{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-227dfe49af44b1f6", "name": "Possibly dead Python function: run_agent_stream", "shortDescription": {"text": "Possibly dead Python function: run_agent_stream"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-902409798244c934", "name": "Possibly dead Python function: run_agent_resume", "shortDescription": {"text": "Possibly dead Python function: run_agent_resume"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b41b8379f2b74c36", "name": "Possibly dead Python function: create_notebook", "shortDescription": {"text": "Possibly dead Python function: create_notebook"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e1a83171f9446482", "name": "Possibly dead Python function: insert_code_cell", "shortDescription": {"text": "Possibly dead Python function: insert_code_cell"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fd52c192a5cc534d", "name": "Possibly dead Python function: modify_cell", "shortDescription": {"text": "Possibly dead Python function: modify_cell"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-57e97df055fe33c9", "name": "Possibly dead Python function: execute_cell", "shortDescription": {"text": "Possibly dead Python function: execute_cell"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1745a3079f50b3c2", "name": "Stray `console.log` in TS/JS \u2014 src/index.ts:37", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 src/index.ts:37"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f74dbdf9bcc344cb", "name": "Stray `console.log` in TS/JS \u2014 src/handler.ts:36", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 src/handler.ts:36"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-25d7a0afc34c953d", "name": "Stray `console.log` in TS/JS \u2014 src/widget.tsx:265", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 src/widget.tsx:265"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9710c8d059e53154", "name": "No frontend routes/components detected", "shortDescription": {"text": "No frontend routes/components detected"}, "fullDescription": {"text": "No React/Vue/Next routes were found. This is fine for backend-only repos."}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-6372cebde0220094", "name": "No auth library detected", "shortDescription": {"text": "No auth library detected"}, "fullDescription": {"text": "The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). The repo has auth/admin/session surface indicators, so auth may live in custom code, in a separate service, or be missing."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7efbda965f283c17", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-57cdb3984df2aab0", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 49 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9dc1b21f424acd39", "name": "Network/subprocess call without timeout or try/except \u2014 langstage_jupyter/agent.py:112", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 langstage_jupyter/agent.py:112"}, "fullDescription": {"text": "`requests.get(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2eafc3188c36bb02", "name": "3 env vars used in code but missing from .env.example", "shortDescription": {"text": "3 env vars used in code but missing from .env.example"}, "fullDescription": {"text": "Drift between code and config docs. The first few: `DEEPAGENT_WORKSPACE_ROOT`, `JUPYTER_AGENT_PATH`, `JUPYTER_TOKEN`. Add them (with a placeholder/comment) to .env.example so onboarding doesn't break."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-49c98f7cedd9c977", "name": "Near-duplicate function bodies in 4 places", "shortDescription": {"text": "Near-duplicate function bodies in 4 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nlangstage_jupyter/handlers.py:post, langstage_jupyter/handlers.py:post, langstage_jupyter/handlers.py:post, langstage_jupyter/handlers.py:post\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/25442"}, "properties": {"repository": "dkedar7/langstage-jupyter", "repoUrl": "https://github.com/dkedar7/langstage-jupyter", "branch": "main"}, "results": [{"ruleId": "scanner-227dfe49af44b1f6", "level": "note", "message": {"text": "Possibly dead Python function: run_agent_stream"}, "properties": {"repobilityId": "ad3580f299f1b720", "scanner": "scanner-primary", "fingerprint": "227dfe49af44b1f6", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "langstage_jupyter/handlers.py:83"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-902409798244c934", "level": "note", "message": {"text": "Possibly dead Python function: run_agent_resume"}, "properties": {"repobilityId": "7635621c62b52662", "scanner": "scanner-primary", "fingerprint": "902409798244c934", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "langstage_jupyter/handlers.py:195"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b41b8379f2b74c36", "level": "note", "message": {"text": "Possibly dead Python function: create_notebook"}, "properties": {"repobilityId": "e5ba92dce6dd080c", "scanner": "scanner-primary", "fingerprint": "b41b8379f2b74c36", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "langstage_jupyter/agent.py:204"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e1a83171f9446482", "level": "note", "message": {"text": "Possibly dead Python function: insert_code_cell"}, "properties": {"repobilityId": "2e915ddf80b27458", "scanner": "scanner-primary", "fingerprint": "e1a83171f9446482", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "langstage_jupyter/agent.py:226"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-fd52c192a5cc534d", "level": "note", "message": {"text": "Possibly