{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-306dcb4809eb1048", "name": "Stray `console.log` in TS/JS \u2014 src/reports/index.ts:14", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 src/reports/index.ts:14"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d651ca412ef5e18d", "name": "Stray `console.log` in TS/JS \u2014 src/cli/index.ts:50", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 src/cli/index.ts:50"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2bd9136dfa0fbdd8", "name": "Stray `console.log` in TS/JS \u2014 src/cli/setup.ts:67", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 src/cli/setup.ts:67"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8047cc77d89a98d7", "name": "Stray `console.log` in TS/JS \u2014 src/cli/auth.ts:56", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 src/cli/auth.ts:56"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-527a52da2381ac8a", "name": "Stray `console.log` in TS/JS \u2014 src/cli/shortcuts.ts:18", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 src/cli/shortcuts.ts:18"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a23d59c2c8d03a39", "name": "Stray `console.log` in TS/JS \u2014 src/prompts/capabilities/scan-security.ts:177", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 src/prompts/capabilities/scan-security.ts:177"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b6b4f7c0ab38c296", "name": "Stray `console.log` in TS/JS \u2014 src/prompts/capabilities/scan-debt.ts:200", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 src/prompts/capabilities/scan-debt.ts:200"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-386006c440839763", "name": "Stray `console.log` in TS/JS \u2014 src/sdk/index.ts:32", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 src/sdk/index.ts:32"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c79de4cc0402e28b", "name": "Stray `console.log` in TS/JS \u2014 desktop/main/server-manager.ts:154", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 desktop/main/server-manager.ts:154"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f03b1f8a7844476d", "name": "Icon-only button without accessible name \u2014 desktop/renderer/src/pages/Tools.tsx:96", "shortDescription": {"text": "Icon-only button without accessible name \u2014 desktop/renderer/src/pages/Tools.tsx:96"}, "fullDescription": {"text": "A `<button>` whose only child is a single glyph or symbol needs `title=` or `aria-label=` so screen readers (and tooltips on hover) work.\n\nWhy: P3 in CHECKLIST.md \u2014 icon-only buttons skipped a title.\nRule id: fq.button.no-label"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d63da3583b14afc0", "name": "Dockerfile runs as root: Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8987d6d1c30c7202", "name": "Docker base image is tag-pinned but not digest-pinned: node:20-alpine", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: node:20-alpine"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bc112666ab729dae", "name": "Insecure pattern 'direct_innerhtml_assignment' in src/dashboard/index.ts:93", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in src/dashboard/index.ts:93"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-fe76e63111f60961", "name": "Insecure pattern 'node_child_process' in src/tools/fluent.ts:12", "shortDescription": {"text": "Insecure pattern 'node_child_process' in src/tools/fluent.ts:12"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-af6bc312c9e562c9", "name": "Insecure pattern 'eval_used' in src/tools/deployment.ts:93", "shortDescription": {"text": "Insecure pattern 'eval_used' in src/tools/deployment.ts:93"}, "fullDescription": {"text": "Found a known-risky pattern (eval_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-e4bf74c34dfdfdfa", "name": "Insecure pattern 'eval_used' in src/resources/query-syntax.ts:100", "shortDescription": {"text": "Insecure pattern 'eval_used' in src/resources/query-syntax.ts:100"}, "fullDescription": {"text": "Found a known-risky pattern (eval_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-a138124e67cfaf7c", "name": "Insecure pattern 'node_child_process' in src/cli/index.ts:18", "shortDescription": {"text": "Insecure pattern 'node_child_process' in src/cli/index.ts:18"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c0d23face91c07b3", "name": "Insecure pattern 'node_child_process' in src/cli/setup.ts:20", "shortDescription": {"text": "Insecure pattern 'node_child_process' in src/cli/setup.ts:20"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e326d48645d03bb4", "name": "Possible secret in src/cli/auth.ts", "shortDescription": {"text": "Possible secret in src/cli/auth.ts"}, "fullDescription": {"text": "Detected pattern matching password_literal. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-c438e91a21f173f5", "name": "Insecure pattern 'node_child_process' in src/cli/detect-clients.ts:8", "shortDescription": {"text": "Insecure pattern 'node_child_process' in src/cli/detect-clients.ts:8"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5b0b2181c2c704e0", "name": "Insecure pattern 'node_child_process' in src/cli/writers/index.ts:7", "shortDescription": {"text": "Insecure pattern 'node_child_process' in src/cli/writers/index.ts:7"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-84c46afbec548f45", "name": "Insecure pattern 'eval_used' in src/prompts/knowledge.ts:337", "shortDescription": {"text": "Insecure pattern 'eval_used' in src/prompts/knowledge.ts:337"}, "fullDescription": {"text": "Found a known-risky pattern (eval_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-d21bd65c84e0c060", "name": "Insecure pattern 'eval_used' in src/prompts/capabilities/build-app.ts:193", "shortDescription": {"text": "Insecure pattern 'eval_used' in src/prompts/capabilities/build-app.ts:193"}, "fullDescription": {"text": "Found a known-risky pattern (eval_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-11857a34fc1feb5c", "name": "Insecure pattern 'eval_used' in src/prompts/capabilities/scan-security.ts:139", "shortDescription": {"text": "Insecure pattern 'eval_used' in src/prompts/capabilities/scan-security.ts:139"}, "fullDescription": {"text": "Found a known-risky pattern (eval_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-b0b985c7ccd3ee4e", "name": "Insecure pattern 'new_function_used' in src/prompts/capabilities/scan-security.ts:178", "shortDescription": {"text": "Insecure pattern 'new_function_used' in src/prompts/capabilities/scan-security.ts:178"}, "fullDescription": {"text": "Found a known-risky pattern (new_function_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-5183ec08c0357b9c", "name": "Insecure pattern 'document_write' in src/prompts/capabilities/scan-security.ts:171", "shortDescription": {"text": "Insecure pattern 'document_write' in src/prompts/capabilities/scan-security.ts:171"}, "fullDescription": {"text": "Found a known-risky pattern (document_write). