{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-bead75b0f9233e05", "name": "No API endpoints detected", "shortDescription": {"text": "No API endpoints detected"}, "fullDescription": {"text": "The scanner did not find FastAPI/Flask/Express/NestJS/GraphQL/gRPC routes. If this repo exposes APIs, the framework may be unsupported."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "info", "confidence": 1.0}}, {"id": "scanner-d4bb2791548d6ea4", "name": "Stray `console.log` in TS/JS \u2014 packages/cli/src/main.ts:139", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/cli/src/main.ts:139"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-be5e20ec08f77ff0", "name": "Stray `console.log` in TS/JS \u2014 packages/cli/src/cli/resume.ts:79", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/cli/src/cli/resume.ts:79"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-793dea98ec340c37", "name": "Stray `console.log` in TS/JS \u2014 packages/cli/src/cli/onboarding.ts:81", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/cli/src/cli/onboarding.ts:81"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cd4b6ade501c9ee2", "name": "Stray `console.log` in TS/JS \u2014 packages/cli/src/cli/args.ts:219", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/cli/src/cli/args.ts:219"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-11e532a09ff3d651", "name": "Stray `console.log` in TS/JS \u2014 packages/cli/src/cli/external-editor.ts:123", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/cli/src/cli/external-editor.ts:123"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0086cc16684a864c", "name": "Stray `console.log` in TS/JS \u2014 packages/cli/src/cli/model-picker.ts:82", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/cli/src/cli/model-picker.ts:82"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8ed2d73b59aa236b", "name": "Stray `console.log` in TS/JS \u2014 packages/cli/src/cli/github-prompt.ts:114", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/cli/src/cli/github-prompt.ts:114"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b144f7e27a239cda", "name": "Stray `console.log` in TS/JS \u2014 packages/cli/src/cli/connect-prompt.ts:56", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/cli/src/cli/connect-prompt.ts:56"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-964599ac4231e483", "name": "Stray `console.log` in TS/JS \u2014 packages/cli/src/cli/goal-config-prompt.ts:25", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/cli/src/cli/goal-config-prompt.ts:25"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a7745d1360ee414f", "name": "Stray `console.log` in TS/JS \u2014 packages/cli/src/cli/heartbeat-prompt.ts:68", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/cli/src/cli/heartbeat-prompt.ts:68"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-984bdb6a3f03111a", "name": "Stray `console.log` in TS/JS \u2014 packages/cli/src/modes/upgrade-mode.ts:142", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/cli/src/modes/upgrade-mode.ts:142"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-176b9f9a0b33c760", "name": "Stray `console.log` in TS/JS \u2014 packages/cli/src/modes/mcp-mode.ts:87", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/cli/src/modes/mcp-mode.ts:87"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d77cc46dbbf3c6dc", "name": "Stray `console.log` in TS/JS \u2014 packages/cli/src/modes/status-mode.ts:150", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/cli/src/modes/status-mode.ts:150"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-53e1d6fb52214ac4", "name": "Stray `console.log` in TS/JS \u2014 packages/cli/src/modes/runner-mode.ts:46", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/cli/src/modes/runner-mode.ts:46"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1436a3da40392d83", "name": "Stray `console.log` in TS/JS \u2014 packages/cli/src/modes/interactive/goal-command.ts:41", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/cli/src/modes/interactive/goal-command.ts:41"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-59d4e80ccd092c9b", "name": "Stray `console.log` in TS/JS \u2014 packages/cli/src/modes/interactive/interactive-mode.ts:106", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/cli/src/modes/interactive/interactive-mode.ts:106"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9ad636aa7f9c1283", "name": "Stray `console.log` in TS/JS \u2014 packages/cli/src/modes/interactive/mcp-panel.ts:34", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/cli/src/modes/interactive/mcp-panel.ts:34"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1d4500c08ac1366d", "name": "Insecure pattern 'node_child_process' in packages/cli/src/cli/external-editor.ts:1", "shortDescription": {"text": "Insecure pattern 'node_child_process' in