{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-362650bc975d3394", "name": "Possibly dead Python function: gen_nginx_access", "shortDescription": {"text": "Possibly dead Python function: gen_nginx_access"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-be532215f695434a", "name": "Possibly dead Python function: gen_nginx_error", "shortDescription": {"text": "Possibly dead Python function: gen_nginx_error"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-21c71afe46d24dc3", "name": "Possibly dead Python function: gen_audit", "shortDescription": {"text": "Possibly dead Python function: gen_audit"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ab4fa0564f4eeb40", "name": "Possibly dead Python function: gen_syslog", "shortDescription": {"text": "Possibly dead Python function: gen_syslog"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-73911ed1855451b2", "name": "Possibly dead Python function: gen_secure", "shortDescription": {"text": "Possibly dead Python function: gen_secure"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7eb8855f50ecc9ec", "name": "Possibly dead Python function: gen_portal_json", "shortDescription": {"text": "Possibly dead Python function: gen_portal_json"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0a5fa145882b62a6", "name": "Possibly dead Python function: gen_pip_log", "shortDescription": {"text": "Possibly dead Python function: gen_pip_log"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7ed50ee93caab1b9", "name": "Possibly dead Python function: gen_mysql_binlog", "shortDescription": {"text": "Possibly dead Python function: gen_mysql_binlog"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-11543efb11d8cabd", "name": "Possibly dead Python function: gen_utmp", "shortDescription": {"text": "Possibly dead Python function: gen_utmp"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-299d1dc34cda5fdf", "name": "Possibly dead Python function: gen_dnf_cache", "shortDescription": {"text": "Possibly dead Python function: gen_dnf_cache"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-774ce5b6680d9b06", "name": "Possibly dead Python function: auto_deny", "shortDescription": {"text": "Possibly dead Python function: auto_deny"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-764d4b8be31920e1", "name": "Possibly dead Python function: noop_progress", "shortDescription": {"text": "Possibly dead Python function: noop_progress"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7e44a74e925e2c14", "name": "Possibly dead Python function: auto_cancel_choice", "shortDescription": {"text": "Possibly dead Python function: auto_cancel_choice"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-245125481ad77902", "name": "Possibly dead Python function: handle_progress", "shortDescription": {"text": "Possibly dead Python function: handle_progress"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0d9adc2edaf35e88", "name": "Possibly dead Python function: prompt_user_choice", "shortDescription": {"text": "Possibly dead Python function: prompt_user_choice"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-996ed9a089670db9", "name": "Possibly dead Python function: handle_data", "shortDescription": {"text": "Possibly dead Python function: handle_data"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-064e6ed6e277804d", "name": "Possibly dead Python function: build_agent", "shortDescription": {"text": "Possibly dead Python function: build_agent"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1df005e266f0c0b1", "name": "Possibly dead Python function: is_blocked", "shortDescription": {"text": "Possibly dead Python function: is_blocked"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-56792a8b94b94391", "name": "Possibly dead Python function: needs_confirm", "shortDescription": {"text": "Possibly dead Python function: needs_confirm"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-49ff61b5bbb192fa", "name": "Possibly dead Python function: is_blocked", "shortDescription": {"text": "Possibly dead Python function: is_blocked"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-832526de408a3930", "name": "Possibly dead Python function: needs_confirm", "shortDescription": {"text": "Possibly dead Python function: needs_confirm"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4a55279ab8ca69e0", "name": "Possibly dead Python function: web_confirm", "shortDescription": {"text": "Possibly dead Python function: web_confirm"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9e196c91c67573e8", "name": "Possibly dead Python function: web_user_choice", "shortDescription": {"text": "Possibly dead Python function: web_user_choice"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2afc2086c75d8939", "name": "Insecure pattern 'direct_innerhtml_assignment' in kyagent/web/static/ref.html:771", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in kyagent/web/static/ref.html:771"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-43d9485d201c1a8f", "name": "Insecure pattern 'local_storage_auth_token' in kyagent/web/static/ref.html:725", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in kyagent/web/static/ref.html:725"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-68cc7fa1228ba76e", "name": "Insecure pattern 'direct_innerhtml_assignment' in kyagent/web/static/ref_v2.html:1215", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in kyagent/web/static/ref_v2.html:1215"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0b8d4d1589efdaaa", "name": "Insecure pattern 'local_storage_auth_token' in kyagent/web/static/ref_v2.html:1103", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in kyagent/web/static/ref_v2.html:1103"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-fc0c29cdc8f9b614", "name": "Insecure pattern 'direct_innerhtml_assignment' in kyagent/web/static/index.html:990", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in kyagent/web/static/index.html:990"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c042b5fefa3ff615", "name": "Insecure pattern 'local_storage_auth_token' in kyagent/web/static/index.html:882", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in kyagent/web/static/index.html:882"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-bac7da629f31ff44", "name": "Insecure pattern 'subprocess_shell_true' in study/html/06-executor-sandbox.html:283", "shortDescription": {"text": "Insecure pattern 'subprocess_shell_true' in study/html/06-executor-sandbox.html:283"}, "fullDescription": {"text": "Found a known-risky pattern (subprocess_shell_true). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-d8b8792fa4b54658", "name": "Insecure pattern 'exec_used' in study/html/06-executor-sandbox.html:82", "shortDescription": {"text": "Insecure pattern 'exec_used' in study/html/06-executor-sandbox.html:82"}, "fullDescription": {"text": "Found a known-risky pattern (exec_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-31722f9ce3ac188c", "name": "Very large file: kyagent/agent/core.py (1393 lines)", "shortDescription": {"text": "Very large file: kyagent/agent/core.py (1393 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-141b30a41e03817b", "name": "No license file detected", "shortDescription": {"text": "No license file detected"}, "fullDescription": {"text": "No LICENSE/COPYING/NOTICE file was found. Generated repositories often omit licensing, which blocks reuse and automated intake."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 199 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 43 placeholder/mock markers across 11 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b9088664ace7f748", "name": "Composite production-readiness gap", "shortDescription": {"text": "Composite production-readiness gap"}, "fullDescription": {"text": "Multiple low-cost hardening controls are missing together: license, ci. Opus verification showed these co-occurring gaps are a better readiness signal than reading each flag in isolation."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c616eccd6db56ecd", "name": "Legacy-named symbol `test_world_check_does_not_treat_unrelated_nonzero_as_old` in tests/test_loongarch_hardening.py:195", "shortDescription": {"text": "Legacy-named symbol `test_world_check_does_not_treat_unrelated_nonzero_as_old` in tests/test_loongarch_hardening.py:195"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7a2cd9037177beff", "name": "Legacy-named symbol `score_copy` in tests/test_benchmark_suite_runner.py:22", "shortDescription": {"text": "Legacy-named symbol `score_copy` in tests/test_benchmark_suite_runner.py:22"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ab96d34266d462bf", "name": "Network/subprocess call without timeout or try/except \u2014 benchmarks/unix-socket-stale-v1/gen_artifacts.py:123", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 benchmarks/unix-socket-stale-v1/gen_artifacts.py:123"}, "fullDescription": {"text": "`subprocess.Popen(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-29009eab63c6b2e9", "name": "Network/subprocess call without timeout or try/except \u2014 benchmarks/port-conflict-v1/gen_artifacts.py:36", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 