{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-9710c8d059e53154", "name": "No frontend routes/components detected", "shortDescription": {"text": "No frontend routes/components detected"}, "fullDescription": {"text": "No React/Vue/Next routes were found. This is fine for backend-only repos."}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-630c3983fe05755f", "name": "Insecure pattern 'direct_innerhtml_assignment' in pkg/claude/agentd/dashboard/js/plugins.js:210", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in pkg/claude/agentd/dashboard/js/plugins.js:210"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b17cf4a4602688a4", "name": "Insecure pattern 'direct_innerhtml_assignment' in pkg/claude/agentd/dashboard/js/costs.js:184", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in pkg/claude/agentd/dashboard/js/costs.js:184"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-38534371e11bc2e1", "name": "Insecure pattern 'direct_innerhtml_assignment' in pkg/claude/agentd/dashboard/js/slop-fx.js:262", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in pkg/claude/agentd/dashboard/js/slop-fx.js:262"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-082aceb9ccd11d9b", "name": "Insecure pattern 'direct_innerhtml_assignment' in pkg/claude/agentd/dashboard/js/refresh.js:256", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in pkg/claude/agentd/dashboard/js/refresh.js:256"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-510741946c404a9a", "name": "Insecure pattern 'direct_innerhtml_assignment' in pkg/claude/agentd/dashboard/js/slop-credits.js:86", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in pkg/claude/agentd/dashboard/js/slop-credits.js:86"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2e2b0f4f19f3b056", "name": "Insecure pattern 'direct_innerhtml_assignment' in pkg/claude/agentd/dashboard/js/modal-spawn.js:96", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in pkg/claude/agentd/dashboard/js/modal-spawn.js:96"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8d75bcde6be9395d", "name": "Insecure pattern 'direct_innerhtml_assignment' in pkg/claude/agentd/dashboard/js/modal-cron.js:25", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in pkg/claude/agentd/dashboard/js/modal-cron.js:25"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8dd3daf529747b40", "name": "Insecure pattern 'direct_innerhtml_assignment' in pkg/claude/agentd/dashboard/js/render.js:541", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in pkg/claude/agentd/dashboard/js/render.js:541"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f2f2c04579807533", "name": "Insecure pattern 'direct_innerhtml_assignment' in pkg/claude/agentd/dashboard/js/config.js:88", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in pkg/claude/agentd/dashboard/js/config.js:88"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0fbd8330bd9cbaa3", "name": "Insecure pattern 'direct_innerhtml_assignment' in pkg/claude/agentd/dashboard/js/tabs.js:98", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in pkg/claude/agentd/dashboard/js/tabs.js:98"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a8163d7714ad2761", "name": "Insecure pattern 'direct_innerhtml_assignment' in pkg/claude/agentd/dashboard/js/modal-message.js:101", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in pkg/claude/agentd/dashboard/js/modal-message.js:101"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e37fd8637d23aabd", "name": "Insecure pattern 'direct_innerhtml_assignment' in pkg/claude/agentd/dashboard/js/modal-link-wt.js:35", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in pkg/claude/agentd/dashboard/js/modal-link-wt.js:35"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-27924aa79fa4a517", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0763d85002569570", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/deploy-pages@v5 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-14ce8614dd03f409", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-46c644c6227e4d4a", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1838a141491ce38c", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4240f0f2a55e0a76", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b2546c752752c5bc", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-bf3746f260e930eb", "name": "Very large file: pkg/claude/conv/watch.go (1995 lines)", "shortDescription": {"text": "Very large file: pkg/claude/conv/watch.go (1995 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9994f16095d478aa", "name": "Very large file: pkg/claude/common/db/agent.go (1582 lines)", "shortDescription": {"text": "Very large file: pkg/claude/common/db/agent.go (1582 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-10e76d91d1a23efb", "name": "Very large file: pkg/claude/common/db/migrate.go (2656 lines)", "shortDescription": {"text": "Very large file: pkg/claude/common/db/migrate.go (2656 