packages/cli/src/cli/external-editor.ts:1"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8868439075ded39a", "name": "Insecure pattern 'node_child_process' in packages/cli/src/cli/clipboard.ts:1", "shortDescription": {"text": "Insecure pattern 'node_child_process' in packages/cli/src/cli/clipboard.ts:1"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b32cb8530b805b19", "name": "Insecure pattern 'node_child_process' in packages/cli/src/cli/file-search.ts:1", "shortDescription": {"text": "Insecure pattern 'node_child_process' in packages/cli/src/cli/file-search.ts:1"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f56a26b69ff5bc4a", "name": "Insecure pattern 'node_child_process' in packages/cli/src/modes/upgrade-mode.ts:11", "shortDescription": {"text": "Insecure pattern 'node_child_process' in packages/cli/src/modes/upgrade-mode.ts:11"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a075b8680a92e055", "name": "Insecure pattern 'node_child_process' in packages/cli/src/modes/status-mode.ts:17", "shortDescription": {"text": "Insecure pattern 'node_child_process' in packages/cli/src/modes/status-mode.ts:17"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-585542d3cc767b18", "name": "Insecure pattern 'node_child_process' in packages/cli/src/modes/runner-mode.ts:8", "shortDescription": {"text": "Insecure pattern 'node_child_process' in packages/cli/src/modes/runner-mode.ts:8"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-97405f3d6ab647ae", "name": "Insecure pattern 'node_child_process' in packages/cli/src/modes/interactive/render.ts:1", "shortDescription": {"text": "Insecure pattern 'node_child_process' in packages/cli/src/modes/interactive/render.ts:1"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-08956eb439be9dde", "name": "Insecure pattern 'node_child_process' in packages/core/skills/browser-verify/scripts/profile-lock.mjs:2", "shortDescription": {"text": "Insecure pattern 'node_child_process' in packages/core/skills/browser-verify/scripts/profile-lock.mjs:2"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d5bee8fa109d69e6", "name": "Insecure pattern 'node_child_process' in packages/core/skills/browser-verify/scripts/detect-browser.mjs:2", "shortDescription": {"text": "Insecure pattern 'node_child_process' in packages/core/skills/browser-verify/scripts/detect-browser.mjs:2"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a350f8d663d43aef", "name": "Insecure pattern 'node_child_process' in packages/core/skills/browser-verify/scripts/prepare.mjs:2", "shortDescription": {"text": "Insecure pattern 'node_child_process' in packages/core/skills/browser-verify/scripts/prepare.mjs:2"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3faff46a9ab00c87", "name": "Insecure pattern 'node_child_process' in packages/core/skills/browser-verify/scripts/capture-lib.mjs:3", "shortDescription": {"text": "Insecure pattern 'node_child_process' in packages/core/skills/browser-verify/scripts/capture-lib.mjs:3"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-77f218d25c274b1e", "name": "Insecure pattern 'node_child_process' in packages/core/src/heartbeat.ts:11", "shortDescription": {"text": "Insecure pattern 'node_child_process' in packages/core/src/heartbeat.ts:11"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-74cb77ac69115de6", "name": "Insecure pattern 'node_child_process' in packages/core/src/coding-agent-runner.ts:10", "shortDescription": {"text": "Insecure pattern 'node_child_process' in packages/core/src/coding-agent-runner.ts:10"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-58868bda5ae58143", "name": "Insecure pattern 'node_child_process' in packages/core/src/command-executor.ts:1", "shortDescription": {"text": "Insecure pattern 'node_child_process' in packages/core/src/command-executor.ts:1"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7b8b3e029c99d3d8", "name": "Insecure pattern 'node_child_process' in packages/core/src/github-connection.ts:8", "shortDescription": {"text": "Insecure pattern 'node_child_process' in packages/core/src/github-connection.ts:8"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4124161c05643b18", "name": "Insecure pattern 'node_child_process' in packages/core/src/self-hosted-runner.ts:11", "shortDescription": {"text": "Insecure pattern 'node_child_process' in packages/core/src/self-hosted-runner.ts:11"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-bb08dffb7af743bb", "name": "Insecure pattern 'node_child_process' in packages/core/src/worktree.ts:23", "shortDescription": {"text": "Insecure pattern 'node_child_process' in packages/core/src/worktree.ts:23"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-08e1ee8780e5c1ad", "name": "Insecure pattern 'node_child_process' in packages/core/src/git-branch.ts:1", "shortDescription": {"text": "Insecure pattern 'node_child_process' in packages/core/src/git-branch.ts:1"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1838a141491ce38c", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-85773234675f17f2", "name": "Very