{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-1b46d6c02a691dbd", "name": "Possibly dead Python function: check_tool_start", "shortDescription": {"text": "Possibly dead Python function: check_tool_start"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e5769309ed8b0f44", "name": "Possibly dead Python function: check_tool_start", "shortDescription": {"text": "Possibly dead Python function: check_tool_start"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ed220a85ce4432c3", "name": "Possibly dead Python function: wait_for_tool_approval", "shortDescription": {"text": "Possibly dead Python function: wait_for_tool_approval"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d55c39f103c66d6e", "name": "Possibly dead Python function: check_tool_start", "shortDescription": {"text": "Possibly dead Python function: check_tool_start"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b0f75e61d4ffedb4", "name": "Possibly dead Python function: check_tool_start", "shortDescription": {"text": "Possibly dead Python function: check_tool_start"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-91ca88dadf073ac8", "name": "Possibly dead Python function: wait_for_tool_approval", "shortDescription": {"text": "Possibly dead Python function: wait_for_tool_approval"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0a9a59c1304abbba", "name": "Possibly dead Python function: check_tool_start", "shortDescription": {"text": "Possibly dead Python function: check_tool_start"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-67b89f5b4b34080e", "name": "Possibly dead Python function: check_tool_start", "shortDescription": {"text": "Possibly dead Python function: check_tool_start"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c371438c288d704d", "name": "Possibly dead Python function: wait_for_tool_approval", "shortDescription": {"text": "Possibly dead Python function: wait_for_tool_approval"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-373cae39a29d5a91", "name": "Possibly dead Python function: check_tool_start", "shortDescription": {"text": "Possibly dead Python function: check_tool_start"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4470c38f8122baf6", "name": "Possibly dead Python function: wait_for_tool_approval", "shortDescription": {"text": "Possibly dead Python function: wait_for_tool_approval"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8c10b580b0f00cdc", "name": "Possibly dead Python function: check_tool_start", "shortDescription": {"text": "Possibly dead Python function: check_tool_start"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6ef6f349bf88b32a", "name": "Stray `console.log` in TS/JS \u2014 scenarios/approval-gates/node/src/index.ts:21", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 scenarios/approval-gates/node/src/index.ts:21"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8073a9d51b63221a", "name": "Stray `console.log` in TS/JS \u2014 scenarios/approval-gates/node/src/approval.ts:45", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 scenarios/approval-gates/node/src/approval.ts:45"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-aa1ab4f00bf7cba1", "name": "Stray `console.log` in TS/JS \u2014 scenarios/budget-limits/node/agent.js:80", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 scenarios/budget-limits/node/agent.js:80"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-70f85a804d207ef7", "name": "Stray `console.log` in TS/JS \u2014 scenarios/sidecar-runtime/examples/node-agent/agent.js:71", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 scenarios/sidecar-runtime/examples/node-agent/agent.js:71"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a1195e06bc3487c1", "name": "Stray `console.log` in TS/JS \u2014 scenarios/sidecar-runtime/mock-gateway/server.js:19", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 scenarios/sidecar-runtime/mock-gateway/server.js:19"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-74bae8932ee0de42", "name": "Stray `console.log` in TS/JS \u2014 scenarios/policy-enforcement/node/src/index.ts:27", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 scenarios/policy-enforcement/node/src/index.ts:27"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ca2cd521b5f15291", "name": "Stray `console.log` in TS/JS \u2014 scenarios/audit-trace/node/agent.js:59", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 scenarios/audit-trace/node/agent.js:59"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-027bdee668689ba0", "name": "Stray `console.log` in TS/JS \u2014 node/mastra/src/index.ts:20", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 node/mastra/src/index.ts:20"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9a561d77068b74b3", "name": "Stray `console.log` in TS/JS \u2014 node/vercel-ai/src/index.ts:6", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 node/vercel-ai/src/index.ts:6"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-021eecdf6947cb10", "name": "Stray `console.log` in TS/JS \u2014 node/custom-tool-policy/src/index.ts:6", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 node/custom-tool-policy/src/index.ts:6"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b959214122933837", "name": "Stray `console.log` in TS/JS \u2014 node/langgraph-js/src/index.ts:30", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 node/langgraph-js/src/index.ts:30"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c7373af1c8a86d67", "name": "Stray `console.log` in TS/JS \u2014 node/langchain-js-basic-agent/src/index.ts:6", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 node/langchain-js-basic-agent/src/index.ts:6"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9e22c83862de41e2", "name": "Stray `console.log` in TS/JS \u2014 node/openai-node-tool-policy/src/index.ts:6", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 node/openai-node-tool-policy/src/index.ts:6"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b955ed43215ebcf5", "name": "Dockerfile runs as root: scenarios/sidecar-runtime/mock-gateway/Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: scenarios/sidecar-runtime/mock-gateway/Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2ca42979a4b6ddae", "name": "Docker base image is tag-pinned but not digest-pinned: node:18-alpine", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: node:18-alpine"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6d16e578d135b7f0", "name": "Possible secret in python/langchain-research-agent/README.md", "shortDescription": {"text": "Possible secret in python/langchain-research-agent/README.md"}, "fullDescription": {"text": "Detected pattern matching openai_or_anthropic_key. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-6a3c73f077bb1d1b", "name": "Possible secret in python/langchain-research-agent/src/main.py", "shortDescription": {"text": "Possible secret in python/langchain-research-agent/src/main.py"}, "fullDescription": {"text": "Detected pattern matching openai_or_anthropic_key. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-6372cebde0220094", "name": "No auth library detected", "shortDescription": {"text": "No auth library detected"}, "fullDescription": {"text": "The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). The repo has auth/admin/session surface indicators, so auth may live in custom code, in a separate service, or be missing."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ec77845b9113e7fb", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "pozil/auto-assign-issue@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2140b1431e6ec1b6", "name": "Node manifest has dependencies but no lockfile: node/mastra/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: node/mastra/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-95186a18789f7914", "name": "Node manifest has dependencies but no lockfile: node/vercel-ai/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: node/vercel-ai/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a3c1bf2c7c26e448", "name": "Node manifest has dependencies but no lockfile: node/custom-tool-policy/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: node/custom-tool-policy/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5c6d2f03acb1e5b7", "name": "Node manifest has dependencies but no lockfile: node/langgraph-js/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: node/langgraph-js/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-54f087fa8dbd88b1", "name": "Node manifest has dependencies but no lockfile: node/langchain-js-basic-agent/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: node/langchain-js-basic-agent/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-083edf7f66b1e429", "name": "Node manifest has dependencies but no lockfile: node/openai-node-tool-policy/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: node/openai-node-tool-policy/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 326 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 69 placeholder/mock markers across 26 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-00978da317144cf4", "name": "Commented-code block (5 lines) in scenarios/budget-limits/node/agent.js:25", "shortDescription": {"text": "Commented-code block (5 lines) in scenarios/budget-limits/node/agent.js:25"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-84d89aead897b39d", "name": "Commented-code block (5 lines) in scenarios/audit-trace/node/agent.js:16", "shortDescription": {"text": "Commented-code block (5 lines) in scenarios/audit-trace/node/agent.js:16"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-fe1d9311d6aee734", "name": "Near-duplicate function bodies in 12 places", "shortDescription": {"text": "Near-duplicate function bodies in 12 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\npython/custom-tool-policy/src/policy.py:check_tool_start, python/openai-agents-sdk/src/policy.py:check_tool_start, python/openai-agents-sdk/src/policy.py:wait_for_tool_approval, python/llamaindex-tool-policy/src/policy.py:check_tool_start\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-be46ea126aa5d8dc", "name": "Near-duplicate