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c6c402f49743a557", "name": "Very large file: pkg/claude/agent/groups.go (1620 lines)", "shortDescription": {"text": "Very large file: pkg/claude/agent/groups.go (1620 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3364bbfd4d3e2cd9", "name": "Very large file: pkg/claude/session/hook_callback.go (1416 lines)", "shortDescription": {"text": "Very large file: pkg/claude/session/hook_callback.go (1416 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-879a49e275508db7", "name": "Very large file: pkg/claude/agentd/handlers.go (2927 lines)", "shortDescription": {"text": "Very large file: pkg/claude/agentd/handlers.go (2927 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cb9bc40386ddb209", "name": "Very large file: pkg/claude/agentd/dashboard.go (1415 lines)", "shortDescription": {"text": "Very large file: pkg/claude/agentd/dashboard.go (1415 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7e4589f2f4376b9d", "name": "Very large file: pkg/claude/agentd/dashboard_edit.go (1442 lines)", "shortDescription": {"text": "Very large file: pkg/claude/agentd/dashboard_edit.go (1442 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-043315cd86eeb769", "name": "Very large file: pkg/claude/agentd/lifecycle.go (1767 lines)", "shortDescription": {"text": "Very large file: pkg/claude/agentd/lifecycle.go (1767 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-70e4571849dd7a6a", "name": "Very large file: pkg/claude/agentd/dashboard/js/refresh.js (2146 lines)", "shortDescription": {"text": "Very large file: pkg/claude/agentd/dashboard/js/refresh.js (2146 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e6acfa574240410e", "name": "Very large file: pkg/claude/agentd/dashboard/js/row-actions.js (1406 lines)", "shortDescription": {"text": "Very large file: pkg/claude/agentd/dashboard/js/row-actions.js (1406 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 99 placeholder/mock markers across 46 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-11825279136b53a3", "name": "CI is configured but no tests are detected", "shortDescription": {"text": "CI is configured but no tests are detected"}, "fullDescription": {"text": "A CI pipeline exists, but the scan found no test files to gate. Opus labeled this generated-code pattern as config theater: release machinery exists, but it has little behavioral signal."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-749d4bc1bd66df5f", "name": "Agent instructions exist but release-hardening basics are missing", "shortDescription": {"text": "Agent instructions exist but release-hardening basics are missing"}, "fullDescription": {"text": "AI-coder instruction files were found, but the repo is missing tests. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-d6cb3500c6bf6f84", "name": "Agent authority lacks a verifier contract: pkg/claude/agent/skills/agent-rename/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: pkg/claude/agent/skills/agent-rename/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8934fedfa77aa4a0", "name": "Agent authority lacks a verifier contract: pkg/claude/agent/skills/agent-schedule/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: pkg/claude/agent/skills/agent-schedule/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7c0fc2d75e26ffe0", "name": "Agent authority lacks a verifier contract: pkg/claude/agent/skills/agent-coord/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: pkg/claude/agent/skills/agent-coord/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2ae8a436e6352d72", "name": "Agent authority lacks a verifier contract: pkg/claude/agent/skills/agent-dir/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: pkg/claude/agent/skills/agent-dir/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e54eabe094a25a5f", "name": "Agent authority lacks a verifier contract: pkg/claude/agent/skills/human-notify/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: pkg/claude/agent/skills/human-notify/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7fda05d871d10af8", "name": "Commented-code block (9 lines) in pkg/claude/agentd/dashboard/js/slop-audio.js:15", "shortDescription": {"text": "Commented-code block (9 lines) in pkg/claude/agentd/dashboard/js/slop-audio.js:15"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-7135e15514910c0a", "name": "Commented-code block (5 lines) in pkg/claude/agentd/dashboard/js/plugins.js:4", "shortDescription": {"text": "Commented-code block (5 lines) in pkg/claude/agentd/dashboard/js/plugins.js:4"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-cba3f345c15fdde9", "name": "`fetch()` without try/.catch or AbortSignal \u2014 pkg/claude/agentd/dashboard/js/plugins.js:338", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 pkg/claude/agentd/dashboard/js/plugins.js:338"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ac7a7f4cfc5ca2bf", "name": "Commented-code block (5 lines) in