{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-dd2f4407ea5f503b", "name": "Stray `console.log` in TS/JS \u2014 scripts/test-proxy-nested-body.js:42", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 scripts/test-proxy-nested-body.js:42"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a0db23dfe8a5d43c", "name": "`truncate` class without `title=` for hover reveal \u2014 packages/plugin/src/config/ConfigScreen.tsx:310", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 packages/plugin/src/config/ConfigScreen.tsx:310"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-998b8de485ca18d4", "name": "`truncate` class without `title=` for hover reveal \u2014 packages/plugin/src/desktop/Header.tsx:105", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 packages/plugin/src/desktop/Header.tsx:105"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-e203e935a9484390", "name": "`truncate` class without `title=` for hover reveal \u2014 packages/plugin/src/desktop/settings/DeploymentsListPane.tsx:252", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 packages/plugin/src/desktop/settings/DeploymentsListPane.tsx:252"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-1ed2428ba00b2849", "name": "`truncate` class without `title=` for hover reveal \u2014 packages/plugin/src/desktop/settings/AgentsListPane.tsx:155", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 packages/plugin/src/desktop/settings/AgentsListPane.tsx:155"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-4836c90af2146cb6", "name": "`truncate` class without `title=` for hover reveal \u2014 packages/plugin/src/desktop/settings/SkillsPane.tsx:256", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 packages/plugin/src/desktop/settings/SkillsPane.tsx:256"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-3fb7e905c06ca1cf", "name": "`truncate` class without `title=` for hover reveal \u2014 packages/plugin/src/desktop/settings/AccessPicker.tsx:100", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 packages/plugin/src/desktop/settings/AccessPicker.tsx:100"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-b5d0f71e5ba1d4ac", "name": "`truncate` class without `title=` for hover reveal \u2014 packages/plugin/src/desktop/settings/skill-add/SkillFileTab.tsx:78", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 packages/plugin/src/desktop/settings/skill-add/SkillFileTab.tsx:78"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-428cf9fe73046a49", "name": "`truncate` class without `title=` for hover reveal \u2014 packages/plugin/src/desktop/settings/agent-detail/DraftForm.tsx:206", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 packages/plugin/src/desktop/settings/agent-detail/DraftForm.tsx:206"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-22ed7da574a3540a", "name": "`truncate` class without `title=` for hover reveal \u2014 packages/plugin/src/desktop/components/ProgressIndicator.tsx:48", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 packages/plugin/src/desktop/components/ProgressIndicator.tsx:48"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-0009f670e2a095d4", "name": "`truncate` class without `title=` for hover reveal \u2014 packages/plugin/src/desktop/components/AgentMini.tsx:19", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 packages/plugin/src/desktop/components/AgentMini.tsx:19"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-9e5edef9128c5f33", "name": "`truncate` class without `title=` for hover reveal \u2014 packages/plugin/src/desktop/components/PresetAgentLanding.tsx:210", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 packages/plugin/src/desktop/components/PresetAgentLanding.tsx:210"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-2243bd983f098219", "name": "`truncate` class without `title=` for hover reveal \u2014 packages/plugin/src/desktop/components/AgentPicker.tsx:74", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 packages/plugin/src/desktop/components/AgentPicker.tsx:74"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-c5b1a579b1bb85ed", "name": "`truncate` class without `title=` for hover reveal \u2014 packages/plugin/src/desktop/components/ArtifactPane/ArtifactHeader.", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 packages/plugin/src/desktop/components/ArtifactPane/ArtifactHeader.tsx:40"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-1264ba0fb42e0395", "name": "`truncate` class without `title=` for hover reveal \u2014 packages/plugin/src/desktop/components/ArtifactPane/renderers/Agent", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 packages/plugin/src/desktop/components/ArtifactPane/renderers/AgentDraftArtifact.tsx:64"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-d1332c6d6a44d11d", "name": "`truncate` class without `title=` for hover reveal \u2014 packages/plugin/src/desktop/components/MessageItem/ArtifactRefMessa", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 packages/plugin/src/desktop/components/MessageItem/ArtifactRefMessage.tsx:63"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-8f1765092d7005b9", "name": "`truncate` class without `title=` for hover reveal \u2014 packages/plugin/src/desktop/components/MessageItem/UserMessage.tsx:", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 packages/plugin/src/desktop/components/MessageItem/UserMessage.tsx:36"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-4865c41a90fc538e", "name": "Stray `console.log` in TS/JS \u2014 packages/plugin/src/core/artifacts/types.test.ts:52", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/plugin/src/core/artifacts/types.test.ts:52"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ce44e6275be708b5", "name": "Stray `console.log` in TS/JS \u2014 packages/kintone-mcp/src/mcp.ts:71", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/kintone-mcp/src/mcp.ts:71"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f7c8d91ab1dbd49b", "name": "Insecure pattern 'node_child_process' in packages/plugin/scripts/keygen.mjs:11", "shortDescription": {"text": "Insecure pattern 'node_child_process' in packages/plugin/scripts/keygen.mjs:11"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-47f11c863733ba82", "name": "Insecure pattern 'node_child_process' in packages/plugin/scripts/build.mjs:12", "shortDescription": {"text": "Insecure pattern 'node_child_process' in packages/plugin/scripts/build.mjs:12"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f9d27b4d7c935192", "name": "Insecure pattern 'node_child_process' in packages/plugin/scripts/upload.mjs:15", "shortDescription": {"text": "Insecure pattern 'node_child_process' in packages/plugin/scripts/upload.mjs:15"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d845402d2e1efdac", "name": "Insecure pattern 'node_child_process' in packages/plugin/scripts/e2e.mjs:13", "shortDescription": {"text": "Insecure pattern 'node_child_process' in packages/plugin/scripts/e2e.mjs:13"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-cb2f832ea00757ad", "name": "Insecure pattern 'node_child_process' in packages/plugin/scripts/release.mjs:17", "shortDescription": {"text": "Insecure pattern 'node_child_process' in packages/plugin/scripts/release.mjs:17"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e4350c478a1f56e1", "name": "Insecure pattern 'new_function_used' in packages/plugin/src/desktop/components/ArtifactPane/renderers/ReactArtifact.tsx:", "shortDescription": {"text": "Insecure pattern 'new_function_used' in packages/plugin/src/desktop/components/ArtifactPane/renderers/ReactArtifact.tsx:79"}, "fullDescription": {"text": "Found a known-risky pattern (new_function_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-77456064e8c0ee8b", "name": "Insecure pattern 'direct_innerhtml_assignment' in packages/plugin/src/desktop/components/ArtifactPane/renderers/ReactArt", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in packages/plugin/src/desktop/components/ArtifactPane/renderers/ReactArtifact.tsx:39"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8d2cceea9ad77771", "name": "Insecure pattern 'direct_innerhtml_assignment' in packages/plugin/src/desktop/components/ArtifactPane/renderers/MermaidA", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in packages/plugin/src/desktop/components/ArtifactPane/renderers/MermaidArtifact.tsx:33"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2c06e3c051a2098e", "name": "Insecure pattern 'local_storage_auth_token' in packages/plugin/src/core/oauth/pkce.test.ts:66", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in packages/plugin/src/core/oauth/pkce.test.ts:66"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-866398fd43a2eae4", "name": "Insecure pattern 'cors_wildcard' in packages/kintone-mcp/src/index.ts:77", "shortDescription": {"text": "Insecure pattern 'cors_wildcard' in packages/kintone-mcp/src/index.ts:77"}, "fullDescription": {"text": "Found a known-risky pattern (cors_wildcard). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0aef6f5798738d58", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-dc9623e3da821384", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-de53ac274e5b4ecf", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-37716d9c0a33ad5c", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a5effcd78af7645c", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e4f658c0c00de0d4", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/upload-pages-artifact@v3 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-448d8837178ae57a", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b5b8b2192793f700", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-97dd6c123507d2ba", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-09edb261be82fd5c", "name": "Node manifest has dependencies but no lockfile: packages/plugin/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/plugin/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b23ff959c3a1cfe6", "name": "Node manifest has dependencies but no lockfile: packages/landing/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/landing/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-24125c5115eeee89", "name": "Node manifest has dependencies but no lockfile: packages/kintone-mcp/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/kintone-mcp/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 108 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 37 placeholder/mock markers across 13 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-749d4bc1bd66df5f", "name": "Agent instructions exist but release-hardening basics are missing", "shortDescription": {"text": "Agent instructions exist but release-hardening basics are missing"}, "fullDescription": {"text": "AI-coder instruction files were found, but the repo is missing lockfile. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-bea357a6497a2d5d", "name": "Agent authority lacks a verifier contract: CLAUDE.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: CLAUDE.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1fd979cd2888b19a", "name": "Agent instruction/config may expose a secret: packages/plugin/src/skills/kintone-plugin-development/SKILL.md", "shortDescription": {"text": "Agent instruction/config may expose a secret: packages/plugin/src/skills/kintone-plugin-development/SKILL.md"}, "fullDescription": {"text": "Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-84dc14bbc7fb94ea", "name": "Agent authority lacks a verifier contract: packages/plugin/src/skills/kintone-plugin-development/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: packages/plugin/src/skills/kintone-plugin-development/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b0056b033f483971", "name": "Commented-code block (5 lines) in eslint.config.js:33", "shortDescription": {"text": "Commented-code block (5 lines) in eslint.config.js:33"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-da0c160a1f47f2ec", "name": "Commented-code block (7 lines) in scripts/test-proxy-nested-body.js:4", "shortDescription": {"text": "Commented-code block (7 lines) in scripts/test-proxy-nested-body.js:4"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-1f6fa5d574dfac60", "name": "Commented-code block (8 lines) in scripts/verify-customize-rest-api.mjs:12", "shortDescription": {"text": "Commented-code block (8 lines) in scripts/verify-customize-rest-api.mjs:12"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-9ba6f8dd3ec69d9b", "name": "Commented-code block (8 lines) in scripts/verify-mcp-oauth.mjs:5", "shortDescription": {"text": "Commented-code block (8 lines) in scripts/verify-mcp-oauth.mjs:5"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-18057f2acad71271", "name": "`fetch()` without try/.catch or AbortSignal \u2014 scripts/verify-mcp-oauth.mjs:97", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 scripts/verify-mcp-oauth.mjs:97"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7329624b73d5ed1f", "name": "Commented-code block (6 lines) in packages/plugin/scripts/deploy-worker.mjs:16", "shortDescription": {"text": "Commented-code block (6 lines) in packages/plugin/scripts/deploy-worker.mjs:16"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-c0f6142400700c92", "name": "`fetch()` without try/.catch or AbortSignal \u2014 packages/plugin/scripts/deploy-worker.mjs:92", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/plugin/scripts/deploy-worker.mjs:92"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-64fb1976346b7e5b", "name": "Commented-code block (5 lines) in packages/plugin/scripts/build.mjs:4", "shortDescription": {"text": "Commented-code block (5 lines) in packages/plugin/scripts/build.mjs:4"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-8ad2717806d26a9f", "name": "Commented-code block (5 lines) in packages/plugin/scripts/snapshot-handoff.mjs:4", "shortDescription": {"text": "Commented-code block (5 lines) in packages/plugin/scripts/snapshot-handoff.mjs:4"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-eb96a7714a08f9fb", "name": "Commented-code block (5 lines) in packages/plugin/scripts/snapshot-wedge.mjs:4", "shortDescription": {"text": "Commented-code block (5 lines) in packages/plugin/scripts/snapshot-wedge.mjs:4"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-5e78a2d3642824f5", "name": "Commented-code block (7 lines) in packages/plugin/scripts/release.mjs:9", "shortDescription": {"text": "Commented-code block (7 lines) in packages/plugin/scripts/release.mjs:9"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-faedb2a9f8df6c09", "name": "`fetch()` without try/.catch or AbortSignal \u2014 packages/plugin/scripts/lib/kintone-deploy.mjs:15", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/plugin/scripts/lib/kintone-deploy.mjs:15"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-95f527eb950a4bc7", "name": "Commented-code block (5 lines) in packages/plugin/src/config/ConfigScreen.test.tsx:3", "shortDescription": {"text": "Commented-code block (5 lines) in packages/plugin/src/config/ConfigScreen.test.tsx:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-4bf8c73be0afc200", "name": "Commented-code block (5 lines) in packages/plugin/src/config/ConfigScreen.tsx:3", "shortDescription": {"text": "Commented-code block (5 lines) in packages/plugin/src/config/ConfigScreen.tsx:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-4b7dadc16755650e", "name": "Commented-code block (5 lines) in packages/plugin/src/desktop/settings/SettingsViewBound.tsx:8", "shortDescription": {"text": "Commented-code block (5 lines) in packages/plugin/src/desktop/settings/SettingsViewBound.tsx:8"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-c6b1af6d00f86203", "name": "`fetch()` without try/.catch or AbortSignal \u2014 packages/plugin/src/desktop/settings/SettingsViewBound.tsx:64", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/plugin/src/desktop/settings/SettingsViewBound.tsx:64"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-30f1bb2adf836bc2", "name": "Commented-code block (6 lines) in packages/plugin/src/desktop/components/ProgressIndicator.tsx:7", "shortDescription": {"text": "Commented-code block (6 lines) in packages/plugin/src/desktop/components/ProgressIndicator.tsx:7"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-773b03706fa3e802", "name": "Commented-code block (5 lines) in packages/plugin/src/desktop/components/AgentIcon.tsx:3", "shortDescription": {"text": "Commented-code block (5 lines) in packages/plugin/src/desktop/components/AgentIcon.tsx:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-5b16af54a4ca34e7", "name": "Commented-code block (5 lines) in packages/plugin/src/desktop/components/Composer.tsx:122", "shortDescription": {"text": "Commented-code block (5 lines) in