{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-711ff574fedbf4a7", "name": "Possibly dead Python function: generate", "shortDescription": {"text": "Possibly dead Python function: generate"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cb9c2d9458037965", "name": "Possibly dead Python function: write_binary", "shortDescription": {"text": "Possibly dead Python function: write_binary"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-463f53a75e72f347", "name": "Possibly dead Python function: read_binary", "shortDescription": {"text": "Possibly dead Python function: read_binary"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c0f4209c595b8936", "name": "Possibly dead Python function: downgrade", "shortDescription": {"text": "Possibly dead Python function: downgrade"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ea77d82ea0b5ce9f", "name": "Possibly dead Python function: downgrade", "shortDescription": {"text": "Possibly dead Python function: downgrade"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d5e33bdcbcb89b93", "name": "Possibly dead Python function: downgrade", "shortDescription": {"text": "Possibly dead Python function: downgrade"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1c4ab940c8c2b84d", "name": "Possibly dead Python function: downgrade", "shortDescription": {"text": "Possibly dead Python function: downgrade"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d20cc36f403ca017", "name": "Possibly dead Python function: downgrade", "shortDescription": {"text": "Possibly dead Python function: downgrade"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4380fbda976d9908", "name": "Possibly dead Python function: downgrade", "shortDescription": {"text": "Possibly dead Python function: downgrade"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-32bcff5a805e6aba", "name": "Possibly dead Python function: downgrade", "shortDescription": {"text": "Possibly dead Python function: downgrade"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d434930f37fe0510", "name": "Possibly dead Python function: downgrade", "shortDescription": {"text": "Possibly dead Python function: downgrade"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-45d6105fc4f20e60", "name": "Possibly dead Python function: downgrade", "shortDescription": {"text": "Possibly dead Python function: downgrade"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b68dbeae21888bf6", "name": "Possibly dead Python function: downgrade", "shortDescription": {"text": "Possibly dead Python function: downgrade"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a585c6d2dd349526", "name": "Possibly dead Python function: downgrade", "shortDescription": {"text": "Possibly dead Python function: downgrade"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e0cfca54314a0620", "name": "Possibly dead Python function: downgrade", "shortDescription": {"text": "Possibly dead Python function: downgrade"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c6032dd85957f832", "name": "Possibly dead Python function: downgrade", "shortDescription": {"text": "Possibly dead Python function: downgrade"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ec674c61108c6ea3", "name": "Possibly dead Python function: downgrade", "shortDescription": {"text": "Possibly dead Python function: downgrade"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-20941c68255ba980", "name": "Possibly dead Python function: merge_runs", "shortDescription": {"text": "Possibly dead Python function: merge_runs"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-34f96576777fe1e2", "name": "Possibly dead Python function: simplify_redlines", "shortDescription": {"text": "Possibly dead Python function: simplify_redlines"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d64e7d8766a6e6e8", "name": "Possibly dead Python function: infer_author", "shortDescription": {"text": "Possibly dead Python function: infer_author"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-64a124554dbf97e7", "name": "Possibly dead Python function: merge_runs", "shortDescription": {"text": "Possibly dead Python function: merge_runs"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2a5bcf0ab2a8d4c1", "name": "Possibly dead Python function: simplify_redlines", "shortDescription": {"text": "Possibly dead Python function: simplify_redlines"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-64e6df551fbb8e16", "name": "Possibly dead Python function: infer_author", "shortDescription": {"text": "Possibly dead Python function: infer_author"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-15538a9f31950222", "name": "Possibly dead Python function: merge_runs", "shortDescription": {"text": "Possibly dead Python function: merge_runs"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3379a3b284ba94c2", "name": "Possibly dead Python function: simplify_redlines", "shortDescription": {"text": "Possibly dead Python function: simplify_redlines"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-82ad3800bb8f2139", "name": "Possibly dead Python function: infer_author", "shortDescription": {"text": "Possibly dead Python function: infer_author"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-963cf93ec1818008", "name": "`truncate` class without `title=` for hover reveal \u2014 frontend/src/components/UserAttachments.tsx:97", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 frontend/src/components/UserAttachments.tsx:97"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-d56841e377638ad7", "name": "`truncate` class without `title=` for hover reveal \u2014 frontend/src/components/AccountMenu.tsx:67", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 frontend/src/components/AccountMenu.tsx:67"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-61323c6138e07e66", "name": "`truncate` class without `title=` for hover reveal \u2014 frontend/src/components/TopBar.tsx:52", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 frontend/src/components/TopBar.tsx:52"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-c1cebd80bfbe2c0e", "name": "`truncate` class without `title=` for hover reveal \u2014 frontend/src/components/ToolCallCard.tsx:109", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 frontend/src/components/ToolCallCard.tsx:109"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-a850cb28651e087c", "name": "`truncate` class without `title=` for hover reveal \u2014 frontend/src/components/NotificationListener.tsx:118", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 frontend/src/components/NotificationListener.tsx:118"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-fd65291f84fcc3fb", "name": "`truncate` class without `title=` for hover reveal \u2014 frontend/src/components/SessionList.tsx:107", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 frontend/src/components/SessionList.tsx:107"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-adcbef6ca7abcb4d", "name": "`truncate` class without `title=` for hover reveal \u2014 frontend/src/components/AgentHeader.tsx:85", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 frontend/src/components/AgentHeader.tsx:85"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-c82296f9988ca619", "name": "`truncate` class without `title=` for hover reveal \u2014 frontend/src/components/settings/SettingsNav.tsx:38", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 frontend/src/components/settings/SettingsNav.tsx:38"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-924616adb5bf5cb1", "name": "`truncate` class without `title=` for hover reveal \u2014 frontend/src/components/ui/SelectMenu.tsx:101", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 frontend/src/components/ui/SelectMenu.tsx:101"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-9701c80053f2d613", "name": "`truncate` class without `title=` for hover reveal \u2014 frontend/src/components/ui/SettingRow.tsx:24", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 frontend/src/components/ui/SettingRow.tsx:24"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-a5e290a4c8abfaa2", "name": "Icon-only button without accessible name \u2014 frontend/src/components/files/FileDrawer.tsx:44", "shortDescription": {"text": "Icon-only button without accessible name \u2014 frontend/src/components/files/FileDrawer.tsx:44"}, "fullDescription": {"text": "A `<button>` whose only child is a single glyph or symbol needs `title=` or `aria-label=` so screen readers (and tooltips on hover) work.\n\nWhy: P3 in CHECKLIST.md \u2014 icon-only buttons skipped a title.\nRule id: fq.button.no-label"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-674f738540706ae1", "name": "Icon-only button without accessible name \u2014 frontend/src/components/files/FilePreview.tsx:97", "shortDescription": {"text": "Icon-only button without accessible name \u2014 frontend/src/components/files/FilePreview.tsx:97"}, "fullDescription": {"text": "A `<button>` whose only child is a single glyph or symbol needs `title=` or `aria-label=` so screen readers (and tooltips on hover) work.\n\nWhy: P3 in CHECKLIST.md \u2014 icon-only buttons skipped a title.