", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 src/client/openai/chat-completion-client.ts:314"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-b73ea7291d8db5d5", "name": "TODO/FIXME marker in shipping code \u2014 src/client/anthropic/client.ts:73", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 src/client/anthropic/client.ts:73"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-62369b0a0d2aeb96", "name": "TODO/FIXME marker in shipping code \u2014 src/dts/vscode.proposed.inlineCompletionsAdditions.d.ts:54", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 src/dts/vscode.proposed.inlineCompletionsAdditions.d.ts:54"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-18574d8a70c27514", "name": "TODO/FIXME marker in shipping code \u2014 src/dts/vscode.proposed.aiRelatedInformation.d.ts:22", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 src/dts/vscode.proposed.aiRelatedInformation.d.ts:22"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-cd9d34a4ddf1d01d", "name": "TODO/FIXME marker in shipping code \u2014 src/dts/vscode.proposed.documentFiltersExclusive.d.ts:8", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 src/dts/vscode.proposed.documentFiltersExclusive.d.ts:8"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-469c4f67fd09b3b3", "name": "TODO/FIXME marker in shipping code \u2014 src/dts/vscode.proposed.languageModelCapabilities.d.ts:8", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 src/dts/vscode.proposed.languageModelCapabilities.d.ts:8"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-6cf43daae9d1cdfd", "name": "Stray `console.log` in TS/JS \u2014 src/dts/vscode.proposed.textSearchProvider2.d.ts:163", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 src/dts/vscode.proposed.textSearchProvider2.d.ts:163"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-99c8649b66868a2d", "name": "TODO/FIXME marker in shipping code \u2014 src/dts/vscode.proposed.chatParticipantAdditions.d.ts:779", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 src/dts/vscode.proposed.chatParticipantAdditions.d.ts:779"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-351bc0e1640b114c", "name": "TODO/FIXME marker in shipping code \u2014 src/dts/vscode.proposed.embeddings.d.ts:14", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 src/dts/vscode.proposed.embeddings.d.ts:14"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-0c905c628e6cbbea", "name": "TODO/FIXME marker in shipping code \u2014 src/dts/vscode.proposed.chatSessionsProvider.d.ts:76", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 src/dts/vscode.proposed.chatSessionsProvider.d.ts:76"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-42064ae02fc8482a", "name": "TODO/FIXME marker in shipping code \u2014 src/dts/vscode.proposed.languageModelSystem.d.ts:10", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 src/dts/vscode.proposed.languageModelSystem.d.ts:10"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-eb5b6f5f15427686", "name": "TODO/FIXME marker in shipping code \u2014 src/dts/vscode.proposed.chatParticipantPrivate.d.ts:36", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 src/dts/vscode.proposed.chatParticipantPrivate.d.ts:36"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-9710c8d059e53154", "name": "No frontend routes/components detected", "shortDescription": {"text": "No frontend routes/components detected"}, "fullDescription": {"text": "No React/Vue/Next routes were found. This is fine for backend-only repos."}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-e526c1a7bc5893e1", "name": "Insecure pattern 'node_child_process' in scripts/release.ts:28", "shortDescription": {"text": "Insecure pattern 'node_child_process' in scripts/release.ts:28"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-46c644c6227e4d4a", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1838a141491ce38c", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6d748b0196b6359f", "name": "Very large file: src/utils.ts (3229 lines)", "shortDescription": {"text": "Very large file: src/utils.ts (3229 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bcbf0b81fac690a5", "name": "Very large file: src/client/google/code-assist-client.ts (2423 lines)", "shortDescription": {"text": "Very large file: src/client/google/code-assist-client.ts (2423 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e26cecac1d003a6c", "name": "Very large file: src/client/openai/chat-completion-client.ts (1774 