large file: packages/cli/src/cli/github-prompt.ts (2256 lines)", "shortDescription": {"text": "Very large file: packages/cli/src/cli/github-prompt.ts (2256 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0d1d067b0ef70167", "name": "Very large file: packages/cli/src/modes/interactive/interactive-mode.ts (1489 lines)", "shortDescription": {"text": "Very large file: packages/cli/src/modes/interactive/interactive-mode.ts (1489 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8c2e3196a4ef0cdd", "name": "Node manifest has dependencies but no lockfile: packages/cli/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/cli/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-28e92806c0db3cd2", "name": "Node manifest has dependencies but no lockfile: packages/core/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/core/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-307605aaa64be6c0", "name": "Node manifest has dependencies but no lockfile: packages/core/skills/browser-verify/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/core/skills/browser-verify/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 560 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-749d4bc1bd66df5f", "name": "Agent instructions exist but release-hardening basics are missing", "shortDescription": {"text": "Agent instructions exist but release-hardening basics are missing"}, "fullDescription": {"text": "AI-coder instruction files were found, but the repo is missing lockfile. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-b34a3aee7e2206d9", "name": "Agent authority lacks a verifier contract: packages/core/skills/review/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: packages/core/skills/review/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-205782dd21189b56", "name": "Commented-code block (8 lines) in packages/cli/tsup.config.ts:3", "shortDescription": {"text": "Commented-code block (8 lines) in packages/cli/tsup.config.ts:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-702d833a05689f25", "name": "Commented-code block (5 lines) in packages/cli/src/cli/github-prompt.ts:685", "shortDescription": {"text": "Commented-code block (5 lines) in packages/cli/src/cli/github-prompt.ts:685"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-74054033cba9e092", "name": "Commented-code block (5 lines) in packages/cli/src/cli/input.ts:155", "shortDescription": {"text": "Commented-code block (5 lines) in packages/cli/src/cli/input.ts:155"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-3a09ca00b943ab59", "name": "Commented-code block (5 lines) in packages/cli/src/modes/interactive/interactive-mode.ts:719", "shortDescription": {"text": "Commented-code block (5 lines) in packages/cli/src/modes/interactive/interactive-mode.ts:719"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-7e8fef0be362a29f", "name": "Commented-code block (5 lines) in packages/cli/src/modes/interactive/render.ts:7", "shortDescription": {"text": "Commented-code block (5 lines) in packages/cli/src/modes/interactive/render.ts:7"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-a7ab25a534b38857", "name": "Commented-code block (5 lines) in packages/cli/src/modes/interactive/markdown-stream.ts:34", "shortDescription": {"text": "Commented-code block (5 lines) in packages/cli/src/modes/interactive/markdown-stream.ts:34"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-fcecc772558393dd", "name": "Commented-code block (5 lines) in packages/core/tests/install-bundled-skills.test.ts:25", "shortDescription": {"text": "Commented-code block (5 lines) in packages/core/tests/install-bundled-skills.test.ts:25"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-6ddcbb010ce81f11", "name": "Commented-code block (5 lines) in packages/core/tests/workflow-generator.test.ts:345", "shortDescription": {"text": "Commented-code block (5 lines) in packages/core/tests/workflow-generator.test.ts:345"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-aeef82a01aae5a28", "name": "Commented-code block (5 lines) in packages/core/tests/code-analysis-pipeline.test.ts:186", "shortDescription": {"text": "Commented-code block (5 lines) in packages/core/tests/code-analysis-pipeline.test.ts:186"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-76b755110e91ee93", "name": "Commented-code block (7 lines) in packages/core/tests/coding-agent-runner.test.ts:216", "shortDescription": {"text": "Commented-code block (7 lines) in packages/core/tests/coding-agent-runner.test.ts:216"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-5cf74638f2a03f7c", "name": "Commented-code block (6 lines) in packages/core/tests/tagger-workflow.test.ts:37", "shortDescription": {"text": "Commented-code block (6 lines) in