\nRule id: fq.button.no-label"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-30f2f1ed6fccc72c", "name": "`truncate` class without `title=` for hover reveal \u2014 frontend/src/components/files/FilePreview.tsx:80", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 frontend/src/components/files/FilePreview.tsx:80"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-6acbdc4acab8e212", "name": "`truncate` class without `title=` for hover reveal \u2014 frontend/src/components/files/FileList.tsx:54", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 frontend/src/components/files/FileList.tsx:54"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-a69912bb803303e6", "name": "`truncate` class without `title=` for hover reveal \u2014 frontend/src/components/slash/SlashPalette.tsx:39", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 frontend/src/components/slash/SlashPalette.tsx:39"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-de4e212379c60233", "name": "`truncate` class without `title=` for hover reveal \u2014 frontend/src/components/toggles/SkillsMenu.tsx:60", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 frontend/src/components/toggles/SkillsMenu.tsx:60"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-1fa903f2e71a8a48", "name": "`truncate` class without `title=` for hover reveal \u2014 frontend/src/components/toggles/ScheduledTasksMenu.tsx:98", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 frontend/src/components/toggles/ScheduledTasksMenu.tsx:98"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-9d6e0a681fbc6611", "name": "`truncate` class without `title=` for hover reveal \u2014 frontend/src/components/toggles/ToolsMenu.tsx:49", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 frontend/src/components/toggles/ToolsMenu.tsx:49"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-6d7ccdb78ee6c4ae", "name": "`truncate` class without `title=` for hover reveal \u2014 frontend/src/components/model/ModelMenu.tsx:105", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 frontend/src/components/model/ModelMenu.tsx:105"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-aa5acaa49eb8315b", "name": "Containers defined but no K8s/orchestration manifest found", "shortDescription": {"text": "Containers defined but no K8s/orchestration manifest found"}, "fullDescription": {"text": "Repo has Dockerfiles/compose but no Kubernetes/Nomad manifests. If the target deployment is K8s, the manifests may live in a separate ops repo."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e84ec17d284c64ec", "name": "Insecure pattern 'local_storage_auth_token' in frontend/src/store.ts:107", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/src/store.ts:107"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ce2de88036f9c5c6", "name": "Insecure pattern 'subprocess_shell_true' in services/worker/src/agent_cloud_worker/tools.py:69", "shortDescription": {"text": "Insecure pattern 'subprocess_shell_true' in services/worker/src/agent_cloud_worker/tools.py:69"}, "fullDescription": {"text": "Found a known-risky pattern (subprocess_shell_true). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-47b71d7e13e03bf5", "name": "Insecure pattern 'subprocess_shell_true' in services/sandbox/src/agent_cloud_sandbox/tools.py:61", "shortDescription": {"text": "Insecure pattern 'subprocess_shell_true' in services/sandbox/src/agent_cloud_sandbox/tools.py:61"}, "fullDescription": {"text": "Found a known-risky pattern (subprocess_shell_true). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 348 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 22 placeholder/mock markers across 10 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-f6fcdcac82075480", "name": "Agent instruction contains unpinned remote install: services/backend/src/agent_cloud_backend/skill_registry/skill-creato", "shortDescription": {"text": "Agent instruction contains unpinned remote install: services/backend/src/agent_cloud_backend/skill_registry/skill-creator/SKILL.md"}, "fullDescription": {"text": "Remote install commands in agent instructions are a supply-chain risk, especially when an agent can execute shell commands."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-240c6b75505c7348", "name": "Agent authority lacks a verifier contract: services/backend/src/agent_cloud_backend/skill_registry/docx/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: services/backend/src/agent_cloud_backend/skill_registry/docx/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-940211f9484a2a00", "name": "Agent instruction contains unpinned remote install: services/backend/src/agent_cloud_backend/skill_registry/docx/SKILL.m", "shortDescription": {"text": "Agent instruction contains unpinned remote install: services/backend/src/agent_cloud_backend/skill_registry/docx/SKILL.md"}, "fullDescription": {"text": "Remote install commands in agent instructions are a supply-chain risk, especially when an agent can execute shell commands."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-330eac12654d179e", "name": "Agent instruction contains unpinned remote install: services/backend/src/agent_cloud_backend/skill_registry/pptx/SKILL.m", "shortDescription": {"text": "Agent instruction contains unpinned remote install: services/backend/src/agent_cloud_backend/skill_registry/pptx/SKILL.md"}, "fullDescription": {"text": "Remote install commands in agent instructions are a supply-chain risk, especially when an agent can execute shell commands."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a7c08903a4e128e2", "name": "Commented-code block (5 lines) in frontend/src/chatText.ts:3", "shortDescription": {"text": "Commented-code block (5 lines) in frontend/src/chatText.ts:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-7b1339f667f14548", "name": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/src/api/auth.ts:23", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/src/api/auth.ts:23"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3ccb668f0f4184ca", "name": "Commented-code block (14 lines) in frontend/src/components/Markdown.tsx:20", "shortDescription": {"text": "Commented-code block (14 lines) in frontend/src/components/Markdown.tsx:20"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-0b636fa4bb64ba24", "name": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/src/components/files/FileList.tsx:6", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/src/components/files/FileList.tsx:6"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-83c9893a958f8474", "name": "Commented-code block (5 lines) in frontend/src/components/terminal/TerminalWindow.tsx:17", "shortDescription": {"text": "Commented-code block (5 lines) in frontend/src/components/terminal/TerminalWindow.tsx:17"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-a3782c1c2da260c1", "name": "Commented-code block (5 lines) in packages/common/src/agent_cloud_common/grpc_limits.py:3", "shortDescription": {"text": "Commented-code block (5 lines) in packages/common/src/agent_cloud_common/grpc_limits.py:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-96ec99cf26d768f7", "name": "Network/subprocess call without timeout or try/except \u2014 services/worker/src/agent_cloud_worker/tools.py:67", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 services/worker/src/agent_cloud_worker/tools.py:67"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-be40adeadee7d048", "name": "Commented-code block (5 lines) in services/worker/src/agent_cloud_worker/context.py:61", "shortDescription": {"text": "Commented-code block (5 lines) in services/worker/src/agent_cloud_worker/context.py:61"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-07ae47a94ffac17c", "name": "Network/subprocess call without timeout or try/except \u2014 services/sandbox/src/agent_cloud_sandbox/tools.py:59", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 services/sandbox/src/agent_cloud_sandbox/tools.py:59"}, "fullDescription": {"text": "`subprocess.Popen(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4e3bf73bbf9168e5", "name": "Commented-code block (6 lines) in services/sandbox/src/agent_cloud_sandbox/pty_session.py:14", "shortDescription": {"text": "Commented-code block (6 lines) in services/sandbox/src/agent_cloud_sandbox/pty_session.py:14"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-30cd1c93ecaa1e38", "name": "Commented-code block (5 lines) in services/backend/tests/conftest.py:82", "shortDescription": {"text": "Commented-code block (5 lines) in services/backend/tests/conftest.py:82"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-f01168fe3a03f48d", "name": "Commented-code block (7 lines) in services/backend/tests/test_turn_stream_e2e.py:28", "shortDescription": {"text": "Commented-code block (7 lines) in services/backend/tests/test_turn_stream_e2e.py:28"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-e6bc7ec87d3fb6b9", "name": "Commented-code block (6 lines) in services/backend/src/agent_cloud_backend/models/sandbox_registry.py:26", "shortDescription": {"text": "Commented-code block (6 lines) in services/backend/src/agent_cloud_backend/models/sandbox_registry.py:26"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-a4946a9eec883590", "name": "Commented-code block (6 lines) in services/backend/src/agent_cloud_backend/sandbox/deps.py:40", "shortDescription": {"text": "Commented-code block (6 lines) in services/backend/src/agent_cloud_backend/sandbox/deps.py:40"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-99376f494c697a36", "name": "Commented-code block (5 lines) in services/backend/src/agent_cloud_backend/skills/service.py:57", "shortDescription": {"text": "Commented-code block (5 lines) in services/backend/src/agent_cloud_backend/skills/service.py:57"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-eac6f41235a5bdde", "name": "Network/subprocess call without timeout or try/except \u2014 services/backend/src/agent_cloud_backend/skill_registry/docx/scr", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 services/backend/src/agent_cloud_backend/skill_registry/docx/scripts/office/soffice.py:14"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-15dc57d1b6829fdd", "name": "Network/subprocess call without timeout or try/except \u2014 