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d7392128042841ce", "name": "Insecure pattern 'eval_used' in src/prompts/capabilities/review-code.ts:86", "shortDescription": {"text": "Insecure pattern 'eval_used' in src/prompts/capabilities/review-code.ts:86"}, "fullDescription": {"text": "Found a known-risky pattern (eval_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-7a14cb0b7123f84f", "name": "Insecure pattern 'eval_used' in src/prompts/capabilities/review-flows.ts:250", "shortDescription": {"text": "Insecure pattern 'eval_used' in src/prompts/capabilities/review-flows.ts:250"}, "fullDescription": {"text": "Found a known-risky pattern (eval_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-d6defde16ec9b952", "name": "Insecure pattern 'eval_used' in src/prompts/capabilities/build-business-rule.ts:73", "shortDescription": {"text": "Insecure pattern 'eval_used' in src/prompts/capabilities/build-business-rule.ts:73"}, "fullDescription": {"text": "Found a known-risky pattern (eval_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-0355d567a46e9750", "name": "Insecure pattern 'eval_used' in src/prompts/capabilities/review-scripts.ts:73", "shortDescription": {"text": "Insecure pattern 'eval_used' in src/prompts/capabilities/review-scripts.ts:73"}, "fullDescription": {"text": "Found a known-risky pattern (eval_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-14aaafc66bea0bd4", "name": "Possible secret in src/sdk/index.ts", "shortDescription": {"text": "Possible secret in src/sdk/index.ts"}, "fullDescription": {"text": "Detected pattern matching password_literal. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-57aa391adb79415f", "name": "Insecure pattern 'node_child_process' in desktop/main/server-manager.ts:1", "shortDescription": {"text": "Insecure pattern 'node_child_process' in desktop/main/server-manager.ts:1"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-46c644c6227e4d4a", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/upload-artifact@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1838a141491ce38c", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-27924aa79fa4a517", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/setup-node@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4e03c1f9b387d039", "name": "Very large file: src/cli/setup.ts (1367 lines)", "shortDescription": {"text": "Very large file: src/cli/setup.ts (1367 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-38d9eaa56eb8cee3", "name": "Very large file: desktop/renderer/src/tools-data.ts (8219 lines)", "shortDescription": {"text": "Very large file: desktop/renderer/src/tools-data.ts (8219 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ea3b5e389d8c9c0f", "name": "Low test-to-source ratio", "shortDescription": {"text": "Low test-to-source ratio"}, "fullDescription": {"text": "21 tests / 138 src (ratio 0.15)."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 335 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 22 placeholder/mock markers across 13 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b6429e3617501ece", "name": "Agent authority lacks a verifier contract: clients/cursor/.cursor/mcp.basic.json", "shortDescription": {"text": "Agent authority lacks a verifier contract: clients/cursor/.cursor/mcp.basic.json"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-76077d6eea5aedf0", "name": "Agent authority lacks a verifier contract: clients/cursor/.cursor/mcp.oauth.json", "shortDescription": {"text": "Agent authority lacks a verifier contract: clients/cursor/.cursor/mcp.oauth.json"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4eb8f0a3829e5f0b", "name": "Agent authority lacks a verifier contract: skills/servicenow-incident-triage/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: skills/servicenow-incident-triage/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7f4c9095cf757bb9", "name": "Agent authority lacks a verifier contract: skills/servicenow-cmdb-health-audit/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: skills/servicenow-cmdb-health-audit/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1bcfec67bb613a89", "name": "Network/subprocess call without timeout or try/except \u2014 clients/gemini/servicenow_gemini_client.py:39", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 clients/gemini/servicenow_gemini_client.py:39"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e9623778439f78df", "name": "Network/subprocess call without timeout or try/except \u2014 clients/codex/servicenow_openai_client.py:40", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 clients/codex/servicenow_openai_client.py:40"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-cf71b52ab53e08cc", "name": "Legacy-named symbol `svc_backup` in scripts/generate-sample-reports.mjs:325", "shortDescription": {"text": "Legacy-named symbol `svc_backup` in scripts/generate-sample-reports.mjs:325"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3efb70fc4394a301", "name": "Legacy-named symbol `hasLegacy` in src/server.ts:24", "shortDescription": {"text": "Legacy-named symbol `hasLegacy` in src/server.ts:24"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-97a278751bfcd720", "name": "`fetch()` without try/.catch or AbortSignal \u2014 