packages/plugin/src/desktop/components/Composer.tsx:122"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-1d01cd3f31f6bd16", "name": "Commented-code block (6 lines) in packages/plugin/src/desktop/components/ConnectKintoneButton.tsx:3", "shortDescription": {"text": "Commented-code block (6 lines) in packages/plugin/src/desktop/components/ConnectKintoneButton.tsx:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-a7b226cb2f5e9854", "name": "Commented-code block (6 lines) in packages/plugin/src/desktop/hooks/useCustomToolResponder.ts:8", "shortDescription": {"text": "Commented-code block (6 lines) in packages/plugin/src/desktop/hooks/useCustomToolResponder.ts:8"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-9c8833d3ab19288f", "name": "Commented-code block (5 lines) in packages/plugin/src/desktop/hooks/useFileAttacher.ts:3", "shortDescription": {"text": "Commented-code block (5 lines) in packages/plugin/src/desktop/hooks/useFileAttacher.ts:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-5c7ce5cd4518c0e2", "name": "Legacy-named symbol `vcrd_old` in packages/plugin/src/desktop/hooks/useUserBinding.test.ts:209", "shortDescription": {"text": "Legacy-named symbol `vcrd_old` in packages/plugin/src/desktop/hooks/useUserBinding.test.ts:209"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4ca9d07679d961bb", "name": "Commented-code block (6 lines) in packages/plugin/src/desktop/hooks/useEventPoller.ts:108", "shortDescription": {"text": "Commented-code block (6 lines) in packages/plugin/src/desktop/hooks/useEventPoller.ts:108"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-fe7fe50bf8a477ba", "name": "Commented-code block (8 lines) in packages/plugin/src/chat/workflow/kintoneCustomizeApi.ts:6", "shortDescription": {"text": "Commented-code block (8 lines) in packages/plugin/src/chat/workflow/kintoneCustomizeApi.ts:6"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-63e7ce566e00fff0", "name": "Commented-code block (5 lines) in packages/plugin/src/chat/workflow/useApplyWorkflow.ts:5", "shortDescription": {"text": "Commented-code block (5 lines) in packages/plugin/src/chat/workflow/useApplyWorkflow.ts:5"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-83cb9d11f4188025", "name": "Commented-code block (6 lines) in packages/plugin/src/core/managed-agents/eventInterpreter.ts:3", "shortDescription": {"text": "Commented-code block (6 lines) in packages/plugin/src/core/managed-agents/eventInterpreter.ts:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-f926f9953eaf51fa", "name": "`fetch()` without try/.catch or AbortSignal \u2014 packages/plugin/src/core/managed-agents/client.ts:45", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/plugin/src/core/managed-agents/client.ts:45"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4f40453f90e4be1f", "name": "Commented-code block (5 lines) in packages/plugin/src/core/managed-agents/sessionLifecycle.ts:3", "shortDescription": {"text": "Commented-code block (5 lines) in packages/plugin/src/core/managed-agents/sessionLifecycle.ts:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-b8116f4647330016", "name": "Commented-code block (6 lines) in packages/plugin/src/core/kintone/users.ts:3", "shortDescription": {"text": "Commented-code block (6 lines) in packages/plugin/src/core/kintone/users.ts:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-c77ab9955c4a84de", "name": "`fetch()` without try/.catch or AbortSignal \u2014 packages/plugin/src/core/kintone/users.ts:11", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/plugin/src/core/kintone/users.ts:11"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-afb62ea1308a2a6e", "name": "Legacy-named symbol `env_old` in packages/plugin/src/core/bootstrap/resolveEnvironment.test.ts:42", "shortDescription": {"text": "Legacy-named symbol `env_old` in packages/plugin/src/core/bootstrap/resolveEnvironment.test.ts:42"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a215f52aec9b2d12", "name": "Commented-code block (6 lines) in packages/plugin/src/core/files/messageContent.ts:3", "shortDescription": {"text": "Commented-code block (6 lines) in packages/plugin/src/core/files/messageContent.ts:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-1709d02420c4ecae", "name": "Commented-code block (5 lines) in packages/plugin/src/core/oauth/popup.ts:3", "shortDescription": {"text": "Commented-code block (5 lines) in packages/plugin/src/core/oauth/popup.ts:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-d3a46e6250719b4e", "name": "`fetch()` without try/.catch or AbortSignal \u2014 packages/plugin/src/core/cloudflare/cfDeploy.test.ts:8", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/plugin/src/core/cloudflare/cfDeploy.test.ts:8"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-fe5a1e87067c04ee", "name": "Commented-code block (5 lines) in packages/plugin/src/core/cloudflare/cfDeploy.ts:8", "shortDescription": {"text": "Commented-code block (5 lines) in packages/plugin/src/core/cloudflare/cfDeploy.ts:8"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-b45ce7b0db5adf6f", "name": "Commented-code block (5 lines) in packages/plugin/src/core/deployments/view.ts:165", "shortDescription": {"text": "Commented-code block (5 lines) in packages/plugin/src/core/deployments/view.ts:165"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-ca4cd57dfd0e8cd0", "name": "Commented-code block (5 lines) in packages/plugin/src/core/skills/resolveBundledSkillIds.ts:7", "shortDescription": {"text": "Commented-code block (5 lines) in packages/plugin/src/core/skills/resolveBundledSkillIds.ts:7"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-a3824c927eaa95a7", "name": "Commented-code block (6 lines) in packages/plugin/src/core/skills/skillsSyncClient.ts:8", "shortDescription": {"text": "Commented-code block (6 lines) in packages/plugin/src/core/skills/skillsSyncClient.ts:8"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-cb031228958f589a", "name": "Commented-code block (7 lines) in packages/plugin/src/core/skills/resolveBundledSkillIds.test.ts:3", "shortDescription": {"text": "Commented-code block (7 lines) in packages/plugin/src/core/skills/resolveBundledSkillIds.test.ts:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-98c7ce06e7dc8ae1", "name": "Commented-code block (6 lines) in packages/plugin/e2e/css-sanity.spec.ts:3", "shortDescription": {"text": "Commented-code block (6 lines) in packages/plugin/e2e/css-sanity.spec.ts:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-e8643ba70f449efb", "name": "Commented-code block (6 lines) in packages/plugin/e2e/session-history.spec.ts:3", "shortDescription": {"text": "Commented-code block (6 lines) in packages/plugin/e2e/session-history.spec.ts:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-78c49e2f93e0b199", "name": "Commented-code block (6 lines) in packages/plugin/e2e/panel-toggle.spec.ts:3", "shortDescription": {"text": "Commented-code block (6 lines) in packages/plugin/e2e/panel-toggle.spec.ts:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-01b1db63c15bfd8b", "name": "Commented-code block (5 lines) in packages/plugin/e2e/config.spec.ts:62", "shortDescription": {"text": "Commented-code block (5 lines) in packages/plugin/e2e/config.spec.ts:62"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-c3e51b4894052ed0", "name": "`fetch()` without try/.catch or AbortSignal \u2014 packages/plugin/e2e/config.spec.ts:30", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/plugin/e2e/config.spec.ts:30"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1aaf171e5c644650", "name": "Commented-code block (5 lines) in packages/plugin/e2e/customizer-wedge.spec.ts:3", "shortDescription": {"text": "Commented-code block (5 lines) in packages/plugin/e2e/customizer-wedge.spec.ts:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-c876dd20fb0182b1", "name": "Commented-code block (9 lines) in packages/plugin/e2e/credential-bind.setup.ts:3", "shortDescription": {"text": "Commented-code block (9 lines) in packages/plugin/e2e/credential-bind.setup.ts:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-b0f20fb3b4f8068f", "name": "`fetch()` without try/.catch or AbortSignal \u2014 packages/plugin/e2e/credential-bind.setup.ts:114", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/plugin/e2e/credential-bind.setup.ts:114"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7ccc9bc6ccbef515", "name": "Commented-code block (8 lines) in