benchmarks/port-conflict-v1/gen_artifacts.py:36"}, "fullDescription": {"text": "`subprocess.Popen(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0e5ee7d7a6423838", "name": "Network/subprocess call without timeout or try/except \u2014 benchmarks/stale-lock-v1/gen_artifacts.py:119", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 benchmarks/stale-lock-v1/gen_artifacts.py:119"}, "fullDescription": {"text": "`subprocess.Popen(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-20cb2d19d5141800", "name": "Network/subprocess call without timeout or try/except \u2014 benchmarks/open-deleted-v1/gen_artifacts.py:68", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 benchmarks/open-deleted-v1/gen_artifacts.py:68"}, "fullDescription": {"text": "`subprocess.Popen(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-38fe617b4ced73d5", "name": "Network/subprocess call without timeout or try/except \u2014 benchmarks/runaway-cpu-v1/gen_artifacts.py:54", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 benchmarks/runaway-cpu-v1/gen_artifacts.py:54"}, "fullDescription": {"text": "`subprocess.Popen(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1fafa2e69cf182a2", "name": "Legacy-named symbol `has_old` in kyagent/mcp/tools/loongarch.py:87", "shortDescription": {"text": "Legacy-named symbol `has_old` in kyagent/mcp/tools/loongarch.py:87"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-be46ea126aa5d8dc", "name": "Near-duplicate function bodies in 3 places", "shortDescription": {"text": "Near-duplicate function bodies in 3 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nbenchmarks/port-conflict-v1/gen_artifacts.py:port_open, benchmarks/open-deleted-v1/gen_artifacts.py:port_open, benchmarks/runaway-cpu-v1/gen_artifacts.py:port_open\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2c04133e54348533", "name": "Near-duplicate function bodies in 2 places", "shortDescription": {"text": "Near-duplicate function bodies in 2 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nkyagent/tui.py:confirm_request_lines, kyagent/tui.py:confirm\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-02525d39071dd2c7", "name": "Near-duplicate function bodies in 5 places", "shortDescription": {"text": "Near-duplicate function bodies in 5 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nkyagent/agent/llm.py:chat, kyagent/agent/llm.py:chat, kyagent/agent/llm.py:chat, kyagent/agent/llm.py:chat\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-49c98f7cedd9c977", "name": "Near-duplicate function bodies in 4 places", "shortDescription": {"text": "Near-duplicate function bodies in 4 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nkyagent/agent/llm.py:chat_stream, kyagent/agent/llm.py:chat_stream, kyagent/agent/llm.py:chat_stream, kyagent/agent/llm.py:chat_stream\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-46969939caf8120b", "name": "Near-duplicate function bodies in 9 places", "shortDescription": {"text": "Near-duplicate function bodies in 9 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nkyagent/mcp/tools/process.py:build_argv, kyagent/mcp/tools/process.py:build_argv, kyagent/mcp/tools/process.py:build_argv, kyagent/mcp/tools/process.py:build_argv\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-33a6b62e30ce7ab4", "name": "Near-duplicate function bodies in 6 places", "shortDescription": {"text": "Near-duplicate function bodies in 6 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nkyagent/mcp/tools/filesystem.py:build_argv, kyagent/mcp/tools/filesystem.py:build_argv, kyagent/mcp/tools/filesystem.py:build_argv, kyagent/mcp/tools/filesystem.py:build_argv\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6297377883dd7783", "name": "Near-duplicate function bodies in 13 places", "shortDescription": {"text": "Near-duplicate function bodies in 13 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nkyagent/mcp/tools/security.py:build_argv, kyagent/mcp/tools/security.py:build_argv, kyagent/mcp/tools/security.py:build_argv, kyagent/mcp/tools/security.py:build_argv\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0027e313ade46c8f", "name": "Near-duplicate function bodies in 7 places", "shortDescription": {"text": "Near-duplicate function bodies in 7 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nkyagent/mcp/tools/disk.py:build_argv, kyagent/mcp/tools/disk.py:build_argv, kyagent/mcp/tools/disk.py:build_argv, kyagent/mcp/tools/disk.py:build_argv\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f73f4ea428bde650", "name": "FastAPI