lines)", "shortDescription": {"text": "Very large file: src/client/openai/chat-completion-client.ts (1774 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1ce46f189729df87", "name": "Very large file: src/client/openai/responses-client.ts (2412 lines)", "shortDescription": {"text": "Very large file: src/client/openai/responses-client.ts (2412 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cf8a0ca67e589a86", "name": "Very large file: src/client/anthropic/client.ts (1786 lines)", "shortDescription": {"text": "Very large file: src/client/anthropic/client.ts (1786 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6928218bc651ebfd", "name": "Very large file: src/well-known/models.ts (5309 lines)", "shortDescription": {"text": "Very large file: src/well-known/models.ts (5309 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6893a6c8b0861585", "name": "Very low test-to-source ratio", "shortDescription": {"text": "Very low test-to-source ratio"}, "fullDescription": {"text": "1 test file(s) for 230 source file(s) (ratio 0.00). Consider adding integration or unit tests for critical paths."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 85 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 146 placeholder/mock markers across 47 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-11825279136b53a3", "name": "CI is configured but no tests are detected", "shortDescription": {"text": "CI is configured but no tests are detected"}, "fullDescription": {"text": "A CI pipeline exists, but the scan found no test files to gate. Opus labeled this generated-code pattern as config theater: release machinery exists, but it has little behavioral signal."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-749d4bc1bd66df5f", "name": "Agent instructions exist but release-hardening basics are missing", "shortDescription": {"text": "Agent instructions exist but release-hardening basics are missing"}, "fullDescription": {"text": "AI-coder instruction files were found, but the repo is missing tests. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-34e74e1461c34071", "name": "`fetch()` without try/.catch or AbortSignal \u2014 scripts/claude-proxy.ts:79", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 scripts/claude-proxy.ts:79"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-eb94ba15fd5b7d04", "name": "`fetch()` without try/.catch or AbortSignal \u2014 scripts/release.ts:1131", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 scripts/release.ts:1131"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1b2e6915926e14ff", "name": "`fetch()` without try/.catch or AbortSignal \u2014 src/utils.ts:756", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/utils.ts:756"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4d8fbb066dc11054", "name": "Commented-code block (8 lines) in src/service.ts:908", "shortDescription": {"text": "Commented-code block (8 lines) in src/service.ts:908"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-a25980eacacb04d7", "name": "Commented-code block (7 lines) in src/client/google/code-assist-client.ts:913", "shortDescription": {"text": "Commented-code block (7 lines) in src/client/google/code-assist-client.ts:913"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-bd9cf3039b59385a", "name": "Commented-code block (9 lines) in src/client/openai/chat-completion-client.ts:1179", "shortDescription": {"text": "Commented-code block (9 lines) in src/client/openai/chat-completion-client.ts:1179"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-52c2a06d638b49d9", "name": "Commented-code block (9 lines) in src/client/openai/responses-client.ts:1806", "shortDescription": {"text": "Commented-code block (9 lines) in src/client/openai/responses-client.ts:1806"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-20b7d8c04704ea2a", "name": "Commented-code block (8 lines) in src/client/openai/codex-client.ts:89", "shortDescription": {"text": "Commented-code block (8 lines) in src/client/openai/codex-client.ts:89"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-0d7c0576124afeed", "name": "Commented-code block (6 lines) in src/client/xai/grok-build-client.ts:93", "shortDescription": {"text": "Commented-code block (6 lines) in src/client/xai/grok-build-client.ts:93"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-2f90bebf5a88fba2", "name": "Commented-code block (9 lines) in src/client/ollama/client.ts:590", "shortDescription": {"text": "Commented-code block (9 lines) in