services/backend/src/agent_cloud_backend/skill_registry/docx/scr", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 services/backend/src/agent_cloud_backend/skill_registry/docx/scripts/office/validators/redlining.py:138"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-abcb59809daebd16", "name": "Legacy-named symbol `xml_copy` in services/backend/src/agent_cloud_backend/skill_registry/docx/scripts/office/validators", "shortDescription": {"text": "Legacy-named symbol `xml_copy` in services/backend/src/agent_cloud_backend/skill_registry/docx/scripts/office/validators/base.py:705"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9998e8625036b4c7", "name": "Network/subprocess call without timeout or try/except \u2014 services/backend/src/agent_cloud_backend/skill_registry/pptx/scr", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 services/backend/src/agent_cloud_backend/skill_registry/pptx/scripts/thumbnail.py:161"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-608e871744c7fabb", "name": "Network/subprocess call without timeout or try/except \u2014 services/backend/src/agent_cloud_backend/skill_registry/pptx/scr", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 services/backend/src/agent_cloud_backend/skill_registry/pptx/scripts/office/soffice.py:14"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-29d773dcddaa5e7d", "name": "Network/subprocess call without timeout or try/except \u2014 services/backend/src/agent_cloud_backend/skill_registry/pptx/scr", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 services/backend/src/agent_cloud_backend/skill_registry/pptx/scripts/office/validators/redlining.py:138"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6e596325389af4ee", "name": "Legacy-named symbol `xml_copy` in services/backend/src/agent_cloud_backend/skill_registry/pptx/scripts/office/validators", "shortDescription": {"text": "Legacy-named symbol `xml_copy` in services/backend/src/agent_cloud_backend/skill_registry/pptx/scripts/office/validators/base.py:705"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1c7b0b89719f3308", "name": "Network/subprocess call without timeout or try/except \u2014 services/backend/src/agent_cloud_backend/skill_registry/xlsx/scr", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 services/backend/src/agent_cloud_backend/skill_registry/xlsx/scripts/recalc.py:92"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e87e4c92d6124693", "name": "Network/subprocess call without timeout or try/except \u2014 services/backend/src/agent_cloud_backend/skill_registry/xlsx/scr", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 services/backend/src/agent_cloud_backend/skill_registry/xlsx/scripts/office/soffice.py:14"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ec372f22a03beb31", "name": "Network/subprocess call without timeout or try/except \u2014 services/backend/src/agent_cloud_backend/skill_registry/xlsx/scr", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 services/backend/src/agent_cloud_backend/skill_registry/xlsx/scripts/office/validators/redlining.py:138"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4a77b09bab461fdc", "name": "Legacy-named symbol `xml_copy` in services/backend/src/agent_cloud_backend/skill_registry/xlsx/scripts/office/validators", "shortDescription": {"text": "Legacy-named symbol `xml_copy` in services/backend/src/agent_cloud_backend/skill_registry/xlsx/scripts/office/validators/base.py:705"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b334d875f2339fa1", "name": "5 env vars used in code but missing from .env.example", "shortDescription": {"text": "5 env vars used in code but missing from .env.example"}, "fullDescription": {"text": "Drift between code and config docs. The first few: `AGENT_CLOUD_SANDBOX_BASE`, `AGENT_CLOUD_SANDBOX_BASH_TIMEOUT`, `AGENT_CLOUD_SANDBOX_PORT`, `AGENT_CLOUD_SANDBOX_TOKEN`, `VITE_BACKEND_URL`. Add them (with a placeholder/comment) to .env.example so onboarding doesn't break."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fe1d9311d6aee734", "name": "Near-duplicate function bodies in 12 places", "shortDescription": {"text": "Near-duplicate function bodies in 12 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\npackages/common/src/agent_cloud/v1/sandbox_pb2_grpc.py:ExecTool, packages/common/src/agent_cloud/v1/sandbox_pb2_grpc.py:ExecTool, packages/common/src/agent_cloud/v1/worker_pb2_grpc.py:RunTurn, packages/common/src/agent_cloud/v1/worker_pb2_grpc.py:RunTurnStream\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2c04133e54348533", "name": "Near-duplicate function bodies in 2 places", "shortDescription": {"text": "Near-duplicate function bodies in 2 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\npackages/common/src/agent_cloud/v1/sandbox_pb2_grpc.py:WriteBinary, packages/common/src/agent_cloud/v1/sandbox_pb2_grpc.py:WriteBinary\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-be46ea126aa5d8dc", "name": "Near-duplicate function bodies in 3 places", "shortDescription": {"text": "Near-duplicate function bodies in 3 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nservices/backend/src/agent_cloud_backend/api/memory_entries.py:get_memory, services/backend/src/agent_cloud_backend/api/memory_entries.py:clear_memory, services/backend/src/agent_cloud_backend/api/context_documents.py:list_documents\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9efd75798952cc61", "name": "Dangling fetch: POST /api/auth/refresh (frontend/src/api/auth.ts:23)", "shortDescription": {"text": "Dangling fetch: POST /api/auth/refresh (frontend/src/api/auth.ts:23)"}, "fullDescription": {"text": "`frontend/src/api/auth.ts:23` calls `POST /api/auth/refresh` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/auth/refresh`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-5baa8971ebe192a1", "name": "Unused endpoint: GET /", "shortDescription": {"text": "Unused endpoint: GET /"}, "fullDescription": {"text": "`services/backend/src/agent_cloud_backend/api/notifications.py` declares `GET /` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-900368d68d13d839", "name": "Unused endpoint: POST /mark-delivered", "shortDescription": {"text": "Unused endpoint: POST /mark-delivered"}, "fullDescription": {"text": "`services/backend/src/agent_cloud_backend/api/notifications.py` declares `POST /mark-delivered` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7a009b1a56794f45", "name": "Unused endpoint: POST /", "shortDescription": {"text": "Unused endpoint: POST /"}, "fullDescription": {"text": "`services/backend/src/agent_cloud_backend/api/scheduled_tasks.py` declares `POST /` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cecf400c02427097", "name": "Unused endpoint: PATCH /{task_id}", "shortDescription": {"text": "Unused endpoint: PATCH /{task_id}"}, "fullDescription": {"text": "`services/backend/src/agent_cloud_backend/api/scheduled_tasks.py` declares `PATCH /{task_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9c055f3f8f83ed5f", "name": "Unused endpoint: DELETE /{task_id}", "shortDescription": {"text": "Unused endpoint: DELETE /{task_id}"}, "fullDescription": {"text": "`services/backend/src/agent_cloud_backend/api/scheduled_tasks.py` declares `DELETE /{task_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8795305b4a5d6126", "name": "Unused endpoint: POST /{task_id}/run-now", "shortDescription": {"text": "Unused endpoint: POST /{task_id}/run-now"}, "fullDescription": {"text": "`services/backend/src/agent_cloud_backend/api/scheduled_tasks.py` declares `POST /{task_id}/run-now` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-359f35937bed4935", "name": "Unused endpoint: GET /registry", "shortDescription": {"text": "Unused endpoint: GET /registry"}, "fullDescription": {"text": "`services/backend/src/agent_cloud_backend/api/skills.py` declares `GET /registry` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-083fba8d34bf5011", "name": "Unused endpoint: POST /install", "shortDescription": {"text": "Unused endpoint: POST /install"}, "fullDescription": {"text": "`services/backend/src/agent_cloud_backend/api/skills.py` declares `POST /install` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ab6489535547644e", "name": "Unused endpoint: POST /install-from-workspace", "shortDescription": {"text": "Unused endpoint: POST /install-from-workspace"}, "fullDescription": {"text": "`services/backend/src/agent_cloud_backend/api/skills.py` declares `POST /install-from-workspace` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6236b283b79811b8", "name": "Unused endpoint: POST /upload", "shortDescription": {"text": "Unused endpoint: POST /upload"}, "fullDescription": {"text": "`services/backend/src/agent_cloud_backend/api/skills.py` declares `POST /upload` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c829b9b967978974", "name": "Unused endpoint: DELETE /{skill_id}", "shortDescription": {"text": "Unused endpoint: DELETE /{skill_id}"}, "fullDescription": {"text": "`services/backend/src/agent_cloud_backend/api/skills.py` declares `DELETE /{skill_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-67d28fa8cd6bb12f", "name": "Unused endpoint: PUT /", "shortDescription": {"text": "Unused endpoint: PUT /"}, "fullDescription": {"text": "`services/backend/src/agent_cloud_backend/api/memory_entries.py` declares `PUT /` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3b30f4c0994a30b4", "name": "Unused endpoint: DELETE /", "shortDescription": {"text": "Unused endpoint: DELETE /"}, "fullDescription": {"text": "`services/backend/src/agent_cloud_backend/api/memory_entries.py` declares `DELETE /` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2ab9bf5db6820af4", "name": "Unused endpoint: GET /models", "shortDescription": {"text": "Unused endpoint: GET /models"}, "fullDescription": {"text": "`services/backend/src/agent_cloud_backend/api/platform.py` declares `GET /models` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-304b6f2b403d93f7", "name": "Unused endpoint: POST /register", "shortDescription": {"text": "Unused endpoint: POST /register"}, "fullDescription": {"text": "`services/backend/src/agent_cloud_backend/api/auth.py` declares `POST /register` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-618721b912bad1c2", "name": "Unused endpoint: POST /login", "shortDescription": {"text": "Unused endpoint: POST /login"}, "fullDescription": {"text": "`services/backend/src/agent_cloud_backend/api/auth.py` declares `POST /login` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7ce17d6b092a81ca", "name": "Unused endpoint: POST /refresh", "shortDescription": {"text": "Unused endpoint: POST /refresh"}, "fullDescription": {"text": "`services/backend/src/agent_cloud_backend/api/auth.py` declares `POST /refresh` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-99fc36db98c134ce", "name": "Unused endpoint: POST /logout", "shortDescription": {"text": "Unused endpoint: POST /logout"}, "fullDescription": {"text": "`services/backend/src/agent_cloud_backend/api/auth.py` declares `POST /logout` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fd1dc91abf32142d", "name": "Unused endpoint: GET /me", "shortDescription": {"text": "Unused endpoint: GET /me"}, "fullDescription": {"text": "`services/backend/src/agent_cloud_backend/api/auth.py` declares `GET /me` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5f4ee569e1562771", "name": "Unused endpoint: POST /stream", "shortDescription": {"text": "Unused endpoint: POST /stream"}, "fullDescription": {"text": "`services/backend/src/agent_cloud_backend/api/turn.py` declares `POST /stream` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-35a741079ddc6fcc", "name": "Unused endpoint: GET /stream", "shortDescription": {"text": "Unused endpoint: GET /stream"}, "fullDescription": {"text": "`services/backend/src/agent_cloud_backend/api/turn.py` declares `GET /stream` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6b4d3a1c30158c0e", "name": "Unused endpoint: POST /cancel", "shortDescription": {"text": "Unused endpoint: POST /cancel"}, "fullDescription": {"text": "`services/backend/src/agent_cloud_backend/api/turn.py` declares `POST /cancel` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2107157724647831", "name": "Unused endpoint: GET /{agent_id}/skills", "shortDescription": {"text": "Unused endpoint: GET /{agent_id}/skills"}, "fullDescription": {"text": "`services/backend/src/agent_cloud_backend/api/agent_skills.py` declares `GET /{agent_id}/skills` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8ac4888c16fe6c83", "name": "Unused endpoint: PUT /{agent_id}/skills", "shortDescription": {"text": "Unused endpoint: PUT /{agent_id}/skills"}, "fullDescription": {"text": "`services/backend/src/agent_cloud_backend/api/agent_skills.py` declares `PUT /{agent_id}/skills` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c82522b225b7de39", "name": "Unused endpoint: DELETE /{model_id}", "shortDescription": {"text": "Unused endpoint: DELETE /{model_id}"}, "fullDescription": {"text": "`services/backend/src/agent_cloud_backend/api/user_models.py` declares `DELETE /{model_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b8a7cb1f1998fe13", "name": "Unused endpoint: DELETE /{cred_id}", "shortDescription": {"text": "Unused endpoint: DELETE /{cred_id}"}, "fullDescription": {"text": "`services/backend/src/agent_cloud_backend/api/credentials.py` declares `DELETE /{cred_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f5ec41c3b06660d6", "name": "Unused endpoint: GET /index", "shortDescription": {"text": "Unused endpoint: GET /index"}, "fullDescription": {"text": "`services/backend/src/agent_cloud_backend/api/files.py` declares `GET /index` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a9f772e74c781e7b", "name": "Unused endpoint: GET /raw", "shortDescription": {"text": "Unused endpoint: GET /raw"}, "fullDescription": {"text": "`services/backend/src/agent_cloud_backend/api/files.py` declares `GET /raw` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9043216588911765", "name": "Unused endpoint: POST /mkdir", "shortDescription": {"text": "Unused endpoint: POST /mkdir"}, "fullDescription": {"text": "`services/backend/src/agent_cloud_backend/api/files.py` declares `POST /mkdir` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c6ee2f6f26400740", "name": "Unused endpoint: POST /move", "shortDescription": {"text": "Unused endpoint: POST /move"}, "fullDescription": {"text": "`services/backend/src/agent_cloud_backend/api/files.py` declares `POST /move` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2df4cdb5233e7a00", "name": "Unused endpoint: PATCH /{agent_id}", "shortDescription": {"text": "Unused endpoint: PATCH /{agent_id}"}, "fullDescription": {"text": "`services/backend/src/agent_cloud_backend/api/agent_configs.py` declares `PATCH /{agent_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ddfdc003b7b050cb", "name": "Unused endpoint: DELETE /{agent_id}", "shortDescription": {"text": "Unused endpoint: DELETE /{agent_id}"}, "fullDescription": {"text": "`services/backend/src/agent_cloud_backend/api/agent_configs.py` declares `DELETE /{agent_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-593d9b4072f92e9f", "name": "Unused endpoint: PATCH /{session_id}", "shortDescription": {"text": "Unused endpoint: PATCH /{session_id}"}, "fullDescription": {"text": "`services/backend/src/agent_cloud_backend/api/sessions.py` declares `PATCH /{session_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-173ad25a6a1cb443", "name": "Unused endpoint: DELETE /{session_id}", "shortDescription": {"text": "Unused endpoint: DELETE /{session_id}"}, "fullDescription": {"text": "`services/backend/src/agent_cloud_backend/api/sessions.py` declares `DELETE /{session_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2740f15915f9f506", "name": "Unused endpoint: POST /{session_id}/compact", "shortDescription": {"text": "Unused endpoint: POST /{session_id}/compact"}, "fullDescription": {"text": "`services/backend/src/agent_cloud_backend/api/sessions.py` declares `POST /{session_id}/compact` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-091905e511b2a496", "name": "Unused endpoint: POST /{session_id}/rollback", "shortDescription": {"text": "Unused endpoint: POST /{session_id}/rollback"}, "fullDescription": {"text": "`services/backend/src/agent_cloud_backend/api/sessions.py` declares `POST /{session_id}/rollback` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cd381e4201f64078", "name": "Unused endpoint: POST /{session_id}/fork", "shortDescription": {"text": "Unused endpoint: POST /{session_id}/fork"}, "fullDescription": {"text": "`services/backend/src/agent_cloud_backend/api/sessions.py` declares `POST /{session_id}/fork` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7b6137cc1cbcfdd1", "name": "Unused endpoint: POST /{session_id}/mark-read", "shortDescription": {"text": "Unused endpoint: POST /{session_id}/mark-read"}, "fullDescription": {"text": "`services/backend/src/agent_cloud_backend/api/sessions.py` declares `POST /{session_id}/mark-read` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/22896"}, "properties": {"repository": "wuhaowen0714/agent-cloud", "repoUrl": "https://github.com/wuhaowen0714/agent-cloud", "branch": "main"}, "results": [{"ruleId": "scanner-711ff574fedbf4a7", "level": "note", "message": {"text": "Possibly dead Python function: generate"}, "properties": {"repobilityId": "76d61877ca82882a", "scanner": "scanner-primary", "fingerprint": "711ff574fedbf4a7", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "services/worker/src/agent_cloud_worker/image_gen.py:147"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-cb9c2d9458037965", "level": "note", "message": {"text": "Possibly dead Python function: write_binary"}, "properties": {"repobilityId": "30add904a4016bf9", "scanner": "scanner-primary", "fingerprint": "cb9c2d9458037965", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "services/worker/src/agent_cloud_worker/sandbox_executor.py:88"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-463f53a75e72f347", "level": "note", "message": {"text": "Possibly dead Python function: read_binary"}, "properties": {"repobilityId": "2f7690f190375d4d", "scanner": "scanner-primary", "fingerprint": "463f53a75e72f347", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "services/worker/src/agent_cloud_worker/sandbox_executor.py:114"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c0f4209c595b8936", "level": "note", "message": {"text": "Possibly dead Python function: downgrade"}, "properties": {"repobilityId": "c03debbf11efa0c5", "scanner": "scanner-primary", "fingerprint": "c0f4209c595b8936", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "services/backend/alembic/versions/c3d4e5f6a7b8_user_models.py:41"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ea77d82ea0b5ce9f", "level": "note", "message": {"text": "Possibly dead Python function: downgrade"}, "properties": {"repobilityId": "c03debbf11efa0c5", "scanner": "scanner-primary", "fingerprint": "ea77d82ea0b5ce9f", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "services/backend/alembic/versions/b1c2d3e4f5a6_scheduled_tasks.py:78"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d5e33bdcbcb89b93", "level": "note", "message": {"text": "Possibly dead Python function: downgrade"}, "properties": {"repobilityId": "c03debbf11efa0c5", "scanner": "scanner-primary", "fingerprint": "d5e33bdcbcb89b93", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "services/backend/alembic/versions/59592b11f009_add_sandbox_registry.py:51"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1c4ab940c8c2b84d", "level": "note", "message": {"text": "Possibly dead Python function: downgrade"}, "properties": {"repobilityId": "c03debbf11efa0c5", "scanner": "scanner-primary", "fingerprint": "1c4ab940c8c2b84d", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "services/backend/alembic/versions/e3f4a5b6c7d8_provider_credentials.py:45"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d20cc36f403ca017", "level": "note", "message": {"text": "Possibly dead Python function: downgrade"}, "properties": {"repobilityId": "c03debbf11efa0c5", "scanner": "scanner-primary", "fingerprint": "d20cc36f403ca017", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "services/backend/alembic/versions/a1b2c3d4e5f6_session_last_context_tokens.py:28"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4380fbda976d9908", "level": "note", "message": {"text": "Possibly dead Python function: downgrade"}, "properties": {"repobilityId": "c03debbf11efa0c5", "scanner": "scanner-primary", "fingerprint": "4380fbda976d9908", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "services/backend/alembic/versions/118b49942e83_add_active_sandbox_per_user_unique_index.py:37"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-32bcff5a805e6aba", "level": "note", "message": {"text": "Possibly dead Python function: downgrade"}, "properties": {"repobilityId": "c03debbf11efa0c5", "scanner": "scanner-primary", "fingerprint": "32bcff5a805e6aba", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "services/backend/alembic/versions/01eb13f3a1e0_initial_schema.py:154"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d434930f37fe0510", "level": "note", "message": {"text": "Possibly dead Python function: downgrade"}, "properties": {"repobilityId": "c03debbf11efa0c5", "scanner": "scanner-primary", "fingerprint": "d434930f37fe0510", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "services/backend/alembic/versions/d5e6f7a8b9c0_sandbox_auth_token.py:31"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-45d6105fc4f20e60", "level": "note", "message": {"text": "Possibly dead Python function: downgrade"}, "properties": {"repobilityId": "c03debbf11efa0c5", "scanner": "scanner-primary", "fingerprint": "45d6105fc4f20e60", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "services/backend/alembic/versions/d2e3f4a5b6c7_auth.py:49"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b68dbeae21888bf6", "level": "note", "message": {"text": "Possibly dead Python function: downgrade"}, "properties": {"repobilityId": "c03debbf11efa0c5", "scanner": "scanner-primary", "fingerprint": "b68dbeae21888bf6", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "services/backend/alembic/versions/c2d3e4f5a6b7_notifications.py:46"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a585c6d2dd349526", "level": "note", "message": {"text": "Possibly dead Python function: downgrade"}, "properties": {"repobilityId": "c03debbf11efa0c5", "scanner": "scanner-primary", "fingerprint": "a585c6d2dd349526", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "services/backend/alembic/versions/f1a2b3c4d5e6_session_models.py:78"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e0cfca54314a0620", "level": "note", "message": {"text": "Possibly dead Python function: downgrade"}, "properties": {"repobilityId": "c03debbf11efa0c5", "scanner": "scanner-primary", "fingerprint": "e0cfca54314a0620", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "services/backend/alembic/versions/7a1b2c3d4e5f_add_skills_tables.py:56"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c6032dd85957f832", "level": "note", "message": {"text": "Possibly dead Python function: downgrade"}, "properties": {"repobilityId": "c03debbf11efa0c5", "scanner": "scanner-primary", "fingerprint": "c6032dd85957f832", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "services/backend/alembic/versions/c1d2e3f4a5b6_session_summary_fields.py:32"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ec674c61108c6ea3", "level": "note", "message": {"text": "Possibly dead Python function: downgrade"}, "properties": {"repobilityId": "c03debbf11efa0c5", "scanner": "scanner-primary", "fingerprint": "ec674c61108c6ea3", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "services/backend/alembic/versions/f4a5b6c7d8e9_memory_versioning.py:51"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-20941c68255ba980", "level": "note", "message": {"text": "Possibly dead Python function: merge_runs"}, "properties": {"repobilityId": "435767544049256d", "scanner": "scanner-primary", "fingerprint": "20941c68255ba980", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "services/backend/src/agent_cloud_backend/skill_registry/docx/scripts/office/helpers/merge_runs.py:16"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-34f96576777fe1e2", "level": "note", "message": {"text": "Possibly dead Python function: simplify_redlines"}, "properties": {"repobilityId": "cfedaef01c821ad9", "scanner": "scanner-primary", "fingerprint": "34f96576777fe1e2", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "services/backend/src/agent_cloud_backend/skill_registry/docx/scripts/office/helpers/simplify_redlines.py:22"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d64e7d8766a6e6e8", "level": "note", "message": {"text": "Possibly dead Python function: infer_author"}, "properties": {"repobilityId": "82897dcd4c40919c", "scanner": "scanner-primary", "fingerprint": "d64e7d8766a6e6e8", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "services/backend/src/agent_cloud_backend/skill_registry/docx/scripts/office/helpers/simplify_redlines.py:172"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-64a124554dbf97e7", "level": "note", "message": {"text": "Possibly dead Python function: merge_runs"}, "properties": {"repobilityId": "435767544049256d", "scanner": "scanner-primary", "fingerprint": "64a124554dbf97e7", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "services/backend/src/agent_cloud_backend/skill_registry/pptx/scripts/office/helpers/merge_runs.py:16"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2a5bcf0ab2a8d4c1", "level": "note", "message": {"text": "Possibly dead Python function: simplify_redlines"}, "properties": {"repobilityId": "cfedaef01c821ad9", "scanner": "scanner-primary", "fingerprint": "2a5bcf0ab2a8d4c1", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "services/backend/src/agent_cloud_backend/skill_registry/pptx/scripts/office/helpers/simplify_redlines.py:22"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-64e6df551fbb8e16", "level": "note", "message": {"text": "Possibly dead Python function: infer_author"}, "properties": {"repobilityId": "82897dcd4c40919c", "scanner": "scanner-primary", "fingerprint": "64e6df551fbb8e16", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "services/backend/src/agent_cloud_backend/skill_registry/pptx/scripts/office/helpers/simplify_redlines.py:172"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-15538a9f31950222", "level": "note", "message": {"text": "Possibly dead Python function: merge_runs"}, "properties": {"repobilityId": "435767544049256d", "scanner": "scanner-primary", "fingerprint": "15538a9f31950222", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "services/backend/src/agent_cloud_backend/skill_registry/xlsx/scripts/office/helpers/merge_runs.py:16"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3379a3b284ba94c2", "level": "note", "message": {"text": "Possibly dead Python function: simplify_redlines"}, "properties": {"repobilityId": "cfedaef01c821ad9", "scanner": "scanner-primary", "fingerprint": "3379a3b284ba94c2", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "services/backend/src/agent_cloud_backend/skill_registry/xlsx/scripts/office/helpers/simplify_redlines.py:22"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-82ad3800bb8f2139", "level": "note", "message": {"text": "Possibly dead Python function: infer_author"}, "properties": {"repobilityId": "82897dcd4c40919c", "scanner": "scanner-primary", "fingerprint": "82ad3800bb8f2139", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "services/backend/src/agent_cloud_backend/skill_registry/xlsx/scripts/office/helpers/simplify_redlines.py:172"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-963cf93ec1818008", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 frontend/src/components/UserAttachments.tsx:97"}, "properties": {"repobilityId": "fbfef229fc36475e", "scanner": "scanner-primary", "fingerprint": "963cf93ec1818008", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-d56841e377638ad7", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 frontend/src/components/AccountMenu.tsx:67"}, "properties": {"repobilityId": "ac06b223ea05d749", "scanner": "scanner-primary", "fingerprint": "d56841e377638ad7", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-61323c6138e07e66", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 frontend/src/components/TopBar.tsx:52"}, "properties": {"repobilityId": "4cacbea1d64d2dd4", "scanner": "scanner-primary", "fingerprint": "61323c6138e07e66", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-c1cebd80bfbe2c0e", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 frontend/src/components/ToolCallCard.tsx:109"}, "properties": {"repobilityId": "4f705a1a5d454084", "scanner": "scanner-primary", "fingerprint": "c1cebd80bfbe2c0e", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-a850cb28651e087c", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 