src/dashboard/index.ts:88", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/dashboard/index.ts:88"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-68fef83270392b5d", "name": "`fetch()` without try/.catch or AbortSignal \u2014 src/cli/auth.ts:116", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/cli/auth.ts:116"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c94d6e40d80c4eda", "name": "Commented-code block (6 lines) in src/prompts/knowledge.ts:1", "shortDescription": {"text": "Commented-code block (6 lines) in src/prompts/knowledge.ts:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-199f4946fb628ed9", "name": "`fetch()` without try/.catch or AbortSignal \u2014 src/servicenow/client.ts:240", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/servicenow/client.ts:240"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-de09169c8f0cc82f", "name": "`fetch()` without try/.catch or AbortSignal \u2014 desktop/main/index.ts:326", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 desktop/main/index.ts:326"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e0be55268bebd47f", "name": "`fetch()` without try/.catch or AbortSignal \u2014 desktop/renderer/src/api.ts:523", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 desktop/renderer/src/api.ts:523"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-75f8321ea82b2d23", "name": "`fetch()` without try/.catch or AbortSignal \u2014 desktop/renderer/src/pages/Chat.tsx:75", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 desktop/renderer/src/pages/Chat.tsx:75"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-29a2a3e970e3c2d1", "name": "`fetch()` without try/.catch or AbortSignal \u2014 desktop/renderer/src/pages/Dashboard.tsx:49", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 desktop/renderer/src/pages/Dashboard.tsx:49"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-02d4f58bf5b970ab", "name": "36 env vars used in code but missing from .env.example", "shortDescription": {"text": "36 env vars used in code but missing from .env.example"}, "fullDescription": {"text": "Drift between code and config docs. The first few: `ALLOWED_ORIGINS`, `CORS_ORIGIN`, `FLUENT_ENABLED`, `HOME`, `HOST`, `LLM_PROVIDER`, `MAX_RETRIES`, `MCP_TOOL_DISCOVERY` + 28 more. Add them (with a placeholder/comment) to .env.example so onboarding doesn't break."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d69439999be01dc9", "name": "Dangling fetch: GET https://registry.npmjs.org/nowaikit/latest (src/cli/index.ts:68)", "shortDescription": {"text": "Dangling fetch: GET https://registry.npmjs.org/nowaikit/latest (src/cli/index.ts:68)"}, "fullDescription": {"text": "`src/cli/index.ts:68` calls `GET https://registry.npmjs.org/nowaikit/latest` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/https:/registry.npmjs.org/nowaikit/latest`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-141c203cf6c26e58", "name": "Dangling fetch: GET http://localhost:11434/api/tags (src/cli/setup.ts:295)", "shortDescription": {"text": "Dangling fetch: GET http://localhost:11434/api/tags (src/cli/setup.ts:295)"}, "fullDescription": {"text": "`src/cli/setup.ts:295` calls `GET http://localhost:11434/api/tags` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/http:/localhost:11434/api/tags`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-f38e8abefcf406f5", "name": "Dangling fetch: GET http://localhost:1234/v1/models (src/cli/setup.ts:309)", "shortDescription": {"text": "Dangling fetch: GET http://localhost:1234/v1/models (src/cli/setup.ts:309)"}, "fullDescription": {"text": "`src/cli/setup.ts:309` calls `GET http://localhost:1234/v1/models` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/http:/localhost:1234/v1/models`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-feb25386d8ee1ff5", "name": "Dangling fetch: GET https://api.anthropic.com/v1/models (src/cli/setup.ts:327)", "shortDescription": {"text": "Dangling fetch: GET https://api.anthropic.com/v1/models (src/cli/setup.ts:327)"}, "fullDescription": {"text": "`src/cli/setup.ts:327` calls `GET https://api.anthropic.com/v1/models` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/https:/api.anthropic.com/v1/models`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-0aaf92f14c380be3", "name": "Dangling fetch: GET https://api.openai.com/v1/models (src/cli/setup.ts:348)", "shortDescription": {"text": "Dangling fetch: GET https://api.openai.com/v1/models (src/cli/setup.ts:348)"}, "fullDescription": {"text": "`src/cli/setup.ts:348` calls `GET https://api.openai.com/v1/models` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/https:/api.openai.com/v1/models`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-b2c3089a5cec6533", "name": "Dangling fetch: POST https://api.anthropic.com/v1/messages (desktop/main/index.ts:326)", "shortDescription": {"text": "Dangling fetch: POST https://api.anthropic.com/v1/messages (desktop/main/index.ts:326)"}, "fullDescription": {"text": "`desktop/main/index.ts:326` calls `POST https://api.anthropic.com/v1/messages` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/https:/api.anthropic.com/v1/messages`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-5bcf1725e16e5c27", "name": "Dangling fetch: POST /api/ai/anthropic/v1/messages (desktop/renderer/src/api.ts:523)", "shortDescription": {"text": "Dangling fetch: POST /api/ai/anthropic/v1/messages (desktop/renderer/src/api.ts:523)"}, "fullDescription": {"text": "`desktop/renderer/src/api.ts:523` calls `POST /api/ai/anthropic/v1/messages` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/ai/anthropic/v1/messages`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-3c30928c740f9d5a", "name": "Dangling fetch: POST /api/report/generate (desktop/renderer/src/pages/Chat.tsx:75)", "shortDescription": {"text": "Dangling fetch: POST /api/report/generate (desktop/renderer/src/pages/Chat.tsx:75)"}, "fullDescription": {"text": "`desktop/renderer/src/pages/Chat.tsx:75` calls `POST /api/report/generate` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/report/generate`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-d004c30b42ea2782", "name": "Dangling fetch: POST /api/report/generate (desktop/renderer/src/pages/Dashboard.tsx:49)", "shortDescription": {"text": "Dangling fetch: POST /api/report/generate (desktop/renderer/src/pages/Dashboard.tsx:49)"}, "fullDescription": {"text": "`desktop/renderer/src/pages/Dashboard.tsx:49` calls `POST /api/report/generate` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/report/generate`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-5baa8971ebe192a1", "name": "Unused endpoint: GET /", "shortDescription": {"text": "Unused endpoint: GET /"}, "fullDescription": {"text": "`src/dashboard/index.ts` declares `GET /` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d504b80adc9409ec", "name": "Unused endpoint: GET /dashboard", "shortDescription": {"text": "Unused endpoint: GET /dashboard"}, "fullDescription": {"text": "`src/dashboard/index.ts` declares `GET /dashboard` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-64fa3b2e0393e8d4", "name": "Unused endpoint: POST /a2a/tasks/send", "shortDescription": {"text": "Unused endpoint: POST /a2a/tasks/send"}, "fullDescription": {"text": "`src/a2a/index.ts` declares `POST /a2a/tasks/send` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a02b7c5cfe3a1910", "name": "Unused endpoint: POST /a2a/tasks/sendSubscribe", "shortDescription": {"text": "Unused endpoint: POST /a2a/tasks/sendSubscribe"}, "fullDescription": {"text": "`src/a2a/index.ts` declares `POST /a2a/tasks/sendSubscribe` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b6761eb41b34a769", "name": "Unused endpoint: GET /a2a/tasks/:taskId", "shortDescription": {"text": "Unused endpoint: GET /a2a/tasks/:taskId"}, "fullDescription": {"text": "`src/a2a/index.ts` declares `GET /a2a/tasks/:taskId` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-dd6cb73e57959109", "name": "Unused endpoint: POST /a2a/tasks/:taskId/cancel", "shortDescription": {"text": "Unused endpoint: POST /a2a/tasks/:taskId/cancel"}, "fullDescription": {"text": "`src/a2a/index.ts` declares `POST /a2a/tasks/:taskId/cancel` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-955be1b15a9b97b0", "name": "Unused endpoint: GET /api/tools/:name", "shortDescription": {"text": "Unused endpoint: GET /api/tools/:name"}, "fullDescription": {"text": "`src/api/index.ts` declares `GET /api/tools/:name` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cfd263e3b029c209", "name": "Unused endpoint: POST /api/tool", "shortDescription": {"text": "Unused endpoint: POST /api/tool"}, "fullDescription": {"text": "`src/api/index.ts` declares `POST /api/tool` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9faab8556d0772a7", "name": "Unused endpoint: GET /api/resource", "shortDescription": {"text": "Unused endpoint: GET /api/resource"}, "fullDescription": {"text": "`src/api/index.ts` declares `GET /api/resource` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-02cb91f383cbb5c6", "name": "Unused endpoint: GET /api/instances", "shortDescription": {"text": "Unused endpoint: GET /api/instances"}, "fullDescription": {"text": "`src/api/index.ts` declares `GET /api/instances` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7f09bc0119bbe03e", "name": "Unused endpoint: POST /api/instances/switch", "shortDescription": {"text": "Unused endpoint: POST /api/instances/switch"}, "fullDescription": {"text": "`src/api/index.ts` declares `POST /api/instances/switch` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-13451f35f0ddd1ca", "name": "Unused endpoint: GET /sse", "shortDescription": {"text": "Unused endpoint: GET /sse"}, "fullDescription": {"text": "`src/transport/index.ts` declares `GET /sse` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cde167f60259e05e", "name": "Unused endpoint: POST /messages", "shortDescription": {"text": "Unused endpoint: POST /messages"}, "fullDescription": {"text": "`src/transport/index.ts` declares `POST /messages` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-239a938869adf673", "name": "Unused endpoint: POST /mcp", "shortDescription": {"text": "Unused endpoint: POST /mcp"}, "fullDescription": {"text": "`src/transport/index.ts` declares `POST /mcp` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cc1d680cdc3d6aa1", "name": "Unused endpoint: GET /mcp", "shortDescription": {"text": "Unused endpoint: GET /mcp"}, "fullDescription": {"text": "`src/transport/index.ts` declares `GET /mcp` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-56b4efafa0127feb", "name": "Unused endpoint: DELETE /mcp", "shortDescription": {"text": "Unused endpoint: DELETE /mcp"}, "fullDescription": {"text": "`src/transport/index.ts` declares `DELETE /mcp` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/23840"}, "properties": {"repository": "aartiq/nowaikit", "repoUrl": "https://github.com/aartiq/nowaikit", "branch": "main"}, "results": [{"ruleId": "scanner-306dcb4809eb1048", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 src/reports/index.ts:14"}, "properties": {"repobilityId": "6f3b781ea3a19e52", "scanner": "scanner-primary", "fingerprint": "306dcb4809eb1048", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-d651ca412ef5e18d", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 src/cli/index.ts:50"}, "properties": {"repobilityId": "ee7dac2d7990903e", "scanner": "scanner-primary", "fingerprint": "d651ca412ef5e18d", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-2bd9136dfa0fbdd8", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 src/cli/setup.ts:67"}, "properties": {"repobilityId": "07b6df00a7f785f7", "scanner": "scanner-primary", "fingerprint": "2bd9136dfa0fbdd8", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-8047cc77d89a98d7", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 src/cli/auth.ts:56"}, "properties": {"repobilityId": "90028bd5254e87bd", "scanner": "scanner-primary", "fingerprint": "8047cc77d89a98d7", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-527a52da2381ac8a", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 src/cli/shortcuts.ts:18"}, "properties": {"repobilityId": "734174be1992c519", "scanner": "scanner-primary", "fingerprint": "527a52da2381ac8a", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-a23d59c2c8d03a39", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 