POST `ask` without auth dependency \u2014 kyagent/web/server.py:233", "shortDescription": {"text": "FastAPI POST `ask` without auth dependency \u2014 kyagent/web/server.py:233"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-fae67957c233ae72", "name": "FastAPI POST `reset_session` without auth dependency \u2014 kyagent/web/server.py:252", "shortDescription": {"text": "FastAPI POST `reset_session` without auth dependency \u2014 kyagent/web/server.py:252"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-9582b5dd7588619f", "name": "FastAPI POST `approve_approval` without auth dependency \u2014 kyagent/web/server.py:280", "shortDescription": {"text": "FastAPI POST `approve_approval` without auth dependency \u2014 kyagent/web/server.py:280"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-319e722132896e90", "name": "FastAPI POST `reject_approval` without auth dependency \u2014 kyagent/web/server.py:292", "shortDescription": {"text": "FastAPI POST `reject_approval` without auth dependency \u2014 kyagent/web/server.py:292"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-d16b530eb0da0fc3", "name": "FastAPI POST `select_choice` without auth dependency \u2014 kyagent/web/server.py:314", "shortDescription": {"text": "FastAPI POST `select_choice` without auth dependency \u2014 kyagent/web/server.py:314"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-f18661d269dd8680", "name": "FastAPI POST `ask_stream` without auth dependency \u2014 kyagent/web/server.py:327", "shortDescription": {"text": "FastAPI POST `ask_stream` without auth dependency \u2014 kyagent/web/server.py:327"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-0beebd66a2085ff4", "name": "FastAPI POST `safety_check` without auth dependency \u2014 kyagent/web/server.py:431", "shortDescription": {"text": "FastAPI POST `safety_check` without auth dependency \u2014 kyagent/web/server.py:431"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/24975"}, "properties": {"repository": "chuali-zi/long-agent", "repoUrl": "https://github.com/chuali-zi/long-agent", "branch": "main"}, "results": [{"ruleId": "scanner-362650bc975d3394", "level": "note", "message": {"text": "Possibly dead Python function: gen_nginx_access"}, "properties": {"repobilityId": "5e29200a3cdba6f9", "scanner": "scanner-primary", "fingerprint": "362650bc975d3394", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "benchmarks/cleanup-v2/gen_artifacts.py:69"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-be532215f695434a", "level": "note", "message": {"text": "Possibly dead Python function: gen_nginx_error"}, "properties": {"repobilityId": "d5f2482540ac33b8", "scanner": "scanner-primary", "fingerprint": "be532215f695434a", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "benchmarks/cleanup-v2/gen_artifacts.py:88"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-21c71afe46d24dc3", "level": "note", "message": {"text": "Possibly dead Python function: gen_audit"}, "properties": {"repobilityId": "df03f23417641ecf", "scanner": "scanner-primary", "fingerprint": "21c71afe46d24dc3", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "benchmarks/cleanup-v2/gen_artifacts.py:110"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ab4fa0564f4eeb40", "level": "note", "message": {"text": "Possibly dead Python function: gen_syslog"}, "properties": {"repobilityId": "b3142e7b79907d66", "scanner": "scanner-primary", "fingerprint": "ab4fa0564f4eeb40", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "benchmarks/cleanup-v2/gen_artifacts.py:137"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-73911ed1855451b2", "level": "note", "message": {"text": "Possibly dead Python function: gen_secure"}, "properties": {"repobilityId": "bba2e2860c847091", "scanner": "scanner-primary", "fingerprint": "73911ed1855451b2", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "benchmarks/cleanup-v2/gen_artifacts.py:158"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7eb8855f50ecc9ec", "level": "note", "message": {"text": "Possibly dead Python function: gen_portal_json"}, "properties": {"repobilityId": "9e4bef01222aaff9", "scanner": "scanner-primary", "fingerprint": "7eb8855f50ecc9ec", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "benchmarks/cleanup-v2/gen_artifacts.py:177"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0a5fa145882b62a6", "level": "note", "message": {"text": "Possibly dead Python function: gen_pip_log"}, "properties": {"repobilityId": "cf13a1c46ac7617d", "scanner": "scanner-primary", "fingerprint": "0a5fa145882b62a6", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "benchmarks/cleanup-v2/gen_artifacts.py:198"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7ed50ee93caab1b9", "level": "note", "message": {"text": "Possibly dead Python function: gen_mysql_binlog"}, "properties": {"repobilityId": "7398b982bc197f77", "scanner": "scanner-primary", "fingerprint": "7ed50ee93caab1b9", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "benchmarks/cleanup-v2/gen_artifacts.py:215"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-11543efb11d8cabd", "level": "note", "message": {"text": "Possibly dead Python function: gen_utmp"}, "properties": {"repobilityId": "5f449a91035ee372", "scanner": "scanner-primary", "fingerprint": "11543efb11d8cabd", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "benchmarks/cleanup-v2/gen_artifacts.py:225"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-299d1dc34cda5fdf", "level": "note", "message": {"text": "Possibly dead Python function: gen_dnf_cache"}, "properties": {"repobilityId": "826def4ceecef6d8", "scanner": "scanner-primary", "fingerprint": "299d1dc34cda5fdf", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "benchmarks/cleanup-v2/gen_artifacts.py:247"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-774ce5b6680d9b06", "level": "note", "message": {"text": "Possibly dead Python function: auto_deny"}, "properties": {"repobilityId": "51ee7810122c1699", "scanner": "scanner-primary", "fingerprint": "774ce5b6680d9b06", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "kyagent/confirm.py:43"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-764d4b8be31920e1", "level": "note", "message": {"text": "Possibly dead Python function: noop_progress"}, "properties": {"repobilityId": "f2e2a772b293089c", "scanner": "scanner-primary", "fingerprint": "764d4b8be31920e1", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "kyagent/progress.py:57"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7e44a74e925e2c14", "level": "note", "message": {"text": "Possibly dead Python function: auto_cancel_choice"}, "properties": {"repobilityId": "91e22968066e62c2", "scanner": "scanner-primary", "fingerprint": "7e44a74e925e2c14", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "kyagent/interactive.py:44"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-245125481ad77902", "level": "note", "message": {"text": "Possibly dead Python function: handle_progress"}, "properties": {"repobilityId": "4828711ea31edbbf", "scanner": "scanner-primary", "fingerprint": "245125481ad77902", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "kyagent/tui.py:246"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0d9adc2edaf35e88", "level": "note", "message": {"text": "Possibly dead Python function: prompt_user_choice"}, "properties": {"repobilityId": "e8c4b4f7f96824f7", "scanner": "scanner-primary", "fingerprint": "0d9adc2edaf35e88", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "kyagent/tui.py:470"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-996ed9a089670db9", "level": "note", "message": {"text": "Possibly dead Python function: handle_data"}, "properties": {"repobilityId": "3a673a278f4fc1e6", "scanner": "scanner-primary", "fingerprint": "996ed9a089670db9", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "kyagent/web_knowledge.py:39"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-064e6ed6e277804d", "level": "note", "message": {"text": "Possibly dead Python function: build_agent"}, "properties": {"repobilityId": "4ce32291aa7dd1f1", "scanner": "scanner-primary", "fingerprint": "064e6ed6e277804d", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "kyagent/agent/core.py:1388"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1df005e266f0c0b1", "level": "note", "message": {"text": "Possibly dead Python function: is_blocked"}, "properties": {"repobilityId": "b5561653d7817db6", "scanner": "scanner-primary", "fingerprint": "1df005e266f0c0b1", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "kyagent/safety/guardrail.py:40"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-56792a8b94b94391", "level": "note", "message": {"text": "Possibly dead Python function: needs_confirm"}, "properties": {"repobilityId": "cca7c760b9f7c07b", "scanner": "scanner-primary", "fingerprint": "56792a8b94b94391", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "kyagent/safety/guardrail.py:43"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-49ff61b5bbb192fa", "level": "note", "message": {"text": "Possibly dead Python function: is_blocked"}, "properties": {"repobilityId": "b5561653d7817db6", "scanner": "scanner-primary", "fingerprint": "49ff61b5bbb192fa", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "kyagent/safety/intent.py:138"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-832526de408a3930", "level": "note", "message": {"text": "Possibly dead Python function: needs_confirm"}, "properties": {"repobilityId": "cca7c760b9f7c07b", "scanner": "scanner-primary", "fingerprint": "832526de408a3930", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "kyagent/safety/intent.py:141"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4a55279ab8ca69e0", "level": "note", "message": {"text": "Possibly dead Python function: web_confirm"}, "properties": {"repobilityId": "f6397fc3587c2166", "scanner": "scanner-primary", "fingerprint": "4a55279ab8ca69e0", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "kyagent/web/server.py:350"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9e196c91c67573e8", "level": "note", "message": {"text": "Possibly dead Python function: web_user_choice"}, "properties": {"repobilityId": "b5426ecf5e3dd86a", "scanner": "scanner-primary", "fingerprint": "9e196c91c67573e8", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "kyagent/web/server.py:360"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2afc2086c75d8939", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in kyagent/web/static/ref.html:771"}, "properties": {"repobilityId": "4497e2cb525d7e60", "scanner": "scanner-primary", "fingerprint": "2afc2086c75d8939", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "kyagent/web/static/ref.html"}, "region": {"startLine": 771}}}]}, {"ruleId": "scanner-43d9485d201c1a8f", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in kyagent/web/static/ref.html:725"}, "properties": {"repobilityId": "723649a3eccb4614", "scanner": "scanner-primary", "fingerprint": "43d9485d201c1a8f", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "kyagent/web/static/ref.html"}, "region": {"startLine": 725}}}]}, {"ruleId": "scanner-68cc7fa1228ba76e", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in kyagent/web/static/ref_v2.html:1215"}, "properties": {"repobilityId": "bf098cdb5aa32761", "scanner": "scanner-primary", "fingerprint": "68cc7fa1228ba76e", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "kyagent/web/static/ref_v2.html"}, "region": {"startLine": 1215}}}]}, {"ruleId": "scanner-0b8d4d1589efdaaa", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in kyagent/web/static/ref_v2.html:1103"}, "properties": {"repobilityId": "8914704994e8cdf9", "scanner": "scanner-primary", "fingerprint": "0b8d4d1589efdaaa", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "kyagent/web/static/ref_v2.html"}, "region": {"startLine": 1103}}}]}, {"ruleId": "scanner-fc0c29cdc8f9b614", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in kyagent/web/static/index.html:990"}, "properties": {"repobilityId": "174b5ec8697264e9", "scanner": "scanner-primary", "fingerprint": "fc0c29cdc8f9b614", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "kyagent/web/static/index.html"}, "region": {"startLine": 990}}}]}, {"ruleId": "scanner-c042b5fefa3ff615", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in kyagent/web/static/index.html:882"}, "properties": {"repobilityId": "edd362d18f4f45a5", "scanner": "scanner-primary", "fingerprint": "c042b5fefa3ff615", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "kyagent/web/static/index.html"}, "region": {"startLine": 882}}}]}, {"ruleId": "scanner-bac7da629f31ff44", "level": "error", "message": {"text": "Insecure pattern 'subprocess_shell_true' in study/html/06-executor-sandbox.html:283"}, "properties": {"repobilityId": "79a158d3b695ec02", "scanner": "scanner-primary", "fingerprint": "bac7da629f31ff44", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "subprocess_shell_true"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "study/html/06-executor-sandbox.html"}, "region": {"startLine": 283}}}]}, {"ruleId": "scanner-d8b8792fa4b54658", "level": "error", "message": {"text": "Insecure pattern 'exec_used' in study/html/06-executor-sandbox.html:82"}, "properties": {"repobilityId": "3927efa82e82920a", "scanner": "scanner-primary", "fingerprint": "d8b8792fa4b54658", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "exec_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "study/html/06-executor-sandbox.html"}, "region": {"startLine": 82}}}]}, {"ruleId": "scanner-31722f9ce3ac188c", "level": "note", "message": {"text": "Very large file: kyagent/agent/core.py (1393 