frontend/src/components/NotificationListener.tsx:118"}, "properties": {"repobilityId": "96109d29bfef3691", "scanner": "scanner-primary", "fingerprint": "a850cb28651e087c", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-fd65291f84fcc3fb", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 frontend/src/components/SessionList.tsx:107"}, "properties": {"repobilityId": "3deec8a6ede4c1b4", "scanner": "scanner-primary", "fingerprint": "fd65291f84fcc3fb", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-adcbef6ca7abcb4d", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 frontend/src/components/AgentHeader.tsx:85"}, "properties": {"repobilityId": "d523d3b30fe79118", "scanner": "scanner-primary", "fingerprint": "adcbef6ca7abcb4d", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-c82296f9988ca619", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 frontend/src/components/settings/SettingsNav.tsx:38"}, "properties": {"repobilityId": "1ddb8303d29a4756", "scanner": "scanner-primary", "fingerprint": "c82296f9988ca619", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-924616adb5bf5cb1", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 frontend/src/components/ui/SelectMenu.tsx:101"}, "properties": {"repobilityId": "91320022eb080f39", "scanner": "scanner-primary", "fingerprint": "924616adb5bf5cb1", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-9701c80053f2d613", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 frontend/src/components/ui/SettingRow.tsx:24"}, "properties": {"repobilityId": "55ffae80f25ecea2", "scanner": "scanner-primary", "fingerprint": "9701c80053f2d613", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-a5e290a4c8abfaa2", "level": "note", "message": {"text": "Icon-only button without accessible name \u2014 frontend/src/components/files/FileDrawer.tsx:44"}, "properties": {"repobilityId": "bea7da205a94f503", "scanner": "scanner-primary", "fingerprint": "a5e290a4c8abfaa2", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.button.no-label"]}}, {"ruleId": "scanner-674f738540706ae1", "level": "note", "message": {"text": "Icon-only button without accessible name \u2014 frontend/src/components/files/FilePreview.tsx:97"}, "properties": {"repobilityId": "63f3eca86a2d0f94", "scanner": "scanner-primary", "fingerprint": "674f738540706ae1", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.button.no-label"]}}, {"ruleId": "scanner-30f2f1ed6fccc72c", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 frontend/src/components/files/FilePreview.tsx:80"}, "properties": {"repobilityId": "1699276981ccd4af", "scanner": "scanner-primary", "fingerprint": "30f2f1ed6fccc72c", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-6acbdc4acab8e212", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 frontend/src/components/files/FileList.tsx:54"}, "properties": {"repobilityId": "44eb8b95a84a8795", "scanner": "scanner-primary", "fingerprint": "6acbdc4acab8e212", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-a69912bb803303e6", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 frontend/src/components/slash/SlashPalette.tsx:39"}, "properties": {"repobilityId": "df0566e244e50cdf", "scanner": "scanner-primary", "fingerprint": "a69912bb803303e6", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-de4e212379c60233", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 frontend/src/components/toggles/SkillsMenu.tsx:60"}, "properties": {"repobilityId": "5b818a6269eded4f", "scanner": "scanner-primary", "fingerprint": "de4e212379c60233", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-1fa903f2e71a8a48", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 frontend/src/components/toggles/ScheduledTasksMenu.tsx:98"}, "properties": {"repobilityId": "0282c3ca7284def9", "scanner": "scanner-primary", "fingerprint": "1fa903f2e71a8a48", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-9d6e0a681fbc6611", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 frontend/src/components/toggles/ToolsMenu.tsx:49"}, "properties": {"repobilityId": "df3e760050d449c7", "scanner": "scanner-primary", "fingerprint": "9d6e0a681fbc6611", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-6d7ccdb78ee6c4ae", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 frontend/src/components/model/ModelMenu.tsx:105"}, "properties": {"repobilityId": "78c7477de7b0610e", "scanner": "scanner-primary", "fingerprint": "6d7ccdb78ee6c4ae", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-aa5acaa49eb8315b", "level": "note", "message": {"text": "Containers defined but no K8s/orchestration manifest found"}, "properties": {"repobilityId": "b230ea9b68736081", "scanner": "scanner-primary", "fingerprint": "aa5acaa49eb8315b", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["coverage", "deployment"]}}, {"ruleId": "scanner-e84ec17d284c64ec", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/src/store.ts:107"}, "properties": {"repobilityId": "210ea0acc4c60473", "scanner": "scanner-primary", "fingerprint": "e84ec17d284c64ec", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/store.ts"}, "region": {"startLine": 107}}}]}, {"ruleId": "scanner-ce2de88036f9c5c6", "level": "warning", "message": {"text": "Insecure pattern 'subprocess_shell_true' in services/worker/src/agent_cloud_worker/tools.py:69"}, "properties": {"repobilityId": "d0c8d1994ad737a7", "scanner": "scanner-primary", "fingerprint": "ce2de88036f9c5c6", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "subprocess_shell_true"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "services/worker/src/agent_cloud_worker/tools.py"}, "region": {"startLine": 69}}}]}, {"ruleId": "scanner-47b71d7e13e03bf5", "level": "warning", "message": {"text": "Insecure pattern 'subprocess_shell_true' in services/sandbox/src/agent_cloud_sandbox/tools.py:61"}, "properties": {"repobilityId": "b1613d4ebfb13adb", "scanner": "scanner-primary", "fingerprint": "47b71d7e13e03bf5", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "subprocess_shell_true"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "services/sandbox/src/agent_cloud_sandbox/tools.py"}, "region": {"startLine": 61}}}]}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "361f933e3379c9a8", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "8f97778c445c2c59", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "01a7bb8453961ad9", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "dc79206a04bac324", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "6a3f59f1b330d29f", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-f6fcdcac82075480", "level": "warning", "message": {"text": "Agent instruction contains unpinned remote install: services/backend/src/agent_cloud_backend/skill_registry/skill-creator/SKILL.md"}, "properties": {"repobilityId": "032ecf7bbe3c54ee", "scanner": "scanner-primary", "fingerprint": "f6fcdcac82075480", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "supply-chain", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "services/backend/src/agent_cloud_backend/skill_registry/skill-creator/SKILL.md"}, "region": {"startLine": 52}}}]}, {"ruleId": "scanner-240c6b75505c7348", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: services/backend/src/agent_cloud_backend/skill_registry/docx/SKILL.md"}, "properties": {"repobilityId": "bd71eef813378636", "scanner": "scanner-primary", "fingerprint": "240c6b75505c7348", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "services/backend/src/agent_cloud_backend/skill_registry/docx/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-940211f9484a2a00", "level": "warning", "message": {"text": "Agent instruction contains unpinned remote install: services/backend/src/agent_cloud_backend/skill_registry/docx/SKILL.md"}, "properties": {"repobilityId": "4d8622e3395f01bf", "scanner": "scanner-primary", "fingerprint": "940211f9484a2a00", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "supply-chain", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "services/backend/src/agent_cloud_backend/skill_registry/docx/SKILL.md"}, "region": {"startLine": 58}}}]}, {"ruleId": "scanner-330eac12654d179e", "level": "warning", "message": {"text": "Agent instruction contains unpinned remote install: services/backend/src/agent_cloud_backend/skill_registry/pptx/SKILL.md"}, "properties": {"repobilityId": "dc165ed0029765c7", "scanner": "scanner-primary", "fingerprint": "330eac12654d179e", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "supply-chain", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "services/backend/src/agent_cloud_backend/skill_registry/pptx/SKILL.md"}, "region": {"startLine": 230}}}]}, {"ruleId": "scanner-a7c08903a4e128e2", "level": "none", "message": {"text": "Commented-code block (5 lines) in frontend/src/chatText.ts:3"}, "properties": {"repobilityId": "6bb868163f28b794", "scanner": "scanner-primary", "fingerprint": "a7c08903a4e128e2", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-7b1339f667f14548", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/src/api/auth.ts:23"}, "properties": {"repobilityId": "ba06c58e3664aa32", "scanner": "scanner-primary", "fingerprint": "7b1339f667f14548", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-3ccb668f0f4184ca", "level": "none", "message": {"text": "Commented-code block (14 lines) in frontend/src/components/Markdown.tsx:20"}, "properties": {"repobilityId": "bd057c24dff7240e", "scanner": "scanner-primary", "fingerprint": "3ccb668f0f4184ca", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-0b636fa4bb64ba24", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/src/components/files/FileList.tsx:6"}, "properties": {"repobilityId": "11ed03e5c58b2ba3", "scanner": "scanner-primary", "fingerprint": "0b636fa4bb64ba24", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-83c9893a958f8474", "level": "none", "message": {"text": "Commented-code