src/prompts/capabilities/scan-security.ts:177"}, "properties": {"repobilityId": "0d2df1ed498d1887", "scanner": "scanner-primary", "fingerprint": "a23d59c2c8d03a39", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-b6b4f7c0ab38c296", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 src/prompts/capabilities/scan-debt.ts:200"}, "properties": {"repobilityId": "d40ed29e7b2c5a7b", "scanner": "scanner-primary", "fingerprint": "b6b4f7c0ab38c296", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-386006c440839763", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 src/sdk/index.ts:32"}, "properties": {"repobilityId": "e4b720cc03f72d71", "scanner": "scanner-primary", "fingerprint": "386006c440839763", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-c79de4cc0402e28b", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 desktop/main/server-manager.ts:154"}, "properties": {"repobilityId": "cfaba1593eca86b2", "scanner": "scanner-primary", "fingerprint": "c79de4cc0402e28b", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-f03b1f8a7844476d", "level": "note", "message": {"text": "Icon-only button without accessible name \u2014 desktop/renderer/src/pages/Tools.tsx:96"}, "properties": {"repobilityId": "104c875068695337", "scanner": "scanner-primary", "fingerprint": "f03b1f8a7844476d", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.button.no-label"]}}, {"ruleId": "scanner-d63da3583b14afc0", "level": "warning", "message": {"text": "Dockerfile runs as root: Dockerfile"}, "properties": {"repobilityId": "a2ed1bd120e507db", "scanner": "scanner-primary", "fingerprint": "d63da3583b14afc0", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-8987d6d1c30c7202", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: node:20-alpine"}, "properties": {"repobilityId": "068fbf45727eac17", "scanner": "scanner-primary", "fingerprint": "8987d6d1c30c7202", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Dockerfile"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-bc112666ab729dae", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in src/dashboard/index.ts:93"}, "properties": {"repobilityId": "4c16d4eed33d7237", "scanner": "scanner-primary", "fingerprint": "bc112666ab729dae", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/dashboard/index.ts"}, "region": {"startLine": 93}}}]}, {"ruleId": "scanner-fe76e63111f60961", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in src/tools/fluent.ts:12"}, "properties": {"repobilityId": "54790f7757e78b8f", "scanner": "scanner-primary", "fingerprint": "fe76e63111f60961", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/tools/fluent.ts"}, "region": {"startLine": 12}}}]}, {"ruleId": "scanner-af6bc312c9e562c9", "level": "error", "message": {"text": "Insecure pattern 'eval_used' in src/tools/deployment.ts:93"}, "properties": {"repobilityId": "51eda480dcf7fb7b", "scanner": "scanner-primary", "fingerprint": "af6bc312c9e562c9", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "eval_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/tools/deployment.ts"}, "region": {"startLine": 93}}}]}, {"ruleId": "scanner-e4bf74c34dfdfdfa", "level": "error", "message": {"text": "Insecure pattern 'eval_used' in src/resources/query-syntax.ts:100"}, "properties": {"repobilityId": "eeac2e620d319a91", "scanner": "scanner-primary", "fingerprint": "e4bf74c34dfdfdfa", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "eval_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/resources/query-syntax.ts"}, "region": {"startLine": 100}}}]}, {"ruleId": "scanner-a138124e67cfaf7c", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in src/cli/index.ts:18"}, "properties": {"repobilityId": "ddab1ee5a94e4e7a", "scanner": "scanner-primary", "fingerprint": "a138124e67cfaf7c", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/cli/index.ts"}, "region": {"startLine": 18}}}]}, {"ruleId": "scanner-c0d23face91c07b3", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in src/cli/setup.ts:20"}, "properties": {"repobilityId": "1551153b8eae4df8", "scanner": "scanner-primary", "fingerprint": "c0d23face91c07b3", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/cli/setup.ts"}, "region": {"startLine": 20}}}]}, {"ruleId": "scanner-e326d48645d03bb4", "level": "error", "message": {"text": "Possible secret in src/cli/auth.ts"}, "properties": {"repobilityId": "046d179e3b94f6a3", "scanner": "scanner-primary", "fingerprint": "e326d48645d03bb4", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/cli/auth.ts"}, "region": {"startLine": 144}}}]}, {"ruleId": "scanner-c438e91a21f173f5", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in src/cli/detect-clients.ts:8"}, "properties": {"repobilityId": "6ccd49118fbf75c1", "scanner": "scanner-primary", "fingerprint": "c438e91a21f173f5", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/cli/detect-clients.ts"}, "region": {"startLine": 8}}}]}, {"ruleId": "scanner-5b0b2181c2c704e0", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in src/cli/writers/index.ts:7"}, "properties": {"repobilityId": "bcd9591ce4047e0e", "scanner": "scanner-primary", "fingerprint": "5b0b2181c2c704e0", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/cli/writers/index.ts"}, "region": {"startLine": 7}}}]}, {"ruleId": "scanner-84c46afbec548f45", "level": "error", "message": {"text": "Insecure pattern 'eval_used' in src/prompts/knowledge.ts:337"}, "properties": {"repobilityId": "b0f3f4bef2fd7adb", "scanner": "scanner-primary", "fingerprint": "84c46afbec548f45", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "eval_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/prompts/knowledge.ts"}, "region": {"startLine": 337}}}]}, {"ruleId": "scanner-d21bd65c84e0c060", "level": "error", "message": {"text": "Insecure pattern 'eval_used' in src/prompts/capabilities/build-app.ts:193"}, "properties": {"repobilityId": "218eeba2ab2cab7a", "scanner": "scanner-primary", "fingerprint": "d21bd65c84e0c060", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "eval_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/prompts/capabilities/build-app.ts"}, "region": {"startLine": 