pkg/claude/agentd/dashboard/js/vegas.js:7", "shortDescription": {"text": "Commented-code block (5 lines) in pkg/claude/agentd/dashboard/js/vegas.js:7"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-3f566ad87338866d", "name": "Commented-code block (6 lines) in pkg/claude/agentd/dashboard/js/costs.js:4", "shortDescription": {"text": "Commented-code block (6 lines) in pkg/claude/agentd/dashboard/js/costs.js:4"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-a482c5283e3ae8af", "name": "Commented-code block (6 lines) in pkg/claude/agentd/dashboard/js/helpers.js:3", "shortDescription": {"text": "Commented-code block (6 lines) in pkg/claude/agentd/dashboard/js/helpers.js:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-2dce72ce28b57a8b", "name": "Commented-code block (9 lines) in pkg/claude/agentd/dashboard/js/slop-fx.js:4", "shortDescription": {"text": "Commented-code block (9 lines) in pkg/claude/agentd/dashboard/js/slop-fx.js:4"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-a8c4bedffec7ffc6", "name": "Commented-code block (6 lines) in pkg/claude/agentd/dashboard/js/refresh.js:20", "shortDescription": {"text": "Commented-code block (6 lines) in pkg/claude/agentd/dashboard/js/refresh.js:20"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-b0cafd43f6193cbd", "name": "`fetch()` without try/.catch or AbortSignal \u2014 pkg/claude/agentd/dashboard/js/refresh.js:925", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 pkg/claude/agentd/dashboard/js/refresh.js:925"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9ad8bb9ff7ed84e5", "name": "Commented-code block (5 lines) in pkg/claude/agentd/dashboard/js/slop-credits.js:6", "shortDescription": {"text": "Commented-code block (5 lines) in pkg/claude/agentd/dashboard/js/slop-credits.js:6"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-7dc744daa07923f4", "name": "Commented-code block (6 lines) in pkg/claude/agentd/dashboard/js/modal-spawn.js:21", "shortDescription": {"text": "Commented-code block (6 lines) in pkg/claude/agentd/dashboard/js/modal-spawn.js:21"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-807452656ed63f62", "name": "`fetch()` without try/.catch or AbortSignal \u2014 pkg/claude/agentd/dashboard/js/modal-spawn.js:643", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 pkg/claude/agentd/dashboard/js/modal-spawn.js:643"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f412ac7b9b3d6717", "name": "Commented-code block (6 lines) in pkg/claude/agentd/dashboard/js/row-actions.js:36", "shortDescription": {"text": "Commented-code block (6 lines) in pkg/claude/agentd/dashboard/js/row-actions.js:36"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-bd5be59c979a2a01", "name": "`fetch()` without try/.catch or AbortSignal \u2014 pkg/claude/agentd/dashboard/js/row-actions.js:231", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 pkg/claude/agentd/dashboard/js/row-actions.js:231"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-39f9172b0bece5a1", "name": "Commented-code block (5 lines) in pkg/claude/agentd/dashboard/js/dashboard.js:46", "shortDescription": {"text": "Commented-code block (5 lines) in pkg/claude/agentd/dashboard/js/dashboard.js:46"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-674e620c00ee06be", "name": "Commented-code block (5 lines) in pkg/claude/agentd/dashboard/js/virtual-groups.js:3", "shortDescription": {"text": "Commented-code block (5 lines) in pkg/claude/agentd/dashboard/js/virtual-groups.js:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-f69a8fffe56f115a", "name": "Commented-code block (5 lines) in pkg/claude/agentd/dashboard/js/modal-cron.js:9", "shortDescription": {"text": "Commented-code block (5 lines) in pkg/claude/agentd/dashboard/js/modal-cron.js:9"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-d613b74dc4c37a59", "name": "`fetch()` without try/.catch or AbortSignal \u2014 pkg/claude/agentd/dashboard/js/modal-cron.js:549", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 pkg/claude/agentd/dashboard/js/modal-cron.js:549"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-23bc666e75d07560", "name": "Commented-code block (6 lines) in pkg/claude/agentd/dashboard/js/render.js:16", "shortDescription": {"text": "Commented-code block (6 lines) in pkg/claude/agentd/dashboard/js/render.js:16"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-7a66c20722ce9972", "name": "Commented-code block (8 lines) in pkg/claude/agentd/dashboard/js/prefs.js:6", "shortDescription": {"text": "Commented-code block (8 lines) in pkg/claude/agentd/dashboard/js/prefs.js:6"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-fc017eca4d6b5c7f", "name": "Commented-code block (10 lines) in pkg/claude/agentd/dashboard/js/config.js:8", "shortDescription": {"text": "Commented-code block (10 lines) in pkg/claude/agentd/dashboard/js/config.js:8"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-5992d08b70e8ce4a", "name": "Commented-code block (8 lines) in