block (5 lines) in frontend/src/components/terminal/TerminalWindow.tsx:17"}, "properties": {"repobilityId": "2cca5617979a3ef7", "scanner": "scanner-primary", "fingerprint": "83c9893a958f8474", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-a3782c1c2da260c1", "level": "none", "message": {"text": "Commented-code block (5 lines) in packages/common/src/agent_cloud_common/grpc_limits.py:3"}, "properties": {"repobilityId": "07d0b128cdec17c9", "scanner": "scanner-primary", "fingerprint": "a3782c1c2da260c1", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-96ec99cf26d768f7", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 services/worker/src/agent_cloud_worker/tools.py:67"}, "properties": {"repobilityId": "906b32163816ef26", "scanner": "scanner-primary", "fingerprint": "96ec99cf26d768f7", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-be40adeadee7d048", "level": "none", "message": {"text": "Commented-code block (5 lines) in services/worker/src/agent_cloud_worker/context.py:61"}, "properties": {"repobilityId": "572a14b94d2a2b86", "scanner": "scanner-primary", "fingerprint": "be40adeadee7d048", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-07ae47a94ffac17c", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 services/sandbox/src/agent_cloud_sandbox/tools.py:59"}, "properties": {"repobilityId": "3541c375b125fd57", "scanner": "scanner-primary", "fingerprint": "07ae47a94ffac17c", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-4e3bf73bbf9168e5", "level": "none", "message": {"text": "Commented-code block (6 lines) in services/sandbox/src/agent_cloud_sandbox/pty_session.py:14"}, "properties": {"repobilityId": "0e4e68b0f2e75a26", "scanner": "scanner-primary", "fingerprint": "4e3bf73bbf9168e5", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-30cd1c93ecaa1e38", "level": "none", "message": {"text": "Commented-code block (5 lines) in services/backend/tests/conftest.py:82"}, "properties": {"repobilityId": "0fe100ef57f4fab6", "scanner": "scanner-primary", "fingerprint": "30cd1c93ecaa1e38", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-f01168fe3a03f48d", "level": "none", "message": {"text": "Commented-code block (7 lines) in services/backend/tests/test_turn_stream_e2e.py:28"}, "properties": {"repobilityId": "5840ad8cd979bc8f", "scanner": "scanner-primary", "fingerprint": "f01168fe3a03f48d", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-e6bc7ec87d3fb6b9", "level": "none", "message": {"text": "Commented-code block (6 lines) in services/backend/src/agent_cloud_backend/models/sandbox_registry.py:26"}, "properties": {"repobilityId": "1d41a0128ca2692a", "scanner": "scanner-primary", "fingerprint": "e6bc7ec87d3fb6b9", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-a4946a9eec883590", "level": "none", "message": {"text": "Commented-code block (6 lines) in services/backend/src/agent_cloud_backend/sandbox/deps.py:40"}, "properties": {"repobilityId": "bade706102b3e000", "scanner": "scanner-primary", "fingerprint": "a4946a9eec883590", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-99376f494c697a36", "level": "none", "message": {"text": "Commented-code block (5 lines) in services/backend/src/agent_cloud_backend/skills/service.py:57"}, "properties": {"repobilityId": "ef2bc73267a32279", "scanner": "scanner-primary", "fingerprint": "99376f494c697a36", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-eac6f41235a5bdde", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 services/backend/src/agent_cloud_backend/skill_registry/docx/scripts/office/soffice.py:14"}, "properties": {"repobilityId": "a8008eb8c5a1cc25", "scanner": "scanner-primary", "fingerprint": "eac6f41235a5bdde", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-15dc57d1b6829fdd", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 services/backend/src/agent_cloud_backend/skill_registry/docx/scripts/office/validators/redlining.py:138"}, "properties": {"repobilityId": "e81bdf29a431f6da", "scanner": "scanner-primary", "fingerprint": "15dc57d1b6829fdd", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-abcb59809daebd16", "level": "note", "message": {"text": "Legacy-named symbol `xml_copy` in services/backend/src/agent_cloud_backend/skill_registry/docx/scripts/office/validators/base.py:705"}, "properties": {"repobilityId": "b2564bfa4947b102", "scanner": "scanner-primary", "fingerprint": "abcb59809daebd16", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-9998e8625036b4c7", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 services/backend/src/agent_cloud_backend/skill_registry/pptx/scripts/thumbnail.py:161"}, "properties": {"repobilityId": "d166769331a78c72", "scanner": "scanner-primary", "fingerprint": "9998e8625036b4c7", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-608e871744c7fabb", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 services/backend/src/agent_cloud_backend/skill_registry/pptx/scripts/office/soffice.py:14"}, "properties": {"repobilityId": "fa09539d73ba6be8", "scanner": "scanner-primary", "fingerprint": "608e871744c7fabb", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-29d773dcddaa5e7d", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 services/backend/src/agent_cloud_backend/skill_registry/pptx/scripts/office/validators/redlining.py:138"}, "properties": {"repobilityId": "e28715a15e6c4781", "scanner": "scanner-primary", "fingerprint": "29d773dcddaa5e7d", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-6e596325389af4ee", "level": "note", "message": {"text": "Legacy-named symbol `xml_copy` in services/backend/src/agent_cloud_backend/skill_registry/pptx/scripts/office/validators/base.py:705"}, "properties": {"repobilityId": "f87a0f6d9e61e5b2", "scanner": "scanner-primary", "fingerprint": "6e596325389af4ee", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-1c7b0b89719f3308", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 services/backend/src/agent_cloud_backend/skill_registry/xlsx/scripts/recalc.py:92"}, "properties": {"repobilityId": "6379f80b002f98cc", "scanner": "scanner-primary", "fingerprint": "1c7b0b89719f3308", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-e87e4c92d6124693", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 services/backend/src/agent_cloud_backend/skill_registry/xlsx/scripts/office/soffice.py:14"}, "properties": {"repobilityId": "313a803cdc083503", "scanner": "scanner-primary", "fingerprint": "e87e4c92d6124693", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-ec372f22a03beb31", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 services/backend/src/agent_cloud_backend/skill_registry/xlsx/scripts/office/validators/redlining.py:138"}, "properties": {"repobilityId": "6f2a821cd4b7bac2", "scanner": "scanner-primary", "fingerprint": "ec372f22a03beb31", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-4a77b09bab461fdc", "level": "note", "message": {"text": "Legacy-named symbol `xml_copy` in services/backend/src/agent_cloud_backend/skill_registry/xlsx/scripts/office/validators/base.py:705"}, "properties": {"repobilityId": "c6a1169d90129b79", "scanner": "scanner-primary", "fingerprint": "4a77b09bab461fdc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-b334d875f2339fa1", "level": "note", "message": {"text": "5 env vars used in code but missing from .env.example"}, "properties": {"repobilityId": "faa38682016f5d53", "scanner": "scanner-primary", "fingerprint": "b334d875f2339fa1", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "config-drift"]}}, {"ruleId": "scanner-fe1d9311d6aee734", "level": "note", "message": {"text": "Near-duplicate function bodies in 12 places"}, "properties": {"repobilityId": "919f1b4136583bb9", "scanner": "scanner-primary", "fingerprint": "fe1d9311d6aee734", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "9a3d6b47f095c555", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "bcebebc3d539fa91", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "9a120183ab511990", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "98068fc2533fd5a6", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "6201531813959d4f", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "f108186231718d0c", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "d16d23b9a1544477", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "53196dd40a5635b6", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "bc48721af577ec8e", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "537085ca1a636846", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "3b6b6b326d69ebbe", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "5400732d1d93ab10", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "d0c2b3c079604d78", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "de338cefdf41f629", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "6feae2c95e3ec481", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "e81d8549231e1d1a", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "f38b43877f3505bd", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "fd11de26d8c6b015", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "ad2621ca108d18a0", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-9efd75798952cc61", "level": "error", "message": {"text": "Dangling fetch: POST /api/auth/refresh (frontend/src/api/auth.ts:23)"}, "properties": {"repobilityId": "2d5fbacc5c838f73", "scanner": "scanner-primary", "fingerprint": "9efd75798952cc61", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-5baa8971ebe192a1", "level": "note", "message": {"text": "Unused endpoint: GET /"}, "properties": {"repobilityId": "422f2984dc699d34", "scanner": "scanner-primary", "fingerprint": "5baa8971ebe192a1", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-900368d68d13d839", "level": "note", "message": {"text": "Unused