packages/core/tests/tagger-workflow.test.ts:37"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-5eb1d0065cd20560", "name": "Commented-code block (5 lines) in packages/core/skills/browser-verify/scripts/capture-lib.mjs:182", "shortDescription": {"text": "Commented-code block (5 lines) in packages/core/skills/browser-verify/scripts/capture-lib.mjs:182"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-4cac5e252c9a222c", "name": "Commented-code block (6 lines) in packages/core/skills/browser-verify/templates/verify.template.mjs:54", "shortDescription": {"text": "Commented-code block (6 lines) in packages/core/skills/browser-verify/templates/verify.template.mjs:54"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-126c6eedb86ef0d7", "name": "Commented-code block (6 lines) in packages/core/src/compaction.ts:17", "shortDescription": {"text": "Commented-code block (6 lines) in packages/core/src/compaction.ts:17"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-f7cb62a9a45a0a20", "name": "Commented-code block (5 lines) in packages/core/src/seed.ts:9", "shortDescription": {"text": "Commented-code block (5 lines) in packages/core/src/seed.ts:9"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-dc8def9222636da6", "name": "Commented-code block (5 lines) in packages/core/src/coding-agent-runner.ts:186", "shortDescription": {"text": "Commented-code block (5 lines) in packages/core/src/coding-agent-runner.ts:186"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-74bec88b8f43a5c4", "name": "Commented-code block (5 lines) in packages/core/src/sdk.ts:179", "shortDescription": {"text": "Commented-code block (5 lines) in packages/core/src/sdk.ts:179"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-4833a3e3651cbe9d", "name": "Commented-code block (5 lines) in packages/core/src/tagger-workflow.ts:51", "shortDescription": {"text": "Commented-code block (5 lines) in packages/core/src/tagger-workflow.ts:51"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-183506a6082452f3", "name": "`fetch()` without try/.catch or AbortSignal \u2014 packages/core/src/ollama.ts:49", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/core/src/ollama.ts:49"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5fd753b746e56fcd", "name": "Commented-code block (5 lines) in packages/core/src/agent-session.ts:63", "shortDescription": {"text": "Commented-code block (5 lines) in packages/core/src/agent-session.ts:63"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-607b9e79810bf7ad", "name": "`fetch()` without try/.catch or AbortSignal \u2014 packages/core/src/cloud/client.ts:115", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/core/src/cloud/client.ts:115"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9fdb729d8c653662", "name": "Commented-code block (9 lines) in packages/core/src/code-analysis/stages/project-skills.ts:96", "shortDescription": {"text": "Commented-code block (9 lines) in packages/core/src/code-analysis/stages/project-skills.ts:96"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/17609"}, "properties": {"repository": "QualityUnit/harnext", "repoUrl": "https://github.com/QualityUnit/harnext", "branch": "main"}, "results": [{"ruleId": "scanner-bead75b0f9233e05", "level": "none", "message": {"text": "No API endpoints detected"}, "properties": {"repobilityId": "0f8bb852027c38f8", "scanner": "scanner-primary", "fingerprint": "bead75b0f9233e05", "layer": "api", "severity": "info", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-d4bb2791548d6ea4", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/cli/src/main.ts:139"}, "properties": {"repobilityId": "25e8f5f6ad6b428c", "scanner": "scanner-primary", "fingerprint": "d4bb2791548d6ea4", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-be5e20ec08f77ff0", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/cli/src/cli/resume.ts:79"}, "properties": {"repobilityId": "86c5ce75b257eefc", "scanner": "scanner-primary", "fingerprint": "be5e20ec08f77ff0", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-793dea98ec340c37", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/cli/src/cli/onboarding.ts:81"}, "properties": {"repobilityId": "6c09a3f93abc65f9", "scanner": "scanner-primary", "fingerprint": "793dea98ec340c37", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-cd4b6ade501c9ee2", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/cli/src/cli/args.ts:219"}, "properties": {"repobilityId": "0a3a509c134fb8e0", "scanner": "scanner-primary", "fingerprint": "cd4b6ade501c9ee2", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-11e532a09ff3d651", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/cli/src/cli/external-editor.ts:123"}, "properties": {"repobilityId": "0198cb27903b0181", "scanner": "scanner-primary", "fingerprint": "11e532a09ff3d651", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-0086cc16684a864c", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/cli/src/cli/model-picker.ts:82