src/client/ollama/client.ts:590"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-081b64e00d87b690", "name": "Commented-code block (9 lines) in src/client/anthropic/client.ts:1175", "shortDescription": {"text": "Commented-code block (9 lines) in src/client/anthropic/client.ts:1175"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-7d937c9e83fb5744", "name": "`fetch()` without try/.catch or AbortSignal \u2014 src/auth/providers/github-copilot/index.ts:97", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/auth/providers/github-copilot/index.ts:97"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7eb22e3c57c155da", "name": "`fetch()` without try/.catch or AbortSignal \u2014 src/auth/providers/xai-grok-build/oauth-client.ts:209", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/auth/providers/xai-grok-build/oauth-client.ts:209"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-21fca723c0734a2c", "name": "`fetch()` without try/.catch or AbortSignal \u2014 src/auth/providers/antigravity-oauth/oauth-client.ts:495", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/auth/providers/antigravity-oauth/oauth-client.ts:495"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3068fd272af0bed5", "name": "`fetch()` without try/.catch or AbortSignal \u2014 src/auth/providers/oauth2/oauth2-client.ts:95", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/auth/providers/oauth2/oauth2-client.ts:95"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-59a723b094893644", "name": "`fetch()` without try/.catch or AbortSignal \u2014 src/auth/providers/google-gemini-oauth/oauth-client.ts:533", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/auth/providers/google-gemini-oauth/oauth-client.ts:533"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1553b10a276a6865", "name": "`fetch()` without try/.catch or AbortSignal \u2014 src/auth/providers/claude-code/oauth-client.ts:127", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/auth/providers/claude-code/oauth-client.ts:127"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1a474d3883b224b4", "name": "`fetch()` without try/.catch or AbortSignal \u2014 src/auth/providers/openai-codex/oauth-client.ts:174", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/auth/providers/openai-codex/oauth-client.ts:174"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-cc0f9d8e41b33b0e", "name": "11 env vars used in code but missing from .env.example", "shortDescription": {"text": "11 env vars used in code but missing from .env.example"}, "fullDescription": {"text": "Drift between code and config docs. The first few: `CODEX_HOME`, `GITHUB_TOKEN`, `HTTPS_PROXY`, `HTTP_PROXY`, `LOG_FILE`, `NO_PROXY`, `OPENAI_API_KEY`, `OPENAI_BASE_URL` + 3 more. Add them (with a placeholder/comment) to .env.example so onboarding doesn't break."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/19869"}, "properties": {"repository": "smallmain/vscode-unify-chat-provider", "repoUrl": "https://github.com/smallmain/vscode-unify-chat-provider", "branch": "main"}, "results": [{"ruleId": "scanner-6416b6ee686e0c70", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 scripts/claude-proxy.ts:72"}, "properties": {"repobilityId": "e4afa42e1adc7a90", "scanner": "scanner-primary", "fingerprint": "6416b6ee686e0c70", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-e163c9c8296ffbab", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 scripts/count-loc.ts:171"}, "properties": {"repobilityId": "d8c4e1403c41cbef", "scanner": "scanner-primary", "fingerprint": "e163c9c8296ffbab", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-4c22642510ede5ff", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 scripts/release.ts:190"}, "properties": {"repobilityId": "d820829d8215324e", "scanner": "scanner-primary", "fingerprint": "4c22642510ede5ff", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-7e73f2e7cf5ab25f", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 scripts/l10n-audit.ts:440"}, "properties": {"repobilityId": "1e9741b1b9f52d36", "scanner": "scanner-primary", "fingerprint": "7e73f2e7cf5ab25f", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-10902980b4584a92", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 src/client/openai/chat-completion-client.ts:314"}, "properties": {"repobilityId": "6baa3b6bcbadd40b", "scanner": "scanner-primary", "fingerprint": "10902980b4584a92", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.todo-marker"]}}, {"ruleId": "scanner-b73ea7291d8db5d5", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 