function bodies in 3 places", "shortDescription": {"text": "Near-duplicate function bodies in 3 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\npython/langchain-research-agent/src/policy.py:spent, python/crewai-research-crew/src/policy.py:spent, scenarios/budget-limits/python/agent.py:spent\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2c04133e54348533", "name": "Near-duplicate function bodies in 2 places", "shortDescription": {"text": "Near-duplicate function bodies in 2 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\npython/langchain-research-agent/src/policy.py:remaining, python/crewai-research-crew/src/policy.py:remaining\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/23975"}, "properties": {"repository": "ai-agent-assembly/agent-assembly-examples", "repoUrl": "https://github.com/ai-agent-assembly/agent-assembly-examples", "branch": "main"}, "results": [{"ruleId": "scanner-1b46d6c02a691dbd", "level": "note", "message": {"text": "Possibly dead Python function: check_tool_start"}, "properties": {"repobilityId": "92bde3ae6d2668fe", "scanner": "scanner-primary", "fingerprint": "1b46d6c02a691dbd", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "python/custom-tool-policy/src/policy.py:28"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e5769309ed8b0f44", "level": "note", "message": {"text": "Possibly dead Python function: check_tool_start"}, "properties": {"repobilityId": "92bde3ae6d2668fe", "scanner": "scanner-primary", "fingerprint": "e5769309ed8b0f44", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "python/openai-agents-sdk/src/policy.py:35"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ed220a85ce4432c3", "level": "note", "message": {"text": "Possibly dead Python function: wait_for_tool_approval"}, "properties": {"repobilityId": "846759ce706a3cb5", "scanner": "scanner-primary", "fingerprint": "ed220a85ce4432c3", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "python/openai-agents-sdk/src/policy.py:60"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d55c39f103c66d6e", "level": "note", "message": {"text": "Possibly dead Python function: check_tool_start"}, "properties": {"repobilityId": "92bde3ae6d2668fe", "scanner": "scanner-primary", "fingerprint": "d55c39f103c66d6e", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "python/llamaindex-tool-policy/src/policy.py:29"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b0f75e61d4ffedb4", "level": "note", "message": {"text": "Possibly dead Python function: check_tool_start"}, "properties": {"repobilityId": "92bde3ae6d2668fe", "scanner": "scanner-primary", "fingerprint": "b0f75e61d4ffedb4", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "python/langchain-basic-agent/src/policy.py:34"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-91ca88dadf073ac8", "level": "note", "message": {"text": "Possibly dead Python function: wait_for_tool_approval"}, "properties": {"repobilityId": "846759ce706a3cb5", "scanner": "scanner-primary", "fingerprint": "91ca88dadf073ac8", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "python/langchain-basic-agent/src/policy.py:57"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0a9a59c1304abbba", "level": "note", "message": {"text": "Possibly dead Python function: check_tool_start"}, "properties": {"repobilityId": "92bde3ae6d2668fe", "scanner": "scanner-primary", "fingerprint": "0a9a59c1304abbba", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "python/langchain-research-agent/src/policy.py:121"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-67b89f5b4b34080e", "level": "note", "message": {"text": "Possibly dead Python function: check_tool_start"}, "properties": {"repobilityId": "92bde3ae6d2668fe", "scanner": "scanner-primary", "fingerprint": "67b89f5b4b34080e", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "python/crewai-research-crew/src/policy.py:149"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c371438c288d704d", "level": "note", "message": {"text": "Possibly dead Python function: wait_for_tool_approval"}, "properties": {"repobilityId": "846759ce706a3cb5", "scanner": "scanner-primary", "fingerprint": "c371438c288d704d", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "python/crewai-research-crew/src/policy.py:189"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-373cae39a29d5a91", "level": "note", "message": {"text": "Possibly dead Python function: check_tool_start"}, "properties": {"repobilityId": "92bde3ae6d2668fe", "scanner": "scanner-primary", "fingerprint": "373cae39a29d5a91", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scenarios/approval-gates/python/src/approval.py:106"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4470c38f8122baf6", "level": "note", "message": {"text": "Possibly dead Python function: wait_for_tool_approval"}, "properties": {"repobilityId": "846759ce706a3cb5", "scanner": "scanner-primary", "fingerprint": "4470c38f8122baf6", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scenarios/approval-gates/python/src/approval.py:130"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8c10b580b0f00cdc", "level": "note", "message": {"text": "Possibly dead Python function: check_tool_start"}, "properties": {"repobilityId": "92bde3ae6d2668fe", "scanner": "scanner-primary", "fingerprint": "8c10b580b0f00cdc", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scenarios/policy-enforcement/python/src/policy.py:54"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6ef6f349bf88b32a", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 scenarios/approval-gates/node/src/index.ts:21"}, "properties": {"repobilityId": "de1b9ecf07ee3da7", "scanner": "scanner-primary", "fingerprint": "6ef6f349bf88b32a", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-8073a9d51b63221a", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 scenarios/approval-gates/node/src/approval.ts:45"}, "properties": {"repobilityId": "04ad0b0f473ff1de", "scanner": "scanner-primary", "fingerprint": "8073a9d51b63221a", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-aa1ab4f00bf7cba1", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 scenarios/budget-limits/node/agent.js:80"}, "properties": {"repobilityId": "6631b3352d97fd41", "scanner": "scanner-primary", "fingerprint": "aa1ab4f00bf7cba1", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-70f85a804d207ef7", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 scenarios/sidecar-runtime/examples/node-agent/agent.js:71"}, "properties": {"repobilityId": "0f9d1429eea1eeb9", "scanner": "scanner-primary", "fingerprint": "70f85a804d207ef7", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-a1195e06bc3487c1", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 scenarios/sidecar-runtime/mock-gateway/server.js:19"}, "properties": {"repobilityId": "23a5b4bb1226fbb3", "scanner": "scanner-primary", "fingerprint": "a1195e06bc3487c1", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-74bae8932ee0de42", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 scenarios/policy-enforcement/node/src/index.ts:27"}, "properties": {"repobilityId": "345097623e952182", "scanner": "scanner-primary", "fingerprint": "74bae8932ee0de42", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-ca2cd521b5f15291", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 scenarios/audit-trace/node/agent.js:59"}, "properties": {"repobilityId": "f26afe8583dbd97c", "scanner": "scanner-primary", "fingerprint": "ca2cd521b5f15291", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-027bdee668689ba0", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 node/mastra/src/index.ts:20"}, "properties": {"repobilityId": "83ec77920bcb929c", "scanner": "scanner-primary", "fingerprint": "027bdee668689ba0", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-9a561d77068b74b3", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 node/vercel-ai/src/index.ts:6"}, "properties": {"repobilityId": "14136d6ef3024b7e", "scanner": "scanner-primary", "fingerprint": "9a561d77068b74b3", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-021eecdf6947cb10", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 node/custom-tool-policy/src/index.ts:6"}, "properties": {"repobilityId": "118735858f51b1be", "scanner": "scanner-primary", "fingerprint": "021eecdf6947cb10", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-b959214122933837", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 node/langgraph-js/src/index.ts:30"}, "properties": {"repobilityId": "c653f4e672e6672d", "scanner": "scanner-primary", "fingerprint": "b959214122933837", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-c7373af1c8a86d67", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 node/langchain-js-basic-agent/src/index.ts:6"}, "properties": {"repobilityId": "3c0dab4d85fc1c5e", "scanner": "scanner-primary", "fingerprint": "c7373af1c8a86d67", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-9e22c83862de41e2", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 node/openai-node-tool-policy/src/index.ts:6"}, "properties": {"repobilityId": "031520ada895a3e8", "scanner": "scanner-primary", "fingerprint": "9e22c83862de41e2", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-b955ed43215ebcf5", "level": "warning", "message": {"text": "Dockerfile runs as root: scenarios/sidecar-runtime/mock-gateway/Dockerfile"}, "properties": {"repobilityId": "023b2cd8f3eb50de", "scanner": "scanner-primary", "fingerprint": "b955ed43215ebcf5", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-2ca42979a4b6ddae", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: node:18-alpine"}, "properties": {"repobilityId": "184f1c6bc472c652", "scanner": "scanner-primary", "fingerprint": "2ca42979a4b6ddae", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scenarios/sidecar-runtime/mock-gateway/Dockerfile"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6d16e578d135b7f0", "level": "error", "message": {"text": "Possible