"}, "properties": {"repobilityId": "21c67d515722f980", "scanner": "scanner-primary", "fingerprint": "0086cc16684a864c", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-8ed2d73b59aa236b", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/cli/src/cli/github-prompt.ts:114"}, "properties": {"repobilityId": "11f7e73665065275", "scanner": "scanner-primary", "fingerprint": "8ed2d73b59aa236b", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-b144f7e27a239cda", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/cli/src/cli/connect-prompt.ts:56"}, "properties": {"repobilityId": "9405191af9706c94", "scanner": "scanner-primary", "fingerprint": "b144f7e27a239cda", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-964599ac4231e483", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/cli/src/cli/goal-config-prompt.ts:25"}, "properties": {"repobilityId": "e198f31bc14c13dd", "scanner": "scanner-primary", "fingerprint": "964599ac4231e483", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-a7745d1360ee414f", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/cli/src/cli/heartbeat-prompt.ts:68"}, "properties": {"repobilityId": "4964cdedc8126e3a", "scanner": "scanner-primary", "fingerprint": "a7745d1360ee414f", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-984bdb6a3f03111a", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/cli/src/modes/upgrade-mode.ts:142"}, "properties": {"repobilityId": "c86074f912a8a14f", "scanner": "scanner-primary", "fingerprint": "984bdb6a3f03111a", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-176b9f9a0b33c760", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/cli/src/modes/mcp-mode.ts:87"}, "properties": {"repobilityId": "c30dfe126429e27c", "scanner": "scanner-primary", "fingerprint": "176b9f9a0b33c760", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-d77cc46dbbf3c6dc", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/cli/src/modes/status-mode.ts:150"}, "properties": {"repobilityId": "641ddb8372fc151e", "scanner": "scanner-primary", "fingerprint": "d77cc46dbbf3c6dc", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-53e1d6fb52214ac4", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/cli/src/modes/runner-mode.ts:46"}, "properties": {"repobilityId": "e7daae8a57970119", "scanner": "scanner-primary", "fingerprint": "53e1d6fb52214ac4", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-1436a3da40392d83", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/cli/src/modes/interactive/goal-command.ts:41"}, "properties": {"repobilityId": "fdb5dfcb502df35e", "scanner": "scanner-primary", "fingerprint": "1436a3da40392d83", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-59d4e80ccd092c9b", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/cli/src/modes/interactive/interactive-mode.ts:106"}, "properties": {"repobilityId": "a675ef9bf4374138", "scanner": "scanner-primary", "fingerprint": "59d4e80ccd092c9b", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-9ad636aa7f9c1283", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/cli/src/modes/interactive/mcp-panel.ts:34"}, "properties": {"repobilityId": "76ae1e3e5b767bf5", "scanner": "scanner-primary", "fingerprint": "9ad636aa7f9c1283", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-1d4500c08ac1366d", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in packages/cli/src/cli/external-editor.ts:1"}, "properties": {"repobilityId": "24b47b1af4c83a7c", "scanner": "scanner-primary", "fingerprint": "1d4500c08ac1366d", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/cli/src/cli/external-editor.ts"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8868439075ded39a", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in packages/cli/src/cli/clipboard.ts:1"}, "properties": {"repobilityId": "ab29dc50ed2210d1", "scanner": "scanner-primary", "fingerprint": "8868439075ded39a", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/cli/src/cli/clipboard.ts"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b32cb8530b805b19", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in packages/cli/src/cli/file-search.ts:1"}, "properties": {"repobilityId": "04b143cb882b453f", "scanner": "scanner-primary", "fingerprint": "b32cb8530b805b19", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/cli/src/cli/file-search.ts"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f56a26b69ff5bc4a", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in packages/cli/src/modes/upgrade-mode.ts:11"}, "properties": {"repobilityId": "81b844bd94ba0e97", "scanner": "scanner-primary", "fingerprint": "f56a26b69ff5bc4a", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/cli/src/modes/upgrade-mode.ts"}, "region": {"startLine": 11}}}]}, {"ruleId": "scanner-a075b8680a92e055", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in