pkg/claude/agentd/dashboard/js/tabs.js:20", "shortDescription": {"text": "Commented-code block (8 lines) in pkg/claude/agentd/dashboard/js/tabs.js:20"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-a1fede78da98df49", "name": "Commented-code block (8 lines) in pkg/claude/agentd/dashboard/js/modal-message.js:24", "shortDescription": {"text": "Commented-code block (8 lines) in pkg/claude/agentd/dashboard/js/modal-message.js:24"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-d79f875bebfbe4d6", "name": "Commented-code block (8 lines) in pkg/claude/agentd/dashboard/js/slop-volume.js:3", "shortDescription": {"text": "Commented-code block (8 lines) in pkg/claude/agentd/dashboard/js/slop-volume.js:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-81c2d6174c366561", "name": "Commented-code block (7 lines) in pkg/claude/agentd/dashboard/js/dnd.js:25", "shortDescription": {"text": "Commented-code block (7 lines) in pkg/claude/agentd/dashboard/js/dnd.js:25"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-0d0dfa23940bcd5a", "name": "`fetch()` without try/.catch or AbortSignal \u2014 pkg/claude/agentd/dashboard/js/dnd.js:292", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 pkg/claude/agentd/dashboard/js/dnd.js:292"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9bd5150ba5817521", "name": "Commented-code block (5 lines) in pkg/claude/agentd/dashboard/js/modal-link-wt.js:155", "shortDescription": {"text": "Commented-code block (5 lines) in pkg/claude/agentd/dashboard/js/modal-link-wt.js:155"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-b2f3c2e99e3dd617", "name": "`fetch()` without try/.catch or AbortSignal \u2014 pkg/claude/agentd/dashboard/js/modal-link-wt.js:123", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 pkg/claude/agentd/dashboard/js/modal-link-wt.js:123"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ced16f69644e3ea9", "name": "Commented-code block (5 lines) in pkg/claude/agentd/dashboard/js/slop.js:1", "shortDescription": {"text": "Commented-code block (5 lines) in pkg/claude/agentd/dashboard/js/slop.js:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-39c3089a3208924a", "name": "Commented-code block (5 lines) in pkg/claude/agentd/dashboard/js/sort.js:3", "shortDescription": {"text": "Commented-code block (5 lines) in pkg/claude/agentd/dashboard/js/sort.js:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-651d7c76a80c7dc4", "name": "Commented-code block (8 lines) in pkg/claude/agentd/dashboard/js/modal-templates.js:421", "shortDescription": {"text": "Commented-code block (8 lines) in pkg/claude/agentd/dashboard/js/modal-templates.js:421"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-0842aad810a81092", "name": "Commented-code block (9 lines) in pkg/claude/agentd/dashboard/js/slop-spectacle.js:6", "shortDescription": {"text": "Commented-code block (9 lines) in pkg/claude/agentd/dashboard/js/slop-spectacle.js:6"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/21436"}, "properties": {"repository": "tofutools/tclaude", "repoUrl": "https://github.com/tofutools/tclaude", "branch": "main"}, "results": [{"ruleId": "scanner-9710c8d059e53154", "level": "none", "message": {"text": "No frontend routes/components detected"}, "properties": {"repobilityId": "44ca61485762e494", "scanner": "scanner-primary", "fingerprint": "9710c8d059e53154", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-630c3983fe05755f", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in pkg/claude/agentd/dashboard/js/plugins.js:210"}, "properties": {"repobilityId": "0b5f6deae732b10f", "scanner": "scanner-primary", "fingerprint": "630c3983fe05755f", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pkg/claude/agentd/dashboard/js/plugins.js"}, "region": {"startLine": 210}}}]}, {"ruleId": "scanner-b17cf4a4602688a4", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in pkg/claude/agentd/dashboard/js/costs.js:184"}, "properties": {"repobilityId": "225f269c871f6307", "scanner": "scanner-primary", "fingerprint": "b17cf4a4602688a4", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pkg/claude/agentd/dashboard/js/costs.js"}, "region": {"startLine": 184}}}]}, {"ruleId": "scanner-38534371e11bc2e1", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in pkg/claude/agentd/dashboard/js/slop-fx.js:262"}, "properties": {"repobilityId": "4ef753b523698e4e", "scanner": "scanner-primary", "fingerprint": "38534371e11bc2e1", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pkg/claude/agentd/dashboard/js/slop-fx.js"}, "region": {"startLine": 262}}}]}, {"ruleId": "scanner-082aceb9ccd11d9b", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in pkg/claude/agentd/dashboard/js/refresh.js:256"}, "properties": {"repobilityId": "cb87f3a3d7d73975", "scanner": "scanner-primary", "fingerprint": "082aceb9ccd11d9b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pkg/claude/agentd/dashboard/js/refresh.js"}, "region": {"startLine": 256}}}]}, {"ruleId": "scanner-510741946c404a9a", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in