src/client/anthropic/client.ts:73"}, "properties": {"repobilityId": "f2a0774b3e07502f", "scanner": "scanner-primary", "fingerprint": "b73ea7291d8db5d5", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.todo-marker"]}}, {"ruleId": "scanner-62369b0a0d2aeb96", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 src/dts/vscode.proposed.inlineCompletionsAdditions.d.ts:54"}, "properties": {"repobilityId": "3e5128106fc143cf", "scanner": "scanner-primary", "fingerprint": "62369b0a0d2aeb96", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.todo-marker"]}}, {"ruleId": "scanner-18574d8a70c27514", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 src/dts/vscode.proposed.aiRelatedInformation.d.ts:22"}, "properties": {"repobilityId": "af9f12c2c241b897", "scanner": "scanner-primary", "fingerprint": "18574d8a70c27514", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.todo-marker"]}}, {"ruleId": "scanner-cd9d34a4ddf1d01d", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 src/dts/vscode.proposed.documentFiltersExclusive.d.ts:8"}, "properties": {"repobilityId": "d922b832d005ac7f", "scanner": "scanner-primary", "fingerprint": "cd9d34a4ddf1d01d", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.todo-marker"]}}, {"ruleId": "scanner-469c4f67fd09b3b3", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 src/dts/vscode.proposed.languageModelCapabilities.d.ts:8"}, "properties": {"repobilityId": "5edbb0ef2b3233fc", "scanner": "scanner-primary", "fingerprint": "469c4f67fd09b3b3", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.todo-marker"]}}, {"ruleId": "scanner-6cf43daae9d1cdfd", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 src/dts/vscode.proposed.textSearchProvider2.d.ts:163"}, "properties": {"repobilityId": "2ced8eaf9c0bf9dc", "scanner": "scanner-primary", "fingerprint": "6cf43daae9d1cdfd", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-99c8649b66868a2d", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 src/dts/vscode.proposed.chatParticipantAdditions.d.ts:779"}, "properties": {"repobilityId": "a2b8dc8ce521922c", "scanner": "scanner-primary", "fingerprint": "99c8649b66868a2d", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.todo-marker"]}}, {"ruleId": "scanner-351bc0e1640b114c", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 src/dts/vscode.proposed.embeddings.d.ts:14"}, "properties": {"repobilityId": "c3e4cee1f25f3a01", "scanner": "scanner-primary", "fingerprint": "351bc0e1640b114c", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.todo-marker"]}}, {"ruleId": "scanner-0c905c628e6cbbea", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 src/dts/vscode.proposed.chatSessionsProvider.d.ts:76"}, "properties": {"repobilityId": "e998169e0b38e2fd", "scanner": "scanner-primary", "fingerprint": "0c905c628e6cbbea", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.todo-marker"]}}, {"ruleId": "scanner-42064ae02fc8482a", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 src/dts/vscode.proposed.languageModelSystem.d.ts:10"}, "properties": {"repobilityId": "7e69965aa64f7a89", "scanner": "scanner-primary", "fingerprint": "42064ae02fc8482a", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.todo-marker"]}}, {"ruleId": "scanner-eb5b6f5f15427686", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 src/dts/vscode.proposed.chatParticipantPrivate.d.ts:36"}, "properties": {"repobilityId": "27d858906b04e6a9", "scanner": "scanner-primary", "fingerprint": "eb5b6f5f15427686", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.todo-marker"]}}, {"ruleId": "scanner-9710c8d059e53154", "level": "none", "message": {"text": "No frontend routes/components detected"}, "properties": {"repobilityId": "44ca61485762e494", "scanner": "scanner-primary", "fingerprint": "9710c8d059e53154", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-e526c1a7bc5893e1", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in scripts/release.ts:28"}, "properties": {"repobilityId": "d59c31fdb7e68c42", "scanner": "scanner-primary", "fingerprint": "e526c1a7bc5893e1", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/release.ts"}, "region": {"startLine": 28}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "2644034c718fb80d", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 69}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "eeb76410cc935c30", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 