packages/cli/src/modes/status-mode.ts:17"}, "properties": {"repobilityId": "017bc184816f58ac", "scanner": "scanner-primary", "fingerprint": "a075b8680a92e055", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/cli/src/modes/status-mode.ts"}, "region": {"startLine": 17}}}]}, {"ruleId": "scanner-585542d3cc767b18", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in packages/cli/src/modes/runner-mode.ts:8"}, "properties": {"repobilityId": "1a64327379578bfe", "scanner": "scanner-primary", "fingerprint": "585542d3cc767b18", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/cli/src/modes/runner-mode.ts"}, "region": {"startLine": 8}}}]}, {"ruleId": "scanner-97405f3d6ab647ae", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in packages/cli/src/modes/interactive/render.ts:1"}, "properties": {"repobilityId": "7456e70c650de314", "scanner": "scanner-primary", "fingerprint": "97405f3d6ab647ae", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/cli/src/modes/interactive/render.ts"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-08956eb439be9dde", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in packages/core/skills/browser-verify/scripts/profile-lock.mjs:2"}, "properties": {"repobilityId": "2ec0c0269a034543", "scanner": "scanner-primary", "fingerprint": "08956eb439be9dde", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/core/skills/browser-verify/scripts/profile-lock.mjs"}, "region": {"startLine": 2}}}]}, {"ruleId": "scanner-d5bee8fa109d69e6", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in packages/core/skills/browser-verify/scripts/detect-browser.mjs:2"}, "properties": {"repobilityId": "23ce17b244b1039c", "scanner": "scanner-primary", "fingerprint": "d5bee8fa109d69e6", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/core/skills/browser-verify/scripts/detect-browser.mjs"}, "region": {"startLine": 2}}}]}, {"ruleId": "scanner-a350f8d663d43aef", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in packages/core/skills/browser-verify/scripts/prepare.mjs:2"}, "properties": {"repobilityId": "aa94d8fe151fa184", "scanner": "scanner-primary", "fingerprint": "a350f8d663d43aef", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/core/skills/browser-verify/scripts/prepare.mjs"}, "region": {"startLine": 2}}}]}, {"ruleId": "scanner-3faff46a9ab00c87", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in packages/core/skills/browser-verify/scripts/capture-lib.mjs:3"}, "properties": {"repobilityId": "e0a483c2f7e77f63", "scanner": "scanner-primary", "fingerprint": "3faff46a9ab00c87", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/core/skills/browser-verify/scripts/capture-lib.mjs"}, "region": {"startLine": 3}}}]}, {"ruleId": "scanner-77f218d25c274b1e", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in packages/core/src/heartbeat.ts:11"}, "properties": {"repobilityId": "04d51ca6d3956989", "scanner": "scanner-primary", "fingerprint": "77f218d25c274b1e", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/core/src/heartbeat.ts"}, "region": {"startLine": 11}}}]}, {"ruleId": "scanner-74cb77ac69115de6", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in packages/core/src/coding-agent-runner.ts:10"}, "properties": {"repobilityId": "c3a5745c4ec8a0a3", "scanner": "scanner-primary", "fingerprint": "74cb77ac69115de6", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/core/src/coding-agent-runner.ts"}, "region": {"startLine": 10}}}]}, {"ruleId": "scanner-58868bda5ae58143", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in packages/core/src/command-executor.ts:1"}, "properties": {"repobilityId": "7e6bf96bb6daa0fe", "scanner": "scanner-primary", "fingerprint": "58868bda5ae58143", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/core/src/command-executor.ts"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7b8b3e029c99d3d8", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in packages/core/src/github-connection.ts:8"}, "properties": {"repobilityId": "fd30503857a68af6", "scanner": "scanner-primary", "fingerprint": "7b8b3e029c99d3d8", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/core/src/github-connection.ts"}, "region": {"startLine": 8}}}]}, {"ruleId": "scanner-4124161c05643b18", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in packages/core/src/self-hosted-runner.ts:11"}, "properties": {"repobilityId": "8428d1623d5372f2", "scanner": "scanner-primary", "fingerprint": "4124161c05643b18", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/core/src/self-hosted-runner.ts"}, "region": {"startLine": 11}}}]}, {"ruleId": "scanner-bb08dffb7af743bb", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in packages/core/src/worktree.ts:23"}, "properties": {"repobilityId": "382fd9f54f3d849c", "scanner": "scanner-primary", "fingerprint": "bb08dffb7af743bb", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/core/src/worktree.ts"}, "region": {"startLine": 23}}}]}, {"ruleId": "scanner-08e1ee8780e5c1ad", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in