pkg/claude/agentd/dashboard/js/slop-credits.js:86"}, "properties": {"repobilityId": "adbdac2eb8a6548c", "scanner": "scanner-primary", "fingerprint": "510741946c404a9a", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pkg/claude/agentd/dashboard/js/slop-credits.js"}, "region": {"startLine": 86}}}]}, {"ruleId": "scanner-2e2b0f4f19f3b056", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in pkg/claude/agentd/dashboard/js/modal-spawn.js:96"}, "properties": {"repobilityId": "6c9b5eaed799b1e2", "scanner": "scanner-primary", "fingerprint": "2e2b0f4f19f3b056", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pkg/claude/agentd/dashboard/js/modal-spawn.js"}, "region": {"startLine": 96}}}]}, {"ruleId": "scanner-8d75bcde6be9395d", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in pkg/claude/agentd/dashboard/js/modal-cron.js:25"}, "properties": {"repobilityId": "2432d20491c857e5", "scanner": "scanner-primary", "fingerprint": "8d75bcde6be9395d", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pkg/claude/agentd/dashboard/js/modal-cron.js"}, "region": {"startLine": 25}}}]}, {"ruleId": "scanner-8dd3daf529747b40", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in pkg/claude/agentd/dashboard/js/render.js:541"}, "properties": {"repobilityId": "ad926ba41f185ba2", "scanner": "scanner-primary", "fingerprint": "8dd3daf529747b40", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pkg/claude/agentd/dashboard/js/render.js"}, "region": {"startLine": 541}}}]}, {"ruleId": "scanner-f2f2c04579807533", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in pkg/claude/agentd/dashboard/js/config.js:88"}, "properties": {"repobilityId": "7256724057e2e010", "scanner": "scanner-primary", "fingerprint": "f2f2c04579807533", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pkg/claude/agentd/dashboard/js/config.js"}, "region": {"startLine": 88}}}]}, {"ruleId": "scanner-0fbd8330bd9cbaa3", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in pkg/claude/agentd/dashboard/js/tabs.js:98"}, "properties": {"repobilityId": "2a293a15426ca45f", "scanner": "scanner-primary", "fingerprint": "0fbd8330bd9cbaa3", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pkg/claude/agentd/dashboard/js/tabs.js"}, "region": {"startLine": 98}}}]}, {"ruleId": "scanner-a8163d7714ad2761", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in pkg/claude/agentd/dashboard/js/modal-message.js:101"}, "properties": {"repobilityId": "1646f82190d9f8e3", "scanner": "scanner-primary", "fingerprint": "a8163d7714ad2761", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pkg/claude/agentd/dashboard/js/modal-message.js"}, "region": {"startLine": 101}}}]}, {"ruleId": "scanner-e37fd8637d23aabd", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in pkg/claude/agentd/dashboard/js/modal-link-wt.js:35"}, "properties": {"repobilityId": "ae768352e063b452", "scanner": "scanner-primary", "fingerprint": "e37fd8637d23aabd", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pkg/claude/agentd/dashboard/js/modal-link-wt.js"}, "region": {"startLine": 35}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "97a9a5de61d82fcd", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 25}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "be8027642c95a9ce", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 28}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "7b7ce4a66324740d", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 33}}}]}, {"ruleId": "scanner-0763d85002569570", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "e4610670d3104927", "scanner": "scanner-primary", "fingerprint": "0763d85002569570", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/docs.yml"}, "region": {"startLine": 43}}}]}, {"ruleId": "scanner-14ce8614dd03f409", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "81c5c697653f94e8", "scanner": "scanner-primary", "fingerprint": "14ce8614dd03f409", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/docs.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "04f6c832d67a7838", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 29}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "45fe1bb72fced1b5", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 32}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "7072ae3da503ef8b", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 40}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "04f6c832d67a7838", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 54}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "04f6c832d67a7838", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 102}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "45fe1bb72fced1b5", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 107}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "db9d162631d7772f", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 112}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "40de0ea74eab3ee8", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 