secret in python/langchain-research-agent/README.md"}, "properties": {"repobilityId": "5a6bcd52a54fab48", "scanner": "scanner-primary", "fingerprint": "6d16e578d135b7f0", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "python/langchain-research-agent/README.md"}, "region": {"startLine": 82}}}]}, {"ruleId": "scanner-6a3c73f077bb1d1b", "level": "error", "message": {"text": "Possible secret in python/langchain-research-agent/src/main.py"}, "properties": {"repobilityId": "c4261998d046bf67", "scanner": "scanner-primary", "fingerprint": "6a3c73f077bb1d1b", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "python/langchain-research-agent/src/main.py"}, "region": {"startLine": 56}}}]}, {"ruleId": "scanner-6372cebde0220094", "level": "warning", "message": {"text": "No auth library detected"}, "properties": {"repobilityId": "a5b6035a5bbf8054", "scanner": "scanner-primary", "fingerprint": "6372cebde0220094", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["coverage", "auth"]}}, {"ruleId": "scanner-ec77845b9113e7fb", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "7aeefb110a1c1353", "scanner": "scanner-primary", "fingerprint": "ec77845b9113e7fb", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/auto-assign.yml"}, "region": {"startLine": 15}}}]}, {"ruleId": "scanner-2140b1431e6ec1b6", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: node/mastra/package.json"}, "properties": {"repobilityId": "4fe0d27eaf548f78", "scanner": "scanner-primary", "fingerprint": "2140b1431e6ec1b6", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "node/mastra/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-95186a18789f7914", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: node/vercel-ai/package.json"}, "properties": {"repobilityId": "6df1d3ae32d56068", "scanner": "scanner-primary", "fingerprint": "95186a18789f7914", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "node/vercel-ai/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a3c1bf2c7c26e448", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: node/custom-tool-policy/package.json"}, "properties": {"repobilityId": "415d4fa542b53d87", "scanner": "scanner-primary", "fingerprint": "a3c1bf2c7c26e448", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "node/custom-tool-policy/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5c6d2f03acb1e5b7", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: node/langgraph-js/package.json"}, "properties": {"repobilityId": "6d5b959173d8b738", "scanner": "scanner-primary", "fingerprint": "5c6d2f03acb1e5b7", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "node/langgraph-js/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-54f087fa8dbd88b1", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: node/langchain-js-basic-agent/package.json"}, "properties": {"repobilityId": "6ee188725ca3816e", "scanner": "scanner-primary", "fingerprint": "54f087fa8dbd88b1", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "node/langchain-js-basic-agent/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-083edf7f66b1e429", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: node/openai-node-tool-policy/package.json"}, "properties": {"repobilityId": "128a41f57812bb64", "scanner": "scanner-primary", "fingerprint": "083edf7f66b1e429", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "node/openai-node-tool-policy/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "8901bacf47c0eb11", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "1eac8a18495cb19a", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "c8383fb66a88c45b", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-00978da317144cf4", "level": "none", "message": {"text": "Commented-code block (5 lines) in scenarios/budget-limits/node/agent.js:25"}, "properties": {"repobilityId": "618cb6e96f37e3ee", "scanner": "scanner-primary", "fingerprint": "00978da317144cf4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-84d89aead897b39d", "level": "none", "message": {"text": "Commented-code block (5 lines) in scenarios/audit-trace/node/agent.js:16"}, "properties": {"repobilityId": "cac7781e3e590152", "scanner": "scanner-primary", "fingerprint": "84d89aead897b39d", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-fe1d9311d6aee734", "level": "note", "message": {"text": "Near-duplicate function bodies in 12 places"}, "properties": {"repobilityId": "90734ba0dd558e24", "scanner": "scanner-primary", "fingerprint": "fe1d9311d6aee734", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "ed13824984c04ab0", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "d4ed7639fcf4692e", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "96ff8a9d23e8cb13", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "19cd8b1c3454dccc", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "a5e395d67af27a2d", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "693dd7714ee5ca88", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}]}]}