193}}}]}, {"ruleId": "scanner-11857a34fc1feb5c", "level": "error", "message": {"text": "Insecure pattern 'eval_used' in src/prompts/capabilities/scan-security.ts:139"}, "properties": {"repobilityId": "1fe5e3c330bb0dda", "scanner": "scanner-primary", "fingerprint": "11857a34fc1feb5c", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "eval_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/prompts/capabilities/scan-security.ts"}, "region": {"startLine": 139}}}]}, {"ruleId": "scanner-b0b985c7ccd3ee4e", "level": "error", "message": {"text": "Insecure pattern 'new_function_used' in src/prompts/capabilities/scan-security.ts:178"}, "properties": {"repobilityId": "3b16228f4827b6f5", "scanner": "scanner-primary", "fingerprint": "b0b985c7ccd3ee4e", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "new_function_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/prompts/capabilities/scan-security.ts"}, "region": {"startLine": 178}}}]}, {"ruleId": "scanner-5183ec08c0357b9c", "level": "note", "message": {"text": "Insecure pattern 'document_write' in src/prompts/capabilities/scan-security.ts:171"}, "properties": {"repobilityId": "d0164cece65426ee", "scanner": "scanner-primary", "fingerprint": "5183ec08c0357b9c", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["owasp", "document_write"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/prompts/capabilities/scan-security.ts"}, "region": {"startLine": 171}}}]}, {"ruleId": "scanner-d7392128042841ce", "level": "error", "message": {"text": "Insecure pattern 'eval_used' in src/prompts/capabilities/review-code.ts:86"}, "properties": {"repobilityId": "6045268f9efb3be8", "scanner": "scanner-primary", "fingerprint": "d7392128042841ce", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "eval_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/prompts/capabilities/review-code.ts"}, "region": {"startLine": 86}}}]}, {"ruleId": "scanner-7a14cb0b7123f84f", "level": "error", "message": {"text": "Insecure pattern 'eval_used' in src/prompts/capabilities/review-flows.ts:250"}, "properties": {"repobilityId": "05cdc3d162da52cf", "scanner": "scanner-primary", "fingerprint": "7a14cb0b7123f84f", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "eval_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/prompts/capabilities/review-flows.ts"}, "region": {"startLine": 250}}}]}, {"ruleId": "scanner-d6defde16ec9b952", "level": "error", "message": {"text": "Insecure pattern 'eval_used' in src/prompts/capabilities/build-business-rule.ts:73"}, "properties": {"repobilityId": "2801bb3d18829364", "scanner": "scanner-primary", "fingerprint": "d6defde16ec9b952", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "eval_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/prompts/capabilities/build-business-rule.ts"}, "region": {"startLine": 73}}}]}, {"ruleId": "scanner-0355d567a46e9750", "level": "error", "message": {"text": "Insecure pattern 'eval_used' in src/prompts/capabilities/review-scripts.ts:73"}, "properties": {"repobilityId": "96d33baf3b05511e", "scanner": "scanner-primary", "fingerprint": "0355d567a46e9750", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "eval_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/prompts/capabilities/review-scripts.ts"}, "region": {"startLine": 73}}}]}, {"ruleId": "scanner-14aaafc66bea0bd4", "level": "error", "message": {"text": "Possible secret in src/sdk/index.ts"}, "properties": {"repobilityId": "f4f8f46670acac88", "scanner": "scanner-primary", "fingerprint": "14aaafc66bea0bd4", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/sdk/index.ts"}, "region": {"startLine": 14}}}]}, {"ruleId": "scanner-57aa391adb79415f", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in desktop/main/server-manager.ts:1"}, "properties": {"repobilityId": "c1bb9f933131d3c8", "scanner": "scanner-primary", "fingerprint": "57aa391adb79415f", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "desktop/main/server-manager.ts"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "5ab0c5bd71e63ad8", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 31}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "5ab0c5bd71e63ad8", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 58}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "5ab0c5bd71e63ad8", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 85}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "b0f359fc82dc1097", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 101}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f0dc584a111ffc00", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 106}}}]}, {"ruleId": "scanner-1838a141491ce38c", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "b8fd4f5048f96576", "scanner": "scanner-primary", "fingerprint": "1838a141491ce38c", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "989a74409a402368", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 21}}}]}, {"ruleId": "scanner-4e03c1f9b387d039", "level": "note", "message": {"text": "Very large file: src/cli/setup.ts (1367 lines)"}, "properties": {"repobilityId": "4a1a66bef6bc5122", "scanner": "scanner-primary", "fingerprint": "4e03c1f9b387d039", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-38d9eaa56eb8cee3", "level": "note", "message": {"text": "Very large file: desktop/renderer/src/tools-data.ts (8219 lines)"}, "properties": {"repobilityId": "048d7c5094ed2be5", "scanner": "scanner-primary", "fingerprint": "38d9eaa56eb8cee3", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-ea3b5e389d8c9c0f", "level": "note", "message": {"text": "Low test-to-source ratio"}, "properties": {"repobilityId": "ef7b2552cc00a375", "scanner": "scanner-primary", "fingerprint": "ea3b5e389d8c9c0f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["tests"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "6fe457ebae3a3fe4", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "2f7efeb6be1cc011", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "fa8d2df48b3da3db", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-b6429e3617501ece", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: clients/cursor/.cursor/mcp.basic.json"}, "properties": {"repobilityId": "9761597af755103f", "scanner": "scanner-primary", "fingerprint": "b6429e3617501ece", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "cursor_rule"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "clients/cursor/.cursor/mcp.basic.