packages/landing/src/scripts/lp.ts:1", "shortDescription": {"text": "Commented-code block (8 lines) in packages/landing/src/scripts/lp.ts:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-c6c5f894a091fc0d", "name": "Commented-code block (8 lines) in packages/kintone-mcp/tests/credentials-upsert.test.ts:3", "shortDescription": {"text": "Commented-code block (8 lines) in packages/kintone-mcp/tests/credentials-upsert.test.ts:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-1afd575e8b0926ca", "name": "Commented-code block (7 lines) in packages/kintone-mcp/tests/anthropic-passthrough.test.ts:3", "shortDescription": {"text": "Commented-code block (7 lines) in packages/kintone-mcp/tests/anthropic-passthrough.test.ts:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-94fd8b21d045acb2", "name": "Commented-code block (6 lines) in packages/kintone-mcp/tests/mcp.test.ts:3", "shortDescription": {"text": "Commented-code block (6 lines) in packages/kintone-mcp/tests/mcp.test.ts:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-9e8da0e0886e76fe", "name": "Commented-code block (6 lines) in packages/kintone-mcp/tests/skills-sync.test.ts:3", "shortDescription": {"text": "Commented-code block (6 lines) in packages/kintone-mcp/tests/skills-sync.test.ts:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-cfbfb284acb694ab", "name": "Commented-code block (8 lines) in packages/kintone-mcp/src/skills-sync.ts:10", "shortDescription": {"text": "Commented-code block (8 lines) in packages/kintone-mcp/src/skills-sync.ts:10"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-9dc9c094c17a1e0f", "name": "Commented-code block (7 lines) in packages/kintone-mcp/src/credentials-upsert.ts:3", "shortDescription": {"text": "Commented-code block (7 lines) in packages/kintone-mcp/src/credentials-upsert.ts:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-5e94e5409edc82a1", "name": "`fetch()` without try/.catch or AbortSignal \u2014 packages/kintone-mcp/src/credentials-upsert.ts:140", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/kintone-mcp/src/credentials-upsert.ts:140"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-58cfc8f6da172b9b", "name": "`fetch()` without try/.catch or AbortSignal \u2014 packages/kintone-mcp/src/kintone.ts:111", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/kintone-mcp/src/kintone.ts:111"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d078db3fbdb43cfa", "name": "Commented-code block (10 lines) in packages/kintone-mcp/src/index.ts:3", "shortDescription": {"text": "Commented-code block (10 lines) in packages/kintone-mcp/src/index.ts:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-03190d30e4fa9bf9", "name": "`fetch()` without try/.catch or AbortSignal \u2014 packages/kintone-mcp/src/index.ts:27", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/kintone-mcp/src/index.ts:27"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-cb12bb00703299c5", "name": "`fetch()` without try/.catch or AbortSignal \u2014 packages/kintone-mcp/src/anthropic-passthrough.ts:68", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/kintone-mcp/src/anthropic-passthrough.ts:68"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ad1f2c0971b89ce0", "name": "10 env vars used in code but missing from .env.example", "shortDescription": {"text": "10 env vars used in code but missing from .env.example"}, "fullDescription": {"text": "Drift between code and config docs. The first few: `ANTHROPIC_API_KEY`, `CLOUDFLARE_ACCOUNT_ID`, `CLOUDFLARE_API_TOKEN`, `KINTONE_DOMAIN`, `KINTONE_LOGIN`, `KINTONE_OAUTH_AUTHORIZATION_URL`, `KINTONE_OAUTH_CLIENT_ID`, `KINTONE_OAUTH_CLIENT_SECRET` + 2 more. Add them (with a placeholder/comment) to .env.example so onboarding doesn't break."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2c04133e54348533", "name": "Near-duplicate function bodies in 2 places", "shortDescription": {"text": "Near-duplicate function bodies in 2 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\npackages/kintone-helper/src/cowork_agent_kintone/records.py:get, packages/kintone-helper/src/cowork_agent_kintone/records.py:iter_all\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/20476"}, "properties": {"repository": "sugimomoto/CoworkAgentForKintone", "repoUrl": "https://github.com/sugimomoto/CoworkAgentForKintone", "branch": "main"}, "results": [{"ruleId": "scanner-dd2f4407ea5f503b", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 scripts/test-proxy-nested-body.js:42"}, "properties": {"repobilityId": "42a4485bb0febf9c", "scanner": "scanner-primary", "fingerprint": "dd2f4407ea5f503b", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-a0db23dfe8a5d43c", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 packages/plugin/src/config/ConfigScreen.tsx:310"}, "properties": {"repobilityId": "5d1b86a8ce9d106e", "scanner": "scanner-primary", "fingerprint": "a0db23dfe8a5d43c", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-998b8de485ca18d4", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 packages/plugin/src/desktop/Header.tsx:105"}, "properties": {"repobilityId": "aff1a13d8fbf6a29", "scanner": "scanner-primary", "fingerprint": "998b8de485ca18d4", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-e203e935a9484390", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 packages/plugin/src/desktop/settings/DeploymentsListPane.tsx:252"}, "properties": {"repobilityId": "0189252b4be40c96", "scanner": "scanner-primary", "fingerprint": "e203e935a9484390", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-1ed2428ba00b2849", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 packages/plugin/src/desktop/settings/AgentsListPane.tsx:155"}, "properties": {"repobilityId": "f6ca03881f362ff6", "scanner": "scanner-primary", "fingerprint": "1ed2428ba00b2849", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-4836c90af2146cb6", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 packages/plugin/src/desktop/settings/SkillsPane.tsx:256"}, "properties": {"repobilityId": "dda7c95f845c4e5f", "scanner": "scanner-primary", "fingerprint": "4836c90af2146cb6", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-3fb7e905c06ca1cf", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 packages/plugin/src/desktop/settings/AccessPicker.tsx:100"}, "properties": {"repobilityId": "e50504aabbd848d6", "scanner": "scanner-primary", "fingerprint": "3fb7e905c06ca1cf", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-b5d0f71e5ba1d4ac", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 packages/plugin/src/desktop/settings/skill-add/SkillFileTab.tsx:78"}, "properties": {"repobilityId": "83e40ee540830c6d", "scanner": "scanner-primary", "fingerprint": "b5d0f71e5ba1d4ac", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-428cf9fe73046a49", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 packages/plugin/src/desktop/settings/agent-detail/DraftForm.tsx:206"}, "properties": {"repobilityId": "e6af089ca517f377", "scanner": "scanner-primary", "fingerprint": "428cf9fe73046a49", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-22ed7da574a3540a", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 packages/plugin/src/desktop/components/ProgressIndicator.tsx:48"}, "properties": {"repobilityId": "7a9536b9ad49d114", "scanner": "scanner-primary", "fingerprint": "22ed7da574a3540a", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-0009f670e2a095d4", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 packages/plugin/src/desktop/components/AgentMini.tsx:19"}, "properties": {"repobilityId": "3a461a206476c1fa", "scanner": "scanner-primary", "fingerprint": "0009f670e2a095d4", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-9e5edef9128c5f33", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 packages/plugin/src/desktop/components/PresetAgentLanding.tsx:210"}, "properties": {"repobilityId": "aa12ed64a5475b3f", "scanner": "scanner-primary", "fingerprint": "9e5edef9128c5f33", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-2243bd983f098219", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 packages/plugin/src/desktop/components/AgentPicker.tsx:74"}, "properties": {"repobilityId": "48f52b8f53b8236d", "scanner": "scanner-primary", "fingerprint": "2243bd983f098219", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-c5b1a579b1bb85ed", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 