121}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "04f6c832d67a7838", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 134}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "1051a99633356d7b", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 139}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f0c3d4499b6cd885", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 159}}}]}, {"ruleId": "scanner-1838a141491ce38c", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "b8fd4f5048f96576", "scanner": "scanner-primary", "fingerprint": "1838a141491ce38c", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4240f0f2a55e0a76", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "961030f79282175b", "scanner": "scanner-primary", "fingerprint": "4240f0f2a55e0a76", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/manual-release.yml"}, "region": {"startLine": 28}}}]}, {"ruleId": "scanner-4240f0f2a55e0a76", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "6a6ad16988f0f123", "scanner": "scanner-primary", "fingerprint": "4240f0f2a55e0a76", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/manual-release.yml"}, "region": {"startLine": 31}}}]}, {"ruleId": "scanner-4240f0f2a55e0a76", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "961030f79282175b", "scanner": "scanner-primary", "fingerprint": "4240f0f2a55e0a76", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/manual-release.yml"}, "region": {"startLine": 46}}}]}, {"ruleId": "scanner-4240f0f2a55e0a76", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "961030f79282175b", "scanner": "scanner-primary", "fingerprint": "4240f0f2a55e0a76", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/manual-release.yml"}, "region": {"startLine": 102}}}]}, {"ruleId": "scanner-4240f0f2a55e0a76", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "6a6ad16988f0f123", "scanner": "scanner-primary", "fingerprint": "4240f0f2a55e0a76", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/manual-release.yml"}, "region": {"startLine": 107}}}]}, {"ruleId": "scanner-4240f0f2a55e0a76", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "6e5d1c0bacbbd11d", "scanner": "scanner-primary", "fingerprint": "4240f0f2a55e0a76", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/manual-release.yml"}, "region": {"startLine": 112}}}]}, {"ruleId": "scanner-4240f0f2a55e0a76", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "2e1f34ad54882fb6", "scanner": "scanner-primary", "fingerprint": "4240f0f2a55e0a76", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/manual-release.yml"}, "region": {"startLine": 121}}}]}, {"ruleId": "scanner-4240f0f2a55e0a76", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "961030f79282175b", "scanner": "scanner-primary", "fingerprint": "4240f0f2a55e0a76", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/manual-release.yml"}, "region": {"startLine": 132}}}]}, {"ruleId": "scanner-4240f0f2a55e0a76", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "b73c61d29221fc63", "scanner": "scanner-primary", "fingerprint": "4240f0f2a55e0a76", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/manual-release.yml"}, "region": {"startLine": 137}}}]}, {"ruleId": "scanner-4240f0f2a55e0a76", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "c151b0e8b35e83bc", "scanner": "scanner-primary", "fingerprint": "4240f0f2a55e0a76", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/manual-release.yml"}, "region": {"startLine": 157}}}]}, {"ruleId": "scanner-b2546c752752c5bc", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "1a9b682b7f455199", "scanner": "scanner-primary", "fingerprint": "b2546c752752c5bc", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/manual-release.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-bf3746f260e930eb", "level": "note", "message": {"text": "Very large file: pkg/claude/conv/watch.go (1995 lines)"}, "properties": {"repobilityId": "1f4b7945412125dc", "scanner": "scanner-primary", "fingerprint": "bf3746f260e930eb", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-9994f16095d478aa", "level": "note", "message": {"text": "Very large file: pkg/claude/common/db/agent.go (1582 lines)"}, "properties": {"repobilityId": "8691e76f01465d87", "scanner": "scanner-primary", "fingerprint": "9994f16095d478aa", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-10e76d91d1a23efb", "level": "note", "message": {"text": "Very large file: pkg/claude/common/db/migrate.go (2656 lines)"}, "properties": {"repobilityId": "01175474a7634ced", "scanner": "scanner-primary", "fingerprint": "10e76d91d1a23efb", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-c6c402f49743a557", "level": "note", "message": {"text": "Very large file: pkg/claude/agent/groups.go (1620 lines)"}, "properties": {"repobilityId": "b37d74711729ee0b", "scanner": "scanner-primary", "fingerprint": "c6c402f49743a557", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-3364bbfd4d3e2cd9", "level": "note", "message": {"text": "Very