75}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "cedbda24771e393e", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 81}}}]}, {"ruleId": "scanner-1838a141491ce38c", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "b8fd4f5048f96576", "scanner": "scanner-primary", "fingerprint": "1838a141491ce38c", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6d748b0196b6359f", "level": "note", "message": {"text": "Very large file: src/utils.ts (3229 lines)"}, "properties": {"repobilityId": "629ec9f3fac007cc", "scanner": "scanner-primary", "fingerprint": "6d748b0196b6359f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-bcbf0b81fac690a5", "level": "note", "message": {"text": "Very large file: src/client/google/code-assist-client.ts (2423 lines)"}, "properties": {"repobilityId": "8e6a7cd90225b69d", "scanner": "scanner-primary", "fingerprint": "bcbf0b81fac690a5", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-e26cecac1d003a6c", "level": "note", "message": {"text": "Very large file: src/client/openai/chat-completion-client.ts (1774 lines)"}, "properties": {"repobilityId": "99e8c841348b8498", "scanner": "scanner-primary", "fingerprint": "e26cecac1d003a6c", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-1ce46f189729df87", "level": "note", "message": {"text": "Very large file: src/client/openai/responses-client.ts (2412 lines)"}, "properties": {"repobilityId": "a24aac66a9a78c31", "scanner": "scanner-primary", "fingerprint": "1ce46f189729df87", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-cf8a0ca67e589a86", "level": "note", "message": {"text": "Very large file: src/client/anthropic/client.ts (1786 lines)"}, "properties": {"repobilityId": "9546a55bc0aaba06", "scanner": "scanner-primary", "fingerprint": "cf8a0ca67e589a86", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-6928218bc651ebfd", "level": "note", "message": {"text": "Very large file: src/well-known/models.ts (5309 lines)"}, "properties": {"repobilityId": "a19dbd34c4661bd0", "scanner": "scanner-primary", "fingerprint": "6928218bc651ebfd", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-6893a6c8b0861585", "level": "warning", "message": {"text": "Very low test-to-source ratio"}, "properties": {"repobilityId": "54a7de3f06314bf0", "scanner": "scanner-primary", "fingerprint": "6893a6c8b0861585", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["tests", "coverage"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "5ac18b2680104a51", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "88ac27ae1ab14035", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "e53e6b8579310805", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-11825279136b53a3", "level": "warning", "message": {"text": "CI is configured but no tests are detected"}, "properties": {"repobilityId": "4baabe5f366df0b0", "scanner": "scanner-primary", "fingerprint": "11825279136b53a3", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["tests", "ci", "config-theater", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-749d4bc1bd66df5f", "level": "warning", "message": {"text": "Agent instructions exist but release-hardening basics are missing"}, "properties": {"repobilityId": "fa4fb98ca678262a", "scanner": "scanner-primary", "fingerprint": "749d4bc1bd66df5f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "d4d98757831c717f", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "347582ec9cf1dc9a", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-34e74e1461c34071", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 scripts/claude-proxy.ts:79"}, "properties": {"repobilityId": "c6f70493c57c0316", "scanner": "scanner-primary", "fingerprint": "34e74e1461c34071", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-eb94ba15fd5b7d04", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 scripts/release.ts:1131"}, "properties": {"repobilityId": "3a881d45ca486bb6", "scanner": "scanner-primary", "fingerprint": "eb94ba15fd5b7d04", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-1b2e6915926e14ff", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/utils.ts:756"}, "properties": {"repobilityId": "dede27976edf3df8", "scanner": "scanner-primary", "fingerprint": "1b2e6915926e14ff", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-4d8fbb066dc11054", "level": "none", "message": {"text": "Commented-code block (8 lines) in src/service.ts:908"}, "properties": {"repobilityId": "91998960055f8090", "scanner": "scanner-primary", "fingerprint": "4d8fbb066dc11054", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-a25980eacacb04d7", "level": "none", "message": {"text": "Commented-code