packages/plugin/src/desktop/components/ArtifactPane/ArtifactHeader.tsx:40"}, "properties": {"repobilityId": "fca899af0df15940", "scanner": "scanner-primary", "fingerprint": "c5b1a579b1bb85ed", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-1264ba0fb42e0395", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 packages/plugin/src/desktop/components/ArtifactPane/renderers/AgentDraftArtifact.tsx:64"}, "properties": {"repobilityId": "b3d230fadcc895c9", "scanner": "scanner-primary", "fingerprint": "1264ba0fb42e0395", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-d1332c6d6a44d11d", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 packages/plugin/src/desktop/components/MessageItem/ArtifactRefMessage.tsx:63"}, "properties": {"repobilityId": "c36ead189871d284", "scanner": "scanner-primary", "fingerprint": "d1332c6d6a44d11d", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-8f1765092d7005b9", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 packages/plugin/src/desktop/components/MessageItem/UserMessage.tsx:36"}, "properties": {"repobilityId": "a8462dbcfa7c8ed6", "scanner": "scanner-primary", "fingerprint": "8f1765092d7005b9", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-4865c41a90fc538e", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/plugin/src/core/artifacts/types.test.ts:52"}, "properties": {"repobilityId": "82728d5728af5ead", "scanner": "scanner-primary", "fingerprint": "4865c41a90fc538e", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-ce44e6275be708b5", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/kintone-mcp/src/mcp.ts:71"}, "properties": {"repobilityId": "ce951de9488091c7", "scanner": "scanner-primary", "fingerprint": "ce44e6275be708b5", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-f7c8d91ab1dbd49b", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in packages/plugin/scripts/keygen.mjs:11"}, "properties": {"repobilityId": "a0e604206aa1d22c", "scanner": "scanner-primary", "fingerprint": "f7c8d91ab1dbd49b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/plugin/scripts/keygen.mjs"}, "region": {"startLine": 11}}}]}, {"ruleId": "scanner-47f11c863733ba82", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in packages/plugin/scripts/build.mjs:12"}, "properties": {"repobilityId": "63db730bcc5d9793", "scanner": "scanner-primary", "fingerprint": "47f11c863733ba82", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/plugin/scripts/build.mjs"}, "region": {"startLine": 12}}}]}, {"ruleId": "scanner-f9d27b4d7c935192", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in packages/plugin/scripts/upload.mjs:15"}, "properties": {"repobilityId": "7ae2bca09bff0a59", "scanner": "scanner-primary", "fingerprint": "f9d27b4d7c935192", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/plugin/scripts/upload.mjs"}, "region": {"startLine": 15}}}]}, {"ruleId": "scanner-d845402d2e1efdac", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in packages/plugin/scripts/e2e.mjs:13"}, "properties": {"repobilityId": "2b5aa84a34b2b555", "scanner": "scanner-primary", "fingerprint": "d845402d2e1efdac", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/plugin/scripts/e2e.mjs"}, "region": {"startLine": 13}}}]}, {"ruleId": "scanner-cb2f832ea00757ad", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in packages/plugin/scripts/release.mjs:17"}, "properties": {"repobilityId": "af739384bc5c9792", "scanner": "scanner-primary", "fingerprint": "cb2f832ea00757ad", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/plugin/scripts/release.mjs"}, "region": {"startLine": 17}}}]}, {"ruleId": "scanner-e4350c478a1f56e1", "level": "error", "message": {"text": "Insecure pattern 'new_function_used' in packages/plugin/src/desktop/components/ArtifactPane/renderers/ReactArtifact.tsx:79"}, "properties": {"repobilityId": "728ba75ad4c158c7", "scanner": "scanner-primary", "fingerprint": "e4350c478a1f56e1", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "new_function_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/plugin/src/desktop/components/ArtifactPane/renderers/ReactArtifact.tsx"}, "region": {"startLine": 79}}}]}, {"ruleId": "scanner-77456064e8c0ee8b", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in packages/plugin/src/desktop/components/ArtifactPane/renderers/ReactArtifact.tsx:39"}, "properties": {"repobilityId": "4a22648cc79b56a0", "scanner": "scanner-primary", "fingerprint": "77456064e8c0ee8b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/plugin/src/desktop/components/ArtifactPane/renderers/ReactArtifact.tsx"}, "region": {"startLine": 39}}}]}, {"ruleId": "scanner-8d2cceea9ad77771", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in packages/plugin/src/desktop/components/ArtifactPane/renderers/MermaidArtifact.tsx:33"}, "properties": {"repobilityId": "679a82ac80f3ca35", "scanner": "scanner-primary", "fingerprint": "8d2cceea9ad77771", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/plugin/src/desktop/components/ArtifactPane/renderers/MermaidArtifact.tsx"}, "region": {"startLine": 33}}}]}, {"ruleId": "scanner-2c06e3c051a2098e", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in packages/plugin/src/core/oauth/pkce.test.ts:66"}, "properties": {"repobilityId": "1d341731e5ba03c2", "scanner": "scanner-primary", "fingerprint": "2c06e3c051a2098e", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/plugin/src/core/oauth/pkce.test.ts"}, "region": {"startLine": 66}}}]}, {"ruleId": "scanner-866398fd43a2eae4", "level": "warning", "message": {"text": "Insecure pattern 'cors_wildcard' in packages/kintone-mcp/src/index.ts:77"}, "properties": {"repobilityId": "5474063eedd8a05d", "scanner": "scanner-primary", "fingerprint": "866398fd43a2eae4", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "cors_wildcard"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/kintone-mcp/src/index.ts"}, "region": {"startLine": 77}}}]}, {"ruleId": "scanner-0aef6f5798738d58", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "de24d102745219d9", "scanner": "scanner-primary", "fingerprint": "0aef6f5798738d58", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/build-plugin.yml"}, "region": {"startLine": 36}}}]}, {"ruleId": "scanner-0aef6f5798738d58", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "93254998bd528d5b", "scanner": "scanner-primary", "fingerprint": "0aef6f5798738d58", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/build-plugin.yml"}, "region": {"startLine": 40}}}]}, {"ruleId": "scanner-0aef6f5798738d58", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "70a215b6e288e0c7", "scanner": "scanner-primary", "fingerprint": "0aef6f5798738d58", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/build-plugin.yml"}, "region": {"startLine": 43}}}]}, {"ruleId": "scanner-0aef6f5798738d58", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "1eee079720cb7b7b", "scanner": "scanner-primary", "fingerprint": "0aef6f5798738d58", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/build-plugin.yml"}, "region": {"startLine": 107}}}]}, {"ruleId": "scanner-0aef6f5798738d58", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "c8ebaaf5a33eec55", "scanner": "scanner-primary", "fingerprint": "0aef6f5798738d58", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/build-plugin.yml"}, "region": {"startLine": 115}}}]}, {"ruleId": "scanner-dc9623e3da821384", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "c76d271433445a1d", "scanner": "scanner-primary", "fingerprint": "dc9623e3da821384", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/build-plugin.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-de53ac274e5b4ecf", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "02600186fc092bd4", "scanner": "scanner-primary", "fingerprint": "de53ac274e5b4ecf", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/claude.yml"}, "region": {"startLine": 29}}}]}, {"ruleId": "scanner-de53ac274e5b4ecf", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "8ead6a2c2bfe167b", "scanner": "scanner-primary", "fingerprint": "de53ac274e5b4ecf", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/claude.yml"}, "region": {"startLine": 35}}}]}, {"ruleId": "scanner-37716d9c0a33ad5c", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "abfb5752158cf655", "scanner": "scanner-primary", "fingerprint": "37716d9c0a33ad5c", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/claude.