large file: pkg/claude/session/hook_callback.go (1416 lines)"}, "properties": {"repobilityId": "198dda92b4e7909c", "scanner": "scanner-primary", "fingerprint": "3364bbfd4d3e2cd9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-879a49e275508db7", "level": "note", "message": {"text": "Very large file: pkg/claude/agentd/handlers.go (2927 lines)"}, "properties": {"repobilityId": "46e11666377b1c26", "scanner": "scanner-primary", "fingerprint": "879a49e275508db7", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-cb9bc40386ddb209", "level": "note", "message": {"text": "Very large file: pkg/claude/agentd/dashboard.go (1415 lines)"}, "properties": {"repobilityId": "5e6692e2e6da07c7", "scanner": "scanner-primary", "fingerprint": "cb9bc40386ddb209", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-7e4589f2f4376b9d", "level": "note", "message": {"text": "Very large file: pkg/claude/agentd/dashboard_edit.go (1442 lines)"}, "properties": {"repobilityId": "2fb6c262eb0504f6", "scanner": "scanner-primary", "fingerprint": "7e4589f2f4376b9d", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-043315cd86eeb769", "level": "note", "message": {"text": "Very large file: pkg/claude/agentd/lifecycle.go (1767 lines)"}, "properties": {"repobilityId": "211aab2a0dc49c1e", "scanner": "scanner-primary", "fingerprint": "043315cd86eeb769", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-70e4571849dd7a6a", "level": "note", "message": {"text": "Very large file: pkg/claude/agentd/dashboard/js/refresh.js (2146 lines)"}, "properties": {"repobilityId": "b6884757e3d27181", "scanner": "scanner-primary", "fingerprint": "70e4571849dd7a6a", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-e6acfa574240410e", "level": "note", "message": {"text": "Very large file: pkg/claude/agentd/dashboard/js/row-actions.js (1406 lines)"}, "properties": {"repobilityId": "050ee8e6df4ee32f", "scanner": "scanner-primary", "fingerprint": "e6acfa574240410e", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "783df57f661024e9", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "2bd1e53f07c153c6", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-11825279136b53a3", "level": "warning", "message": {"text": "CI is configured but no tests are detected"}, "properties": {"repobilityId": "4e5e4a2daab8379f", "scanner": "scanner-primary", "fingerprint": "11825279136b53a3", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["tests", "ci", "config-theater", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-749d4bc1bd66df5f", "level": "warning", "message": {"text": "Agent instructions exist but release-hardening basics are missing"}, "properties": {"repobilityId": "60b26f60fae6e0d2", "scanner": "scanner-primary", "fingerprint": "749d4bc1bd66df5f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "f1acf7ea47fd52a5", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "bc6988e75609a1ab", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-d6cb3500c6bf6f84", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: pkg/claude/agent/skills/agent-rename/SKILL.md"}, "properties": {"repobilityId": "572a93c8c7cea115", "scanner": "scanner-primary", "fingerprint": "d6cb3500c6bf6f84", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pkg/claude/agent/skills/agent-rename/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8934fedfa77aa4a0", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: pkg/claude/agent/skills/agent-schedule/SKILL.md"}, "properties": {"repobilityId": "4a4183007ecd3888", "scanner": "scanner-primary", "fingerprint": "8934fedfa77aa4a0", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pkg/claude/agent/skills/agent-schedule/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7c0fc2d75e26ffe0", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: pkg/claude/agent/skills/agent-coord/SKILL.md"}, "properties": {"repobilityId": "14c619a4b49f6bf9", "scanner": "scanner-primary", "fingerprint": "7c0fc2d75e26ffe0", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pkg/claude/agent/skills/agent-coord/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2ae8a436e6352d72", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: pkg/claude/agent/skills/agent-dir/SKILL.md"}, "properties": {"repobilityId": "33fb8a60591cfe74", "scanner": "scanner-primary", "fingerprint": "2ae8a436e6352d72", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pkg/claude/agent/skills/agent-dir/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e54eabe094a25a5f", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: pkg/claude/agent/skills/human-notify/SKILL.md"}, "properties": {"repobilityId": "f6e5495b0e08f16f", "scanner": "scanner-primary", "fingerprint": "e54eabe094a25a5f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pkg/claude/agent/skills/human-notify/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7fda05d871d10af8", "level": "none", "message": {"text": "Commented-code