packages/core/src/git-branch.ts:1"}, "properties": {"repobilityId": "3a981f4729ad2ef4", "scanner": "scanner-primary", "fingerprint": "08e1ee8780e5c1ad", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/core/src/git-branch.ts"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1838a141491ce38c", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "b8fd4f5048f96576", "scanner": "scanner-primary", "fingerprint": "1838a141491ce38c", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-85773234675f17f2", "level": "note", "message": {"text": "Very large file: packages/cli/src/cli/github-prompt.ts (2256 lines)"}, "properties": {"repobilityId": "0a41087770dd9b1a", "scanner": "scanner-primary", "fingerprint": "85773234675f17f2", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-0d1d067b0ef70167", "level": "note", "message": {"text": "Very large file: packages/cli/src/modes/interactive/interactive-mode.ts (1489 lines)"}, "properties": {"repobilityId": "9cfdafb51dd089bc", "scanner": "scanner-primary", "fingerprint": "0d1d067b0ef70167", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-8c2e3196a4ef0cdd", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/cli/package.json"}, "properties": {"repobilityId": "2faf23490612d7a6", "scanner": "scanner-primary", "fingerprint": "8c2e3196a4ef0cdd", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/cli/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-28e92806c0db3cd2", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/core/package.json"}, "properties": {"repobilityId": "8640e46be7e3f9b2", "scanner": "scanner-primary", "fingerprint": "28e92806c0db3cd2", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/core/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-307605aaa64be6c0", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/core/skills/browser-verify/package.json"}, "properties": {"repobilityId": "74e471e7fe008cc5", "scanner": "scanner-primary", "fingerprint": "307605aaa64be6c0", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/core/skills/browser-verify/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "7b8b36d858eb0272", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "80a199d2c8c0e0f5", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-749d4bc1bd66df5f", "level": "warning", "message": {"text": "Agent instructions exist but release-hardening basics are missing"}, "properties": {"repobilityId": "66efc0711d481634", "scanner": "scanner-primary", "fingerprint": "749d4bc1bd66df5f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "33b1a860eae8dabf", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "db567d21bea99bc7", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-b34a3aee7e2206d9", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: packages/core/skills/review/SKILL.md"}, "properties": {"repobilityId": "09cd2f37fb176366", "scanner": "scanner-primary", "fingerprint": "b34a3aee7e2206d9", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/core/skills/review/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-205782dd21189b56", "level": "none", "message": {"text": "Commented-code block (8 lines) in packages/cli/tsup.config.ts:3"}, "properties": {"repobilityId": "951bb33c62da71f6", "scanner": "scanner-primary", "fingerprint": "205782dd21189b56", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-702d833a05689f25", "level": "none", "message": {"text": "Commented-code block (5 lines) in packages/cli/src/cli/github-prompt.ts:685"}, "properties": {"repobilityId": "dca3d85381454880", "scanner": "scanner-primary", "fingerprint": "702d833a05689f25", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-74054033cba9e092", "level": "none", "message": {"text": "Commented-code block (5 lines) in packages/cli/src/cli/input.ts:155"}, "properties": {"repobilityId": "87c1b566f0250f47", "scanner": "scanner-primary", "fingerprint": "74054033cba9e092", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-3a09ca00b943ab59", "level": "none", "message": {"text": "Commented-code block (5 lines) in packages/cli/src/modes/interactive/interactive-mode.ts:719"}, "properties": {"repobilityId": "463d8a81eac3d6f9", "scanner": "scanner-primary", "fingerprint": "3a09ca00b943ab59", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-7e8fef0be362a29f", "level": "none", "message": {"text": "Commented-code block (5 lines) in packages/cli/src/modes/interactive/render.ts:7"}, "properties": {"repobilityId": "71d7de97fc364b65", "scanner": "scanner-primary", "fingerprint": "7e8fef0be362a29f", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-a7ab25a534b38857", "level": "none", "message": {"text": "Commented-code block (5 lines) in packages/cli/src/modes/interactive/markdown-stream.ts:34"}, "properties": {"repobilityId": "8d068f7d823aefa0", "scanner": "scanner-primary", "fingerprint": "a7ab25a534b38857", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-fcecc772558393dd", "level": "none", "message": {"text": "Commented-code