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a5effcd78af7645c", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "b2c9e042745aa98a", "scanner": "scanner-primary", "fingerprint": "a5effcd78af7645c", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/sync-docs.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e4f658c0c00de0d4", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "7b2f6f2d816930a2", "scanner": "scanner-primary", "fingerprint": "e4f658c0c00de0d4", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pages.yml"}, "region": {"startLine": 42}}}]}, {"ruleId": "scanner-e4f658c0c00de0d4", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "25e1fa3783e7cb32", "scanner": "scanner-primary", "fingerprint": "e4f658c0c00de0d4", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pages.yml"}, "region": {"startLine": 54}}}]}, {"ruleId": "scanner-448d8837178ae57a", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "13af6451e15656fc", "scanner": "scanner-primary", "fingerprint": "448d8837178ae57a", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pages.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b5b8b2192793f700", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "3c9689185d943c0e", "scanner": "scanner-primary", "fingerprint": "b5b8b2192793f700", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/build-helper.yml"}, "region": {"startLine": 40}}}]}, {"ruleId": "scanner-b5b8b2192793f700", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "e5148cb3431dea6d", "scanner": "scanner-primary", "fingerprint": "b5b8b2192793f700", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/build-helper.yml"}, "region": {"startLine": 43}}}]}, {"ruleId": "scanner-b5b8b2192793f700", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "3c9689185d943c0e", "scanner": "scanner-primary", "fingerprint": "b5b8b2192793f700", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/build-helper.yml"}, "region": {"startLine": 70}}}]}, {"ruleId": "scanner-b5b8b2192793f700", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "e5148cb3431dea6d", "scanner": "scanner-primary", "fingerprint": "b5b8b2192793f700", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/build-helper.yml"}, "region": {"startLine": 73}}}]}, {"ruleId": "scanner-b5b8b2192793f700", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "15c607df8629a7d0", "scanner": "scanner-primary", "fingerprint": "b5b8b2192793f700", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/build-helper.yml"}, "region": {"startLine": 84}}}]}, {"ruleId": "scanner-b5b8b2192793f700", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "bf596104eec8e767", "scanner": "scanner-primary", "fingerprint": "b5b8b2192793f700", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/build-helper.yml"}, "region": {"startLine": 92}}}]}, {"ruleId": "scanner-b5b8b2192793f700", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "ae0627e7a624405e", "scanner": "scanner-primary", "fingerprint": "b5b8b2192793f700", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/build-helper.yml"}, "region": {"startLine": 104}}}]}, {"ruleId": "scanner-b5b8b2192793f700", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "38f9d6e68d757516", "scanner": "scanner-primary", "fingerprint": "b5b8b2192793f700", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/build-helper.yml"}, "region": {"startLine": 110}}}]}, {"ruleId": "scanner-97dd6c123507d2ba", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "3cbe398b60ce2dba", "scanner": "scanner-primary", "fingerprint": "97dd6c123507d2ba", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/build-helper.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-09edb261be82fd5c", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/plugin/package.json"}, "properties": {"repobilityId": "d5c15120c2a88e4a", "scanner": "scanner-primary", "fingerprint": "09edb261be82fd5c", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/plugin/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b23ff959c3a1cfe6", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/landing/package.json"}, "properties": {"repobilityId": "f02c01bbcc4c6a5e", "scanner": "scanner-primary", "fingerprint": "b23ff959c3a1cfe6", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/landing/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-24125c5115eeee89", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/kintone-mcp/package.json"}, "properties": {"repobilityId": "e295ef8604603a4c", "scanner": "scanner-primary", "fingerprint": "24125c5115eeee89", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/kintone-mcp/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "d3446720661867a0", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "75fff2762b6edb6b", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "443d7c4bdac57632", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-749d4bc1bd66df5f", "level": "warning", "message": {"text": "Agent instructions exist but release-hardening basics are missing"}, "properties": {"repobilityId": "f181694c67f7bb2b", "scanner": "scanner-primary", "fingerprint": "749d4bc1bd66df5f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "278ec2a224085538", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "e443a4786acf53bb", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-bea357a6497a2d5d", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: CLAUDE.md"}, "properties": {"repobilityId": "aae72df3934829ac", "scanner": "scanner-primary", "fingerprint": "bea357a6497a2d5d", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "CLAUDE.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1fd979cd2888b19a", "level": "error", "message": {"text": "Agent instruction/config may expose a secret: packages/plugin/src/skills/kintone-plugin-development/SKILL.md"}, "properties": {"repobilityId": "67bc90e25ad09f05", "scanner": "scanner-primary", "fingerprint": "1fd979cd2888b19a", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["agent-instructions", "secrets", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/plugin/src/skills/kintone-plugin-development/SKILL.md"}, "region": {"startLine": 156}}}]}, {"ruleId": "scanner-84dc14bbc7fb94ea", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: packages/plugin/src/skills/kintone-plugin-development/SKILL.md"}, "properties": {"repobilityId": "e5e23ebf74e830b6", "scanner": "scanner-primary", "fingerprint": "84dc14bbc7fb94ea", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/plugin/src/skills/kintone-plugin-development/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b0056b033f483971", "level": "none", "message": {"text": "Commented-code block (5 lines) in eslint.config.js:33"}, "properties": {"repobilityId": "dcf908d28ed4400a", "scanner": "scanner-primary", "fingerprint": "b0056b033f483971", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-da0c160a1f47f2ec", "level": "none", "message": {"text": "Commented-code block (7 lines) in scripts/test-proxy-nested-body.js:4"}, "properties": {"repobilityId": "8a2b915b2401e9a7", "scanner": "scanner-primary", "fingerprint": "da0c160a1f47f2ec", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-1f6fa5d574dfac60", "level": "none", "message": {"text": "Commented-code block (8 lines) in scripts/verify-customize-rest-api.mjs:12"}, "properties": {"repobilityId": "9035f67d194ca257", "scanner": "scanner-primary", "fingerprint": "1f6fa5d574dfac60", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-9ba6f8dd3ec69d9b", "level": "none", "message": {"text": "Commented-code block (8 lines) in scripts/verify-mcp-oauth.mjs:5"}, "properties": {"repobilityId": "17cec131f9779598", "scanner": "scanner-primary", "fingerprint": "9ba6f8dd3ec69d9b", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-18057f2acad71271", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 scripts/verify-mcp-oauth.mjs:97"}, "properties": {"repobilityId": "16f336d3b0217559", "scanner": "scanner-primary", "fingerprint": "18057f2acad71271", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-7329624b73d5ed1f", "level": "none", "message": {"text": "Commented-code block (6 lines) in packages/plugin/scripts/deploy-worker.mjs:16"}, "properties": {"repobilityId": "041bc2623e8d8dd1", "scanner": "scanner-primary", "fingerprint": "7329624b73d5ed1f", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-c0f6142400700c92", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/plugin/scripts/deploy-worker.mjs:92"}, "properties": {"repobilityId": "b68a76acfedad6a8", "scanner": "scanner-primary", "fingerprint": "c0f6142400700c92", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-64fb1976346b7e5b", "level": "none", "message": {"text": "Commented-code