dead Python function: modify_cell"}, "properties": {"repobilityId": "3ce05f9d592ceac1", "scanner": "scanner-primary", "fingerprint": "fd52c192a5cc534d", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "langstage_jupyter/agent.py:282"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-57e97df055fe33c9", "level": "note", "message": {"text": "Possibly dead Python function: execute_cell"}, "properties": {"repobilityId": "eb94f7023b6d55f8", "scanner": "scanner-primary", "fingerprint": "57e97df055fe33c9", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "langstage_jupyter/agent.py:348"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1745a3079f50b3c2", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 src/index.ts:37"}, "properties": {"repobilityId": "867f5b4f120dafeb", "scanner": "scanner-primary", "fingerprint": "1745a3079f50b3c2", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-f74dbdf9bcc344cb", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 src/handler.ts:36"}, "properties": {"repobilityId": "7dc67baab96efcc5", "scanner": "scanner-primary", "fingerprint": "f74dbdf9bcc344cb", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-25d7a0afc34c953d", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 src/widget.tsx:265"}, "properties": {"repobilityId": "1b41ca346f5b971f", "scanner": "scanner-primary", "fingerprint": "25d7a0afc34c953d", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-9710c8d059e53154", "level": "none", "message": {"text": "No frontend routes/components detected"}, "properties": {"repobilityId": "44ca61485762e494", "scanner": "scanner-primary", "fingerprint": "9710c8d059e53154", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-6372cebde0220094", "level": "warning", "message": {"text": "No auth library detected"}, "properties": {"repobilityId": "a5b6035a5bbf8054", "scanner": "scanner-primary", "fingerprint": "6372cebde0220094", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["coverage", "auth"]}}, {"ruleId": "scanner-7efbda965f283c17", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "56929525eac9a554", "scanner": "scanner-primary", "fingerprint": "7efbda965f283c17", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/test.yml"}, "region": {"startLine": 21}}}]}, {"ruleId": "scanner-7efbda965f283c17", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "cd843b74d3963b06", "scanner": "scanner-primary", "fingerprint": "7efbda965f283c17", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/test.yml"}, "region": {"startLine": 24}}}]}, {"ruleId": "scanner-7efbda965f283c17", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "3c5f7937c5980794", "scanner": "scanner-primary", "fingerprint": "7efbda965f283c17", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/test.yml"}, "region": {"startLine": 30}}}]}, {"ruleId": "scanner-7efbda965f283c17", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "3c77c1cde6959234", "scanner": "scanner-primary", "fingerprint": "7efbda965f283c17", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/test.yml"}, "region": {"startLine": 62}}}]}, {"ruleId": "scanner-57cdb3984df2aab0", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "9bf66498bafaa025", "scanner": "scanner-primary", "fingerprint": "57cdb3984df2aab0", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ui-tests.yml"}, "region": {"startLine": 17}}}]}, {"ruleId": "scanner-57cdb3984df2aab0", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "ebc9d25e3e2a2e83", "scanner": "scanner-primary", "fingerprint": "57cdb3984df2aab0", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ui-tests.yml"}, "region": {"startLine": 20}}}]}, {"ruleId": "scanner-57cdb3984df2aab0", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "8cd4c415704f1f71", "scanner": "scanner-primary", "fingerprint": "57cdb3984df2aab0", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ui-tests.yml"}, "region": {"startLine": 25}}}]}, {"ruleId": "scanner-57cdb3984df2aab0", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "41af670061c68e32", "scanner": "scanner-primary", "fingerprint": "57cdb3984df2aab0", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ui-tests.yml"}, "region": {"startLine": 63}}}]}, {"ruleId": "scanner-57cdb3984df2aab0", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "41af670061c68e32", "scanner": "scanner-primary", "fingerprint": "57cdb3984df2aab0", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ui-tests.yml"}, "region": {"startLine": 72}}}]}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "f1952f7bb35ddc5a", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "b9b340625898cdcd", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-9dc1b21f424acd39", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 langstage_jupyter/agent.py:112"}, "properties": {"repobilityId": "ff843fd311b53188", "scanner": "scanner-primary", "fingerprint": "9dc1b21f424acd39", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-2eafc3188c36bb02", "level": "none", "message": {"text": "3 env vars used in code but missing from .env.example"}, "properties": {"repobilityId": "bd934ba112b02ffa", "scanner": "scanner-primary", "fingerprint": "2eafc3188c36bb02", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "config-drift"]}}, {"ruleId": "scanner-49c98f7cedd9c977", "level": "note", "message": {"text": "Near-duplicate function bodies in 4 places"}, "properties": {"repobilityId": "53845114f8b892fe", "scanner": "scanner-primary", "fingerprint": "49c98f7cedd9c977", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}]}]}