lines)"}, "properties": {"repobilityId": "4833b318b0478aa4", "scanner": "scanner-primary", "fingerprint": "31722f9ce3ac188c", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-141b30a41e03817b", "level": "note", "message": {"text": "No license file detected"}, "properties": {"repobilityId": "65c889f40939e6a1", "scanner": "scanner-primary", "fingerprint": "141b30a41e03817b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["license", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "8f62b545df1d34e4", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "6e5f97ea0673ad0b", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "b98956c96ab074f7", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-b9088664ace7f748", "level": "note", "message": {"text": "Composite production-readiness gap"}, "properties": {"repobilityId": "b75f5563d7a6720b", "scanner": "scanner-primary", "fingerprint": "b9088664ace7f748", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["production-readiness", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-c616eccd6db56ecd", "level": "note", "message": {"text": "Legacy-named symbol `test_world_check_does_not_treat_unrelated_nonzero_as_old` in tests/test_loongarch_hardening.py:195"}, "properties": {"repobilityId": "71c7323a8651edff", "scanner": "scanner-primary", "fingerprint": "c616eccd6db56ecd", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-7a2cd9037177beff", "level": "note", "message": {"text": "Legacy-named symbol `score_copy` in tests/test_benchmark_suite_runner.py:22"}, "properties": {"repobilityId": "7d9a2c206d71eb79", "scanner": "scanner-primary", "fingerprint": "7a2cd9037177beff", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-ab96d34266d462bf", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 benchmarks/unix-socket-stale-v1/gen_artifacts.py:123"}, "properties": {"repobilityId": "9cbc1fad46e1481d", "scanner": "scanner-primary", "fingerprint": "ab96d34266d462bf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-29009eab63c6b2e9", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 benchmarks/port-conflict-v1/gen_artifacts.py:36"}, "properties": {"repobilityId": "56bc89c8871c269b", "scanner": "scanner-primary", "fingerprint": "29009eab63c6b2e9", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-0e5ee7d7a6423838", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 benchmarks/stale-lock-v1/gen_artifacts.py:119"}, "properties": {"repobilityId": "3f5e95b6e4ca2b1d", "scanner": "scanner-primary", "fingerprint": "0e5ee7d7a6423838", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-20cb2d19d5141800", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 benchmarks/open-deleted-v1/gen_artifacts.py:68"}, "properties": {"repobilityId": "35559884d28cbd8c", "scanner": "scanner-primary", "fingerprint": "20cb2d19d5141800", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-38fe617b4ced73d5", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 benchmarks/runaway-cpu-v1/gen_artifacts.py:54"}, "properties": {"repobilityId": "26258d75131e025e", "scanner": "scanner-primary", "fingerprint": "38fe617b4ced73d5", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-1fafa2e69cf182a2", "level": "note", "message": {"text": "Legacy-named symbol `has_old` in kyagent/mcp/tools/loongarch.py:87"}, "properties": {"repobilityId": "6c4b4de1379b7088", "scanner": "scanner-primary", "fingerprint": "1fafa2e69cf182a2", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "3a0285508437875d", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "b57e1d9b11e8d8e2", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "bace3b4c109f3837", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "37ed9f99be64632b", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "1ecd4a87b6351d5e", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-02525d39071dd2c7", "level": "note", "message": {"text": "Near-duplicate function bodies in 5 places"}, "properties": {"repobilityId": "322335046529df2d", "scanner": "scanner-primary", "fingerprint": "02525d39071dd2c7", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-49c98f7cedd9c977", "level": "note", "message": {"text": "Near-duplicate function bodies in 4 places"}, "properties": {"repobilityId": "3303983d186e6c5d", "scanner": "scanner-primary", "fingerprint": "49c98f7cedd9c977", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "b4a903ee9e380443", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "73e296eb370459d8", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "bb7659899e28bae3", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "8c9ec0906e29800d", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "666cb2be0ae55fd1", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "16ab4940ac9c8a6f", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-46969939caf8120b", "level": "note", "message": {"text": "Near-duplicate