block (5 lines) in packages/plugin/scripts/build.mjs:4"}, "properties": {"repobilityId": "b79e8d1066379949", "scanner": "scanner-primary", "fingerprint": "64fb1976346b7e5b", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-8ad2717806d26a9f", "level": "none", "message": {"text": "Commented-code block (5 lines) in packages/plugin/scripts/snapshot-handoff.mjs:4"}, "properties": {"repobilityId": "e82268dc25069500", "scanner": "scanner-primary", "fingerprint": "8ad2717806d26a9f", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-eb96a7714a08f9fb", "level": "none", "message": {"text": "Commented-code block (5 lines) in packages/plugin/scripts/snapshot-wedge.mjs:4"}, "properties": {"repobilityId": "771b281bc4aaf863", "scanner": "scanner-primary", "fingerprint": "eb96a7714a08f9fb", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-5e78a2d3642824f5", "level": "none", "message": {"text": "Commented-code block (7 lines) in packages/plugin/scripts/release.mjs:9"}, "properties": {"repobilityId": "4ddc773f5c335581", "scanner": "scanner-primary", "fingerprint": "5e78a2d3642824f5", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-faedb2a9f8df6c09", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/plugin/scripts/lib/kintone-deploy.mjs:15"}, "properties": {"repobilityId": "543ca57debf185a3", "scanner": "scanner-primary", "fingerprint": "faedb2a9f8df6c09", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-95f527eb950a4bc7", "level": "none", "message": {"text": "Commented-code block (5 lines) in packages/plugin/src/config/ConfigScreen.test.tsx:3"}, "properties": {"repobilityId": "d246434954d2d634", "scanner": "scanner-primary", "fingerprint": "95f527eb950a4bc7", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-4bf8c73be0afc200", "level": "none", "message": {"text": "Commented-code block (5 lines) in packages/plugin/src/config/ConfigScreen.tsx:3"}, "properties": {"repobilityId": "a26ec3f9ec220e6c", "scanner": "scanner-primary", "fingerprint": "4bf8c73be0afc200", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-4b7dadc16755650e", "level": "none", "message": {"text": "Commented-code block (5 lines) in packages/plugin/src/desktop/settings/SettingsViewBound.tsx:8"}, "properties": {"repobilityId": "346aa90f98b1934f", "scanner": "scanner-primary", "fingerprint": "4b7dadc16755650e", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-c6b1af6d00f86203", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/plugin/src/desktop/settings/SettingsViewBound.tsx:64"}, "properties": {"repobilityId": "2613ce5275b911a4", "scanner": "scanner-primary", "fingerprint": "c6b1af6d00f86203", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-30f1bb2adf836bc2", "level": "none", "message": {"text": "Commented-code block (6 lines) in packages/plugin/src/desktop/components/ProgressIndicator.tsx:7"}, "properties": {"repobilityId": "abd5f8d78b51c4e3", "scanner": "scanner-primary", "fingerprint": "30f1bb2adf836bc2", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-773b03706fa3e802", "level": "none", "message": {"text": "Commented-code block (5 lines) in packages/plugin/src/desktop/components/AgentIcon.tsx:3"}, "properties": {"repobilityId": "2221824c9275a17b", "scanner": "scanner-primary", "fingerprint": "773b03706fa3e802", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-5b16af54a4ca34e7", "level": "none", "message": {"text": "Commented-code block (5 lines) in packages/plugin/src/desktop/components/Composer.tsx:122"}, "properties": {"repobilityId": "272b0d8b16fc5ded", "scanner": "scanner-primary", "fingerprint": "5b16af54a4ca34e7", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-1d01cd3f31f6bd16", "level": "none", "message": {"text": "Commented-code block (6 lines) in packages/plugin/src/desktop/components/ConnectKintoneButton.tsx:3"}, "properties": {"repobilityId": "9bd386b49094d98e", "scanner": "scanner-primary", "fingerprint": "1d01cd3f31f6bd16", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-a7b226cb2f5e9854", "level": "none", "message": {"text": "Commented-code block (6 lines) in packages/plugin/src/desktop/hooks/useCustomToolResponder.ts:8"}, "properties": {"repobilityId": "00f26ccdbd7f1ab0", "scanner": "scanner-primary", "fingerprint": "a7b226cb2f5e9854", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-9c8833d3ab19288f", "level": "none", "message": {"text": "Commented-code block (5 lines) in packages/plugin/src/desktop/hooks/useFileAttacher.ts:3"}, "properties": {"repobilityId": "8ee8e0b44f73c00a", "scanner": "scanner-primary", "fingerprint": "9c8833d3ab19288f", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-5c7ce5cd4518c0e2", "level": "note", "message": {"text": "Legacy-named symbol `vcrd_old` in packages/plugin/src/desktop/hooks/useUserBinding.test.ts:209"}, "properties": {"repobilityId": "614dda0efd3d19b5", "scanner": "scanner-primary", "fingerprint": "5c7ce5cd4518c0e2", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-4ca9d07679d961bb", "level": "none", "message": {"text": "Commented-code block (6 lines) in packages/plugin/src/desktop/hooks/useEventPoller.ts:108"}, "properties": {"repobilityId": "0a71b5682c56825e", "scanner": "scanner-primary", "fingerprint": "4ca9d07679d961bb", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-fe7fe50bf8a477ba", "level": "none", "message": {"text": "Commented-code block (8 lines) in packages/plugin/src/chat/workflow/kintoneCustomizeApi.ts:6"}, "properties": {"repobilityId": "1e9d1ae23552104e", "scanner": "scanner-primary", "fingerprint": "fe7fe50bf8a477ba", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-63e7ce566e00fff0", "level": "none", "message": {"text": "Commented-code block (5 lines) in packages/plugin/src/chat/workflow/useApplyWorkflow.ts:5"}, "properties": {"repobilityId": "a87eeb1672b7cdb2", "scanner": "scanner-primary", "fingerprint": "63e7ce566e00fff0", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-83cb9d11f4188025", "level": "none", "message": {"text": "Commented-code block (6 lines) in packages/plugin/src/core/managed-agents/eventInterpreter.ts:3"}, "properties": {"repobilityId": "7275e2a7ee9c97af", "scanner": "scanner-primary", "fingerprint": "83cb9d11f4188025", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-f926f9953eaf51fa", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/plugin/src/core/managed-agents/client.ts:45"}, "properties": {"repobilityId": "cbc70dc9a49cb2cf", "scanner": "scanner-primary", "fingerprint": "f926f9953eaf51fa", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-4f40453f90e4be1f", "level": "none", "message": {"text": "Commented-code block (5 lines) in packages/plugin/src/core/managed-agents/sessionLifecycle.ts:3"}, "properties": {"repobilityId": "f8b479c29eb51242", "scanner": "scanner-primary", "fingerprint": "4f40453f90e4be1f", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-b8116f4647330016", "level": "none", "message": {"text": "Commented-code block (6 lines) in packages/plugin/src/core/kintone/users.ts:3"}, "properties": {"repobilityId": "6b30f04f91df03bf", "scanner": "scanner-primary", "fingerprint": "b8116f4647330016", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-c77ab9955c4a84de", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/plugin/src/core/kintone/users.ts:11"}, "properties": {"repobilityId": "ba9e94688e4b51e9", "scanner": "scanner-primary", "fingerprint": "c77ab9955c4a84de", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-afb62ea1308a2a6e", "level": "note", "message": {"text": "Legacy-named symbol `env_old` in packages/plugin/src/core/bootstrap/resolveEnvironment.test.ts:42"}, "properties": {"repobilityId": "3a745f6499d95c81", "scanner": "scanner-primary", "fingerprint": "afb62ea1308a2a6e", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-a215f52aec9b2d12", "level": "none", "message": {"text": "Commented-code block (6 lines) in packages/plugin/src/core/files/messageContent.ts:3"}, "properties": {"repobilityId": "16e5c513afc356ed", "scanner": "scanner-primary", "fingerprint": "a215f52aec9b2d12", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-1709d02420c4ecae", "level": "none", "message": {"text": "Commented-code block (5 lines) in