endpoint: POST /mark-delivered"}, "properties": {"repobilityId": "cc421581f9dc054a", "scanner": "scanner-primary", "fingerprint": "900368d68d13d839", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-7a009b1a56794f45", "level": "note", "message": {"text": "Unused endpoint: POST /"}, "properties": {"repobilityId": "baf02002d6ce3243", "scanner": "scanner-primary", "fingerprint": "7a009b1a56794f45", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-cecf400c02427097", "level": "note", "message": {"text": "Unused endpoint: PATCH /{task_id}"}, "properties": {"repobilityId": "ca3381e380ccd11d", "scanner": "scanner-primary", "fingerprint": "cecf400c02427097", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-9c055f3f8f83ed5f", "level": "note", "message": {"text": "Unused endpoint: DELETE /{task_id}"}, "properties": {"repobilityId": "05f11fcab42ef719", "scanner": "scanner-primary", "fingerprint": "9c055f3f8f83ed5f", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-8795305b4a5d6126", "level": "note", "message": {"text": "Unused endpoint: POST /{task_id}/run-now"}, "properties": {"repobilityId": "d21256986ec41a0e", "scanner": "scanner-primary", "fingerprint": "8795305b4a5d6126", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-359f35937bed4935", "level": "note", "message": {"text": "Unused endpoint: GET /registry"}, "properties": {"repobilityId": "4809ea28d1ece5f8", "scanner": "scanner-primary", "fingerprint": "359f35937bed4935", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-083fba8d34bf5011", "level": "note", "message": {"text": "Unused endpoint: POST /install"}, "properties": {"repobilityId": "b05c91d455517086", "scanner": "scanner-primary", "fingerprint": "083fba8d34bf5011", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-ab6489535547644e", "level": "note", "message": {"text": "Unused endpoint: POST /install-from-workspace"}, "properties": {"repobilityId": "4f7ce3dc9e7377dd", "scanner": "scanner-primary", "fingerprint": "ab6489535547644e", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-6236b283b79811b8", "level": "note", "message": {"text": "Unused endpoint: POST /upload"}, "properties": {"repobilityId": "9fec7bf781b43694", "scanner": "scanner-primary", "fingerprint": "6236b283b79811b8", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c829b9b967978974", "level": "note", "message": {"text": "Unused endpoint: DELETE /{skill_id}"}, "properties": {"repobilityId": "aba44464cfcc372c", "scanner": "scanner-primary", "fingerprint": "c829b9b967978974", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-67d28fa8cd6bb12f", "level": "note", "message": {"text": "Unused endpoint: PUT /"}, "properties": {"repobilityId": "50cfbbf458d1fea3", "scanner": "scanner-primary", "fingerprint": "67d28fa8cd6bb12f", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-3b30f4c0994a30b4", "level": "note", "message": {"text": "Unused endpoint: DELETE /"}, "properties": {"repobilityId": "2e1278b3c70ccd89", "scanner": "scanner-primary", "fingerprint": "3b30f4c0994a30b4", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-2ab9bf5db6820af4", "level": "note", "message": {"text": "Unused endpoint: GET /models"}, "properties": {"repobilityId": "9bf2a5642397f82e", "scanner": "scanner-primary", "fingerprint": "2ab9bf5db6820af4", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-304b6f2b403d93f7", "level": "note", "message": {"text": "Unused endpoint: POST /register"}, "properties": {"repobilityId": "45ba43870a4139b4", "scanner": "scanner-primary", "fingerprint": "304b6f2b403d93f7", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-618721b912bad1c2", "level": "note", "message": {"text": "Unused endpoint: POST /login"}, "properties": {"repobilityId": "ed4993d3fefa440d", "scanner": "scanner-primary", "fingerprint": "618721b912bad1c2", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-7ce17d6b092a81ca", "level": "note", "message": {"text": "Unused endpoint: POST /refresh"}, "properties": {"repobilityId": "afaf92602665dfbd", "scanner": "scanner-primary", "fingerprint": "7ce17d6b092a81ca", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-99fc36db98c134ce", "level": "note", "message": {"text": "Unused endpoint: POST /logout"}, "properties": {"repobilityId": "505990af964eb92b", "scanner": "scanner-primary", "fingerprint": "99fc36db98c134ce", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-fd1dc91abf32142d", "level": "note", "message": {"text": "Unused endpoint: GET /me"}, "properties": {"repobilityId": "5ecf9553be9563a6", "scanner": "scanner-primary", "fingerprint": "fd1dc91abf32142d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5f4ee569e1562771", "level": "note", "message": {"text": "Unused endpoint: POST /stream"}, "properties": {"repobilityId": "6f271c62b36d0fb7", "scanner": "scanner-primary", "fingerprint": "5f4ee569e1562771", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-35a741079ddc6fcc", "level": "note", "message": {"text": "Unused endpoint: GET /stream"}, "properties": {"repobilityId": "8b470ac4d5d92e57", "scanner": "scanner-primary", "fingerprint": "35a741079ddc6fcc", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-6b4d3a1c30158c0e", "level": "note", "message": {"text": "Unused endpoint: POST /cancel"}, "properties": {"repobilityId": "20ba67edfcf1252e", "scanner": "scanner-primary", "fingerprint": "6b4d3a1c30158c0e", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-2107157724647831", "level": "note", "message": {"text": "Unused endpoint: GET /{agent_id}/skills"}, "properties": {"repobilityId": "bfe5c929cf57e35c", "scanner": "scanner-primary", "fingerprint": "2107157724647831", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-8ac4888c16fe6c83", "level": "note", "message": {"text": "Unused endpoint: PUT /{agent_id}/skills"}, "properties": {"repobilityId": "89a101a3a8ebc405", "scanner": "scanner-primary", "fingerprint": "8ac4888c16fe6c83", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c82522b225b7de39", "level": "note", "message": {"text": "Unused endpoint: DELETE /{model_id}"}, "properties": {"repobilityId": "dbb4769244235339", "scanner": "scanner-primary", "fingerprint": "c82522b225b7de39", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-b8a7cb1f1998fe13", "level": "note", "message": {"text": "Unused endpoint: DELETE /{cred_id}"}, "properties": {"repobilityId": "5f45326f36ade301", "scanner": "scanner-primary", "fingerprint": "b8a7cb1f1998fe13", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-f5ec41c3b06660d6", "level": "note", "message": {"text": "Unused endpoint: GET /index"}, "properties": {"repobilityId": "329316737ed7771b", "scanner": "scanner-primary", "fingerprint": "f5ec41c3b06660d6", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-a9f772e74c781e7b", "level": "note", "message": {"text": "Unused endpoint: GET /raw"}, "properties": {"repobilityId": "45ee89922ea5af8d", "scanner": "scanner-primary", "fingerprint": "a9f772e74c781e7b", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-9043216588911765", "level": "note", "message": {"text": "Unused endpoint: POST /mkdir"}, "properties": {"repobilityId": "27dc8507b651cb21", "scanner": "scanner-primary", "fingerprint": "9043216588911765", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c6ee2f6f26400740", "level": "note", "message": {"text": "Unused endpoint: POST /move"}, "properties": {"repobilityId": "bd3690f678c12f94", "scanner": "scanner-primary", "fingerprint": "c6ee2f6f26400740", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-2df4cdb5233e7a00", "level": "note", "message": {"text": "Unused endpoint: PATCH /{agent_id}"}, "properties": {"repobilityId": "3926c90e6a017683", "scanner": "scanner-primary", "fingerprint": "2df4cdb5233e7a00", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-ddfdc003b7b050cb", "level": "note", "message": {"text": "Unused endpoint: DELETE /{agent_id}"}, "properties": {"repobilityId": "dfb85d3cca853d98", "scanner": "scanner-primary", "fingerprint": "ddfdc003b7b050cb", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-593d9b4072f92e9f", "level": "note", "message": {"text": "Unused endpoint: PATCH /{session_id}"}, "properties": {"repobilityId": "462b78877dcbfdf7", "scanner": "scanner-primary", "fingerprint": "593d9b4072f92e9f", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-173ad25a6a1cb443", "level": "note", "message": {"text": "Unused endpoint: DELETE /{session_id}"}, "properties": {"repobilityId": "3e5ae8e476addf33", "scanner": "scanner-primary", "fingerprint": "173ad25a6a1cb443", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-2740f15915f9f506", "level": "note", "message": {"text": "Unused endpoint: POST /{session_id}/compact"}, "properties": {"repobilityId": "582393291b3fbe37", "scanner": "scanner-primary", "fingerprint": "2740f15915f9f506", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-091905e511b2a496", "level": "note", "message": {"text": "Unused endpoint: POST /{session_id}/rollback"}, "properties": {"repobilityId": "7b2265aa16d7c0d4", "scanner": "scanner-primary", "fingerprint": "091905e511b2a496", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-cd381e4201f64078", "level": "note", "message": {"text": "Unused endpoint: POST /{session_id}/fork"}, "properties": {"repobilityId": "f4ef078c544c7dee", "scanner": "scanner-primary", "fingerprint": "cd381e4201f64078", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-7b6137cc1cbcfdd1", "level": "note", "message": {"text": "Unused endpoint: POST /{session_id}/mark-read"}, "properties": {"repobilityId": "304f03440fdabf69", "scanner": "scanner-primary", "fingerprint": "7b6137cc1cbcfdd1", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}]}]}