block (5 lines) in packages/core/tests/install-bundled-skills.test.ts:25"}, "properties": {"repobilityId": "9373b0a8f9162e34", "scanner": "scanner-primary", "fingerprint": "fcecc772558393dd", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-6ddcbb010ce81f11", "level": "none", "message": {"text": "Commented-code block (5 lines) in packages/core/tests/workflow-generator.test.ts:345"}, "properties": {"repobilityId": "336f5f00ba228388", "scanner": "scanner-primary", "fingerprint": "6ddcbb010ce81f11", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-aeef82a01aae5a28", "level": "none", "message": {"text": "Commented-code block (5 lines) in packages/core/tests/code-analysis-pipeline.test.ts:186"}, "properties": {"repobilityId": "cea63433cc84dd4a", "scanner": "scanner-primary", "fingerprint": "aeef82a01aae5a28", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-76b755110e91ee93", "level": "none", "message": {"text": "Commented-code block (7 lines) in packages/core/tests/coding-agent-runner.test.ts:216"}, "properties": {"repobilityId": "467b9f341becf121", "scanner": "scanner-primary", "fingerprint": "76b755110e91ee93", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-5cf74638f2a03f7c", "level": "none", "message": {"text": "Commented-code block (6 lines) in packages/core/tests/tagger-workflow.test.ts:37"}, "properties": {"repobilityId": "0d332e73cf0b9533", "scanner": "scanner-primary", "fingerprint": "5cf74638f2a03f7c", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-5eb1d0065cd20560", "level": "none", "message": {"text": "Commented-code block (5 lines) in packages/core/skills/browser-verify/scripts/capture-lib.mjs:182"}, "properties": {"repobilityId": "f241bc5ebe7a03e5", "scanner": "scanner-primary", "fingerprint": "5eb1d0065cd20560", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-4cac5e252c9a222c", "level": "none", "message": {"text": "Commented-code block (6 lines) in packages/core/skills/browser-verify/templates/verify.template.mjs:54"}, "properties": {"repobilityId": "ee3678c8ed751c1c", "scanner": "scanner-primary", "fingerprint": "4cac5e252c9a222c", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-126c6eedb86ef0d7", "level": "none", "message": {"text": "Commented-code block (6 lines) in packages/core/src/compaction.ts:17"}, "properties": {"repobilityId": "adefeb807504ef50", "scanner": "scanner-primary", "fingerprint": "126c6eedb86ef0d7", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-f7cb62a9a45a0a20", "level": "none", "message": {"text": "Commented-code block (5 lines) in packages/core/src/seed.ts:9"}, "properties": {"repobilityId": "ed83413b1fa25116", "scanner": "scanner-primary", "fingerprint": "f7cb62a9a45a0a20", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-dc8def9222636da6", "level": "none", "message": {"text": "Commented-code block (5 lines) in packages/core/src/coding-agent-runner.ts:186"}, "properties": {"repobilityId": "03d09831405f4a9f", "scanner": "scanner-primary", "fingerprint": "dc8def9222636da6", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-74bec88b8f43a5c4", "level": "none", "message": {"text": "Commented-code block (5 lines) in packages/core/src/sdk.ts:179"}, "properties": {"repobilityId": "f6e32216338bb087", "scanner": "scanner-primary", "fingerprint": "74bec88b8f43a5c4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-4833a3e3651cbe9d", "level": "none", "message": {"text": "Commented-code block (5 lines) in packages/core/src/tagger-workflow.ts:51"}, "properties": {"repobilityId": "686d264357042bf5", "scanner": "scanner-primary", "fingerprint": "4833a3e3651cbe9d", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-183506a6082452f3", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/core/src/ollama.ts:49"}, "properties": {"repobilityId": "671eea107524b24c", "scanner": "scanner-primary", "fingerprint": "183506a6082452f3", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-5fd753b746e56fcd", "level": "none", "message": {"text": "Commented-code block (5 lines) in packages/core/src/agent-session.ts:63"}, "properties": {"repobilityId": "31b5a55ad988a707", "scanner": "scanner-primary", "fingerprint": "5fd753b746e56fcd", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-607b9e79810bf7ad", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/core/src/cloud/client.ts:115"}, "properties": {"repobilityId": "78f4239def8a2237", "scanner": "scanner-primary", "fingerprint": "607b9e79810bf7ad", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-9fdb729d8c653662", "level": "none", "message": {"text": "Commented-code block (9 lines) in packages/core/src/code-analysis/stages/project-skills.ts:96"}, "properties": {"repobilityId": "8fb9d1c4505db63d", "scanner": "scanner-primary", "fingerprint": "9fdb729d8c653662", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}]}]}