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-76077d6eea5aedf0", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: clients/cursor/.cursor/mcp.oauth.json"}, "properties": {"repobilityId": "3a0a816634555891", "scanner": "scanner-primary", "fingerprint": "76077d6eea5aedf0", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "cursor_rule"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "clients/cursor/.cursor/mcp.oauth.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4eb8f0a3829e5f0b", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: skills/servicenow-incident-triage/SKILL.md"}, "properties": {"repobilityId": "3566df43c07e65c3", "scanner": "scanner-primary", "fingerprint": "4eb8f0a3829e5f0b", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/servicenow-incident-triage/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7f4c9095cf757bb9", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: skills/servicenow-cmdb-health-audit/SKILL.md"}, "properties": {"repobilityId": "a2442e77da068eff", "scanner": "scanner-primary", "fingerprint": "7f4c9095cf757bb9", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/servicenow-cmdb-health-audit/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1bcfec67bb613a89", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 clients/gemini/servicenow_gemini_client.py:39"}, "properties": {"repobilityId": "28653fb05ae5b470", "scanner": "scanner-primary", "fingerprint": "1bcfec67bb613a89", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-e9623778439f78df", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 clients/codex/servicenow_openai_client.py:40"}, "properties": {"repobilityId": "22d90a17416827ed", "scanner": "scanner-primary", "fingerprint": "e9623778439f78df", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-cf71b52ab53e08cc", "level": "note", "message": {"text": "Legacy-named symbol `svc_backup` in scripts/generate-sample-reports.mjs:325"}, "properties": {"repobilityId": "911c5934f6cc6dfc", "scanner": "scanner-primary", "fingerprint": "cf71b52ab53e08cc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-3efb70fc4394a301", "level": "note", "message": {"text": "Legacy-named symbol `hasLegacy` in src/server.ts:24"}, "properties": {"repobilityId": "181def615f45c985", "scanner": "scanner-primary", "fingerprint": "3efb70fc4394a301", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-97a278751bfcd720", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/dashboard/index.ts:88"}, "properties": {"repobilityId": "319135b930bd4b1c", "scanner": "scanner-primary", "fingerprint": "97a278751bfcd720", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-68fef83270392b5d", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/cli/auth.ts:116"}, "properties": {"repobilityId": "6cea5671bfbea4e3", "scanner": "scanner-primary", "fingerprint": "68fef83270392b5d", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-c94d6e40d80c4eda", "level": "none", "message": {"text": "Commented-code block (6 lines) in src/prompts/knowledge.ts:1"}, "properties": {"repobilityId": "45e820b556d95c65", "scanner": "scanner-primary", "fingerprint": "c94d6e40d80c4eda", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-199f4946fb628ed9", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/servicenow/client.ts:240"}, "properties": {"repobilityId": "6979bc94258c340f", "scanner": "scanner-primary", "fingerprint": "199f4946fb628ed9", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-de09169c8f0cc82f", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 desktop/main/index.ts:326"}, "properties": {"repobilityId": "bcb1c058de613b18", "scanner": "scanner-primary", "fingerprint": "de09169c8f0cc82f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-e0be55268bebd47f", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 desktop/renderer/src/api.ts:523"}, "properties": {"repobilityId": "66e21f487891161b", "scanner": "scanner-primary", "fingerprint": "e0be55268bebd47f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-75f8321ea82b2d23", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 desktop/renderer/src/pages/Chat.tsx:75"}, "properties": {"repobilityId": "425d65ff8e728a30", "scanner": "scanner-primary", "fingerprint": "75f8321ea82b2d23", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-29a2a3e970e3c2d1", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 desktop/renderer/src/pages/Dashboard.tsx:49"}, "properties": {"repobilityId": "8cc3e884a75ab811", "scanner": "scanner-primary", "fingerprint": "29a2a3e970e3c2d1", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-02d4f58bf5b970ab", "level": "note", "message": {"text": "36 env vars used in code but missing from .env.example"}, "properties": {"repobilityId": "8842434a0f433d2d", "scanner": "scanner-primary", "fingerprint": "02d4f58bf5b970ab", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "config-drift"]}}, {"ruleId": "scanner-d69439999be01dc9", "level": "error", "message": {"text": "Dangling fetch: GET https://registry.npmjs.org/nowaikit/latest (src/cli/index.ts:68)"}, "properties": {"repobilityId": "a62940b794914056", "scanner": "scanner-primary", "fingerprint": "d69439999be01dc9", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-141c203cf6c26e58", "level": "error", "message": {"text": "Dangling fetch: GET http://localhost:11434/api/tags (src/cli/setup.ts:295)"}, "properties": {"repobilityId": "eb2396df47d6f81f", "scanner": "scanner-primary", "fingerprint": "141c203cf6c26e58", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-f38e8abefcf406f5", "level": "error", "message": {"text": "Dangling fetch: GET http://localhost:1234/v1/models (src/cli/setup.ts:309)"}, "properties": {"repobilityId": "2f7a9eae6a300aff", "scanner": "scanner-primary", "fingerprint": "f38e8abefcf406f5", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-feb25386d8ee1ff5", "level": "error", "message": {"text": "Dangling