packages/plugin/src/core/oauth/popup.ts:3"}, "properties": {"repobilityId": "9fb945d12b82124d", "scanner": "scanner-primary", "fingerprint": "1709d02420c4ecae", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-d3a46e6250719b4e", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/plugin/src/core/cloudflare/cfDeploy.test.ts:8"}, "properties": {"repobilityId": "7a3375533b549656", "scanner": "scanner-primary", "fingerprint": "d3a46e6250719b4e", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-fe5a1e87067c04ee", "level": "none", "message": {"text": "Commented-code block (5 lines) in packages/plugin/src/core/cloudflare/cfDeploy.ts:8"}, "properties": {"repobilityId": "668fd8ca542eb38e", "scanner": "scanner-primary", "fingerprint": "fe5a1e87067c04ee", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-b45ce7b0db5adf6f", "level": "none", "message": {"text": "Commented-code block (5 lines) in packages/plugin/src/core/deployments/view.ts:165"}, "properties": {"repobilityId": "462b01236556ed18", "scanner": "scanner-primary", "fingerprint": "b45ce7b0db5adf6f", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-ca4cd57dfd0e8cd0", "level": "none", "message": {"text": "Commented-code block (5 lines) in packages/plugin/src/core/skills/resolveBundledSkillIds.ts:7"}, "properties": {"repobilityId": "f24850c052f1592c", "scanner": "scanner-primary", "fingerprint": "ca4cd57dfd0e8cd0", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-a3824c927eaa95a7", "level": "none", "message": {"text": "Commented-code block (6 lines) in packages/plugin/src/core/skills/skillsSyncClient.ts:8"}, "properties": {"repobilityId": "7a81e2a97a554149", "scanner": "scanner-primary", "fingerprint": "a3824c927eaa95a7", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-cb031228958f589a", "level": "none", "message": {"text": "Commented-code block (7 lines) in packages/plugin/src/core/skills/resolveBundledSkillIds.test.ts:3"}, "properties": {"repobilityId": "53f579d232944b75", "scanner": "scanner-primary", "fingerprint": "cb031228958f589a", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-98c7ce06e7dc8ae1", "level": "none", "message": {"text": "Commented-code block (6 lines) in packages/plugin/e2e/css-sanity.spec.ts:3"}, "properties": {"repobilityId": "08a80e260e7e2ab3", "scanner": "scanner-primary", "fingerprint": "98c7ce06e7dc8ae1", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-e8643ba70f449efb", "level": "none", "message": {"text": "Commented-code block (6 lines) in packages/plugin/e2e/session-history.spec.ts:3"}, "properties": {"repobilityId": "35eab0e7c90713b4", "scanner": "scanner-primary", "fingerprint": "e8643ba70f449efb", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-78c49e2f93e0b199", "level": "none", "message": {"text": "Commented-code block (6 lines) in packages/plugin/e2e/panel-toggle.spec.ts:3"}, "properties": {"repobilityId": "f531df22784bf80a", "scanner": "scanner-primary", "fingerprint": "78c49e2f93e0b199", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-01b1db63c15bfd8b", "level": "none", "message": {"text": "Commented-code block (5 lines) in packages/plugin/e2e/config.spec.ts:62"}, "properties": {"repobilityId": "918202dfc9a001e2", "scanner": "scanner-primary", "fingerprint": "01b1db63c15bfd8b", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-c3e51b4894052ed0", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/plugin/e2e/config.spec.ts:30"}, "properties": {"repobilityId": "e693181ffe145339", "scanner": "scanner-primary", "fingerprint": "c3e51b4894052ed0", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-1aaf171e5c644650", "level": "none", "message": {"text": "Commented-code block (5 lines) in packages/plugin/e2e/customizer-wedge.spec.ts:3"}, "properties": {"repobilityId": "c58a46657f2ea883", "scanner": "scanner-primary", "fingerprint": "1aaf171e5c644650", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-c876dd20fb0182b1", "level": "none", "message": {"text": "Commented-code block (9 lines) in packages/plugin/e2e/credential-bind.setup.ts:3"}, "properties": {"repobilityId": "33509b93e135529f", "scanner": "scanner-primary", "fingerprint": "c876dd20fb0182b1", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-b0f20fb3b4f8068f", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/plugin/e2e/credential-bind.setup.ts:114"}, "properties": {"repobilityId": "2a2f49a6e9051705", "scanner": "scanner-primary", "fingerprint": "b0f20fb3b4f8068f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-7ccc9bc6ccbef515", "level": "none", "message": {"text": "Commented-code block (8 lines) in packages/landing/src/scripts/lp.ts:1"}, "properties": {"repobilityId": "c83bf3143729918f", "scanner": "scanner-primary", "fingerprint": "7ccc9bc6ccbef515", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-c6c5f894a091fc0d", "level": "none", "message": {"text": "Commented-code block (8 lines) in packages/kintone-mcp/tests/credentials-upsert.test.ts:3"}, "properties": {"repobilityId": "aaf55da0c1a995d5", "scanner": "scanner-primary", "fingerprint": "c6c5f894a091fc0d", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-1afd575e8b0926ca", "level": "none", "message": {"text": "Commented-code block (7 lines) in packages/kintone-mcp/tests/anthropic-passthrough.test.ts:3"}, "properties": {"repobilityId": "e205f5cdaa5257e4", "scanner": "scanner-primary", "fingerprint": "1afd575e8b0926ca", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-94fd8b21d045acb2", "level": "none", "message": {"text": "Commented-code block (6 lines) in packages/kintone-mcp/tests/mcp.test.ts:3"}, "properties": {"repobilityId": "7a2705664705e49d", "scanner": "scanner-primary", "fingerprint": "94fd8b21d045acb2", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-9e8da0e0886e76fe", "level": "none", "message": {"text": "Commented-code block (6 lines) in packages/kintone-mcp/tests/skills-sync.test.ts:3"}, "properties": {"repobilityId": "03de24965f15c45e", "scanner": "scanner-primary", "fingerprint": "9e8da0e0886e76fe", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-cfbfb284acb694ab", "level": "none", "message": {"text": "Commented-code block (8 lines) in packages/kintone-mcp/src/skills-sync.ts:10"}, "properties": {"repobilityId": "e1401c20f5c1fa59", "scanner": "scanner-primary", "fingerprint": "cfbfb284acb694ab", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-9dc9c094c17a1e0f", "level": "none", "message": {"text": "Commented-code block (7 lines) in packages/kintone-mcp/src/credentials-upsert.ts:3"}, "properties": {"repobilityId": "ed76df5b63c3a1b1", "scanner": "scanner-primary", "fingerprint": "9dc9c094c17a1e0f", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-5e94e5409edc82a1", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/kintone-mcp/src/credentials-upsert.ts:140"}, "properties": {"repobilityId": "1ea4c380cd9356a5", "scanner": "scanner-primary", "fingerprint": "5e94e5409edc82a1", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-58cfc8f6da172b9b", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/kintone-mcp/src/kintone.ts:111"}, "properties": {"repobilityId": "76e49e8c9a0e3496", "scanner": "scanner-primary", "fingerprint": "58cfc8f6da172b9b", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-d078db3fbdb43cfa", "level": "none", "message": {"text": "Commented-code block (10 lines) in packages/kintone-mcp/src/index.ts:3"}, "properties": {"repobilityId": "eb8636ec9265bc50", "scanner": "scanner-primary", "fingerprint": "d078db3fbdb43cfa", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-03190d30e4fa9bf9", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/kintone-mcp/src/index.ts:27"}, "properties": {"repobilityId": "8e5001edf607e97c", "scanner": "scanner-primary", "fingerprint": "03190d30e4fa9bf9", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-cb12bb00703299c5", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/kintone-mcp/src/anthropic-passthrough.ts:68"}, "properties": {"repobilityId": "5f8d2630b0d5ddb8", "scanner": "scanner-primary", "fingerprint": "cb12bb00703299c5", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-ad1f2c0971b89ce0", "level": "note", "message": {"text": "10 env vars used in code but missing from .env.example"}, "properties": {"repobilityId": "3bfdc60c61f1870e", "scanner": "scanner-primary", "fingerprint": "ad1f2c0971b89ce0", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "config-drift"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "4c07cf7020eb41d4", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}]}]}