block (7 lines) in src/client/google/code-assist-client.ts:913"}, "properties": {"repobilityId": "bccf4d734bf1889f", "scanner": "scanner-primary", "fingerprint": "a25980eacacb04d7", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-bd9cf3039b59385a", "level": "none", "message": {"text": "Commented-code block (9 lines) in src/client/openai/chat-completion-client.ts:1179"}, "properties": {"repobilityId": "043473600b69987a", "scanner": "scanner-primary", "fingerprint": "bd9cf3039b59385a", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-52c2a06d638b49d9", "level": "none", "message": {"text": "Commented-code block (9 lines) in src/client/openai/responses-client.ts:1806"}, "properties": {"repobilityId": "2ebc2601bbd41112", "scanner": "scanner-primary", "fingerprint": "52c2a06d638b49d9", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-20b7d8c04704ea2a", "level": "none", "message": {"text": "Commented-code block (8 lines) in src/client/openai/codex-client.ts:89"}, "properties": {"repobilityId": "5de2f5e8e0f98250", "scanner": "scanner-primary", "fingerprint": "20b7d8c04704ea2a", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-0d7c0576124afeed", "level": "none", "message": {"text": "Commented-code block (6 lines) in src/client/xai/grok-build-client.ts:93"}, "properties": {"repobilityId": "51e05c43a174a2aa", "scanner": "scanner-primary", "fingerprint": "0d7c0576124afeed", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-2f90bebf5a88fba2", "level": "none", "message": {"text": "Commented-code block (9 lines) in src/client/ollama/client.ts:590"}, "properties": {"repobilityId": "25e99bc31d4e8d6a", "scanner": "scanner-primary", "fingerprint": "2f90bebf5a88fba2", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-081b64e00d87b690", "level": "none", "message": {"text": "Commented-code block (9 lines) in src/client/anthropic/client.ts:1175"}, "properties": {"repobilityId": "025eceada19538f7", "scanner": "scanner-primary", "fingerprint": "081b64e00d87b690", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-7d937c9e83fb5744", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/auth/providers/github-copilot/index.ts:97"}, "properties": {"repobilityId": "7234a892b40dc14a", "scanner": "scanner-primary", "fingerprint": "7d937c9e83fb5744", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-7eb22e3c57c155da", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/auth/providers/xai-grok-build/oauth-client.ts:209"}, "properties": {"repobilityId": "e40b1e77391879e2", "scanner": "scanner-primary", "fingerprint": "7eb22e3c57c155da", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-21fca723c0734a2c", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/auth/providers/antigravity-oauth/oauth-client.ts:495"}, "properties": {"repobilityId": "747285828380be65", "scanner": "scanner-primary", "fingerprint": "21fca723c0734a2c", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-3068fd272af0bed5", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/auth/providers/oauth2/oauth2-client.ts:95"}, "properties": {"repobilityId": "14322310340b64c7", "scanner": "scanner-primary", "fingerprint": "3068fd272af0bed5", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-59a723b094893644", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/auth/providers/google-gemini-oauth/oauth-client.ts:533"}, "properties": {"repobilityId": "93351b913b691c18", "scanner": "scanner-primary", "fingerprint": "59a723b094893644", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-1553b10a276a6865", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/auth/providers/claude-code/oauth-client.ts:127"}, "properties": {"repobilityId": "1d5e91afc8b729b9", "scanner": "scanner-primary", "fingerprint": "1553b10a276a6865", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-1a474d3883b224b4", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/auth/providers/openai-codex/oauth-client.ts:174"}, "properties": {"repobilityId": "d0d937edef9b7f45", "scanner": "scanner-primary", "fingerprint": "1a474d3883b224b4", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-cc0f9d8e41b33b0e", "level": "note", "message": {"text": "11 env vars used in code but missing from .env.example"}, "properties": {"repobilityId": "c82cd8cd626c3599", "scanner": "scanner-primary", "fingerprint": "cc0f9d8e41b33b0e", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "config-drift"]}}]}]}