fetch: GET https://api.anthropic.com/v1/models (src/cli/setup.ts:327)"}, "properties": {"repobilityId": "f0fc28e47db938e4", "scanner": "scanner-primary", "fingerprint": "feb25386d8ee1ff5", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-0aaf92f14c380be3", "level": "error", "message": {"text": "Dangling fetch: GET https://api.openai.com/v1/models (src/cli/setup.ts:348)"}, "properties": {"repobilityId": "ac4418472be73bb2", "scanner": "scanner-primary", "fingerprint": "0aaf92f14c380be3", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-b2c3089a5cec6533", "level": "error", "message": {"text": "Dangling fetch: POST https://api.anthropic.com/v1/messages (desktop/main/index.ts:326)"}, "properties": {"repobilityId": "347da824b9ea01e6", "scanner": "scanner-primary", "fingerprint": "b2c3089a5cec6533", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-5bcf1725e16e5c27", "level": "error", "message": {"text": "Dangling fetch: POST /api/ai/anthropic/v1/messages (desktop/renderer/src/api.ts:523)"}, "properties": {"repobilityId": "ed00db45633f7d05", "scanner": "scanner-primary", "fingerprint": "5bcf1725e16e5c27", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-3c30928c740f9d5a", "level": "error", "message": {"text": "Dangling fetch: POST /api/report/generate (desktop/renderer/src/pages/Chat.tsx:75)"}, "properties": {"repobilityId": "5dbdbaf3137d0170", "scanner": "scanner-primary", "fingerprint": "3c30928c740f9d5a", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-d004c30b42ea2782", "level": "error", "message": {"text": "Dangling fetch: POST /api/report/generate (desktop/renderer/src/pages/Dashboard.tsx:49)"}, "properties": {"repobilityId": "a683cb8e116a4682", "scanner": "scanner-primary", "fingerprint": "d004c30b42ea2782", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-5baa8971ebe192a1", "level": "note", "message": {"text": "Unused endpoint: GET /"}, "properties": {"repobilityId": "75a4341b43f3756d", "scanner": "scanner-primary", "fingerprint": "5baa8971ebe192a1", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-d504b80adc9409ec", "level": "note", "message": {"text": "Unused endpoint: GET /dashboard"}, "properties": {"repobilityId": "ba8b09ef1f2c8a03", "scanner": "scanner-primary", "fingerprint": "d504b80adc9409ec", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-64fa3b2e0393e8d4", "level": "note", "message": {"text": "Unused endpoint: POST /a2a/tasks/send"}, "properties": {"repobilityId": "3d2412ebd8c386a5", "scanner": "scanner-primary", "fingerprint": "64fa3b2e0393e8d4", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-a02b7c5cfe3a1910", "level": "note", "message": {"text": "Unused endpoint: POST /a2a/tasks/sendSubscribe"}, "properties": {"repobilityId": "b72eede45bcb1dc8", "scanner": "scanner-primary", "fingerprint": "a02b7c5cfe3a1910", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-b6761eb41b34a769", "level": "note", "message": {"text": "Unused endpoint: GET /a2a/tasks/:taskId"}, "properties": {"repobilityId": "6f2541f206fcb0b4", "scanner": "scanner-primary", "fingerprint": "b6761eb41b34a769", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-dd6cb73e57959109", "level": "note", "message": {"text": "Unused endpoint: POST /a2a/tasks/:taskId/cancel"}, "properties": {"repobilityId": "3760a5c5dc35d3c6", "scanner": "scanner-primary", "fingerprint": "dd6cb73e57959109", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-955be1b15a9b97b0", "level": "note", "message": {"text": "Unused endpoint: GET /api/tools/:name"}, "properties": {"repobilityId": "1077400a1b3be6db", "scanner": "scanner-primary", "fingerprint": "955be1b15a9b97b0", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-cfd263e3b029c209", "level": "note", "message": {"text": "Unused endpoint: POST /api/tool"}, "properties": {"repobilityId": "5a0d8b137584b878", "scanner": "scanner-primary", "fingerprint": "cfd263e3b029c209", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-9faab8556d0772a7", "level": "note", "message": {"text": "Unused endpoint: GET /api/resource"}, "properties": {"repobilityId": "e2441f853051a873", "scanner": "scanner-primary", "fingerprint": "9faab8556d0772a7", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-02cb91f383cbb5c6", "level": "note", "message": {"text": "Unused endpoint: GET /api/instances"}, "properties": {"repobilityId": "318ddf0816ab04ab", "scanner": "scanner-primary", "fingerprint": "02cb91f383cbb5c6", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-7f09bc0119bbe03e", "level": "note", "message": {"text": "Unused endpoint: POST /api/instances/switch"}, "properties": {"repobilityId": "49c2fb26320b3b65", "scanner": "scanner-primary", "fingerprint": "7f09bc0119bbe03e", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-13451f35f0ddd1ca", "level": "note", "message": {"text": "Unused endpoint: GET /sse"}, "properties": {"repobilityId": "1b785b89eeb77f73", "scanner": "scanner-primary", "fingerprint": "13451f35f0ddd1ca", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-cde167f60259e05e", "level": "note", "message": {"text": "Unused endpoint: POST /messages"}, "properties": {"repobilityId": "8ff445bc82b2b335", "scanner": "scanner-primary", "fingerprint": "cde167f60259e05e", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-239a938869adf673", "level": "note", "message": {"text": "Unused endpoint: POST /mcp"}, "properties": {"repobilityId": "f68ad818b219ea5c", "scanner": "scanner-primary", "fingerprint": "239a938869adf673", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-cc1d680cdc3d6aa1", "level": "note", "message": {"text": "Unused endpoint: GET /mcp"}, "properties": {"repobilityId": "54bc3a3db0fd2572", "scanner": "scanner-primary", "fingerprint": "cc1d680cdc3d6aa1", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-56b4efafa0127feb", "level": "note", "message": {"text": "Unused endpoint: DELETE /mcp"}, "properties": {"repobilityId": "2b266c97d95c08fd", "scanner": "scanner-primary", "fingerprint": "56b4efafa0127feb", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}]}]}