function bodies in 9 places"}, "properties": {"repobilityId": "739aff853b1f359f", "scanner": "scanner-primary", "fingerprint": "46969939caf8120b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-49c98f7cedd9c977", "level": "note", "message": {"text": "Near-duplicate function bodies in 4 places"}, "properties": {"repobilityId": "31a4d433b8a2da94", "scanner": "scanner-primary", "fingerprint": "49c98f7cedd9c977", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-33a6b62e30ce7ab4", "level": "note", "message": {"text": "Near-duplicate function bodies in 6 places"}, "properties": {"repobilityId": "5caa5f33d2ad37fa", "scanner": "scanner-primary", "fingerprint": "33a6b62e30ce7ab4", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "da00a7185e16062c", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-6297377883dd7783", "level": "note", "message": {"text": "Near-duplicate function bodies in 13 places"}, "properties": {"repobilityId": "ffa0ef2089d59b89", "scanner": "scanner-primary", "fingerprint": "6297377883dd7783", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-33a6b62e30ce7ab4", "level": "note", "message": {"text": "Near-duplicate function bodies in 6 places"}, "properties": {"repobilityId": "eefbbb37872d5e64", "scanner": "scanner-primary", "fingerprint": "33a6b62e30ce7ab4", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-0027e313ade46c8f", "level": "note", "message": {"text": "Near-duplicate function bodies in 7 places"}, "properties": {"repobilityId": "a618151142c0fccb", "scanner": "scanner-primary", "fingerprint": "0027e313ade46c8f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-f73f4ea428bde650", "level": "error", "message": {"text": "FastAPI POST `ask` without auth dependency \u2014 kyagent/web/server.py:233"}, "properties": {"repobilityId": "0e798aa0ef9b2e77", "scanner": "scanner-primary", "fingerprint": "f73f4ea428bde650", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "kyagent/web/server.py"}, "region": {"startLine": 233}}}]}, {"ruleId": "scanner-fae67957c233ae72", "level": "error", "message": {"text": "FastAPI POST `reset_session` without auth dependency \u2014 kyagent/web/server.py:252"}, "properties": {"repobilityId": "fb48b921160ecf96", "scanner": "scanner-primary", "fingerprint": "fae67957c233ae72", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "kyagent/web/server.py"}, "region": {"startLine": 252}}}]}, {"ruleId": "scanner-9582b5dd7588619f", "level": "error", "message": {"text": "FastAPI POST `approve_approval` without auth dependency \u2014 kyagent/web/server.py:280"}, "properties": {"repobilityId": "c5810b02c4e72b6d", "scanner": "scanner-primary", "fingerprint": "9582b5dd7588619f", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "kyagent/web/server.py"}, "region": {"startLine": 280}}}]}, {"ruleId": "scanner-319e722132896e90", "level": "error", "message": {"text": "FastAPI POST `reject_approval` without auth dependency \u2014 kyagent/web/server.py:292"}, "properties": {"repobilityId": "a6902501972c680a", "scanner": "scanner-primary", "fingerprint": "319e722132896e90", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "kyagent/web/server.py"}, "region": {"startLine": 292}}}]}, {"ruleId": "scanner-d16b530eb0da0fc3", "level": "error", "message": {"text": "FastAPI POST `select_choice` without auth dependency \u2014 kyagent/web/server.py:314"}, "properties": {"repobilityId": "95ab9804d4805670", "scanner": "scanner-primary", "fingerprint": "d16b530eb0da0fc3", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "kyagent/web/server.py"}, "region": {"startLine": 314}}}]}, {"ruleId": "scanner-f18661d269dd8680", "level": "error", "message": {"text": "FastAPI POST `ask_stream` without auth dependency \u2014 kyagent/web/server.py:327"}, "properties": {"repobilityId": "9e16b7736b051c03", "scanner": "scanner-primary", "fingerprint": "f18661d269dd8680", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "kyagent/web/server.py"}, "region": {"startLine": 327}}}]}, {"ruleId": "scanner-0beebd66a2085ff4", "level": "error", "message": {"text": "FastAPI POST `safety_check` without auth dependency \u2014 kyagent/web/server.py:431"}, "properties": {"repobilityId": "2c3801af29cff59b", "scanner": "scanner-primary", "fingerprint": "0beebd66a2085ff4", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "kyagent/web/server.py"}, "region": {"startLine": 431}}}]}]}]}