block (9 lines) in pkg/claude/agentd/dashboard/js/slop-audio.js:15"}, "properties": {"repobilityId": "bb6fd3b20c809463", "scanner": "scanner-primary", "fingerprint": "7fda05d871d10af8", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-7135e15514910c0a", "level": "none", "message": {"text": "Commented-code block (5 lines) in pkg/claude/agentd/dashboard/js/plugins.js:4"}, "properties": {"repobilityId": "b961158e2ec74c74", "scanner": "scanner-primary", "fingerprint": "7135e15514910c0a", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-cba3f345c15fdde9", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 pkg/claude/agentd/dashboard/js/plugins.js:338"}, "properties": {"repobilityId": "5f3a811519461ede", "scanner": "scanner-primary", "fingerprint": "cba3f345c15fdde9", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-ac7a7f4cfc5ca2bf", "level": "none", "message": {"text": "Commented-code block (5 lines) in pkg/claude/agentd/dashboard/js/vegas.js:7"}, "properties": {"repobilityId": "aa2b8cbc6f68bfaf", "scanner": "scanner-primary", "fingerprint": "ac7a7f4cfc5ca2bf", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-3f566ad87338866d", "level": "none", "message": {"text": "Commented-code block (6 lines) in pkg/claude/agentd/dashboard/js/costs.js:4"}, "properties": {"repobilityId": "50f9fa1cbdcccfa5", "scanner": "scanner-primary", "fingerprint": "3f566ad87338866d", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-a482c5283e3ae8af", "level": "none", "message": {"text": "Commented-code block (6 lines) in pkg/claude/agentd/dashboard/js/helpers.js:3"}, "properties": {"repobilityId": "6e04b3e3674f3796", "scanner": "scanner-primary", "fingerprint": "a482c5283e3ae8af", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-2dce72ce28b57a8b", "level": "none", "message": {"text": "Commented-code block (9 lines) in pkg/claude/agentd/dashboard/js/slop-fx.js:4"}, "properties": {"repobilityId": "4ff7f717995425b7", "scanner": "scanner-primary", "fingerprint": "2dce72ce28b57a8b", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-a8c4bedffec7ffc6", "level": "none", "message": {"text": "Commented-code block (6 lines) in pkg/claude/agentd/dashboard/js/refresh.js:20"}, "properties": {"repobilityId": "4b54bd99d3e3fa82", "scanner": "scanner-primary", "fingerprint": "a8c4bedffec7ffc6", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-b0cafd43f6193cbd", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 pkg/claude/agentd/dashboard/js/refresh.js:925"}, "properties": {"repobilityId": "f1bbfa38a6225fdc", "scanner": "scanner-primary", "fingerprint": "b0cafd43f6193cbd", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-9ad8bb9ff7ed84e5", "level": "none", "message": {"text": "Commented-code block (5 lines) in pkg/claude/agentd/dashboard/js/slop-credits.js:6"}, "properties": {"repobilityId": "2a45c9d69e041326", "scanner": "scanner-primary", "fingerprint": "9ad8bb9ff7ed84e5", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-7dc744daa07923f4", "level": "none", "message": {"text": "Commented-code block (6 lines) in pkg/claude/agentd/dashboard/js/modal-spawn.js:21"}, "properties": {"repobilityId": "faead850df7d11c2", "scanner": "scanner-primary", "fingerprint": "7dc744daa07923f4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-807452656ed63f62", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 pkg/claude/agentd/dashboard/js/modal-spawn.js:643"}, "properties": {"repobilityId": "ba9e6c788e5fc323", "scanner": "scanner-primary", "fingerprint": "807452656ed63f62", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-f412ac7b9b3d6717", "level": "none", "message": {"text": "Commented-code block (6 lines) in pkg/claude/agentd/dashboard/js/row-actions.js:36"}, "properties": {"repobilityId": "fee8593db15b4233", "scanner": "scanner-primary", "fingerprint": "f412ac7b9b3d6717", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-bd5be59c979a2a01", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 pkg/claude/agentd/dashboard/js/row-actions.js:231"}, "properties": {"repobilityId": "56a0275730608e25", "scanner": "scanner-primary", "fingerprint": "bd5be59c979a2a01", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-39f9172b0bece5a1", "level": "none", "message": {"text": "Commented-code block (5 lines) in pkg/claude/agentd/dashboard/js/dashboard.js:46"}, "properties": {"repobilityId": "682343d2eed6d5d7", "scanner": "scanner-primary", "fingerprint": "39f9172b0bece5a1", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-674e620c00ee06be", "level": "none", "message": {"text": "Commented-code block (5 lines) in pkg/claude/agentd/dashboard/js/virtual-groups.js:3"}, "properties": {"repobilityId": "c419a6b7b1c48b91", "scanner": "scanner-primary", "fingerprint": "674e620c00ee06be", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-f69a8fffe56f115a", "level": "none", "message": {"text": "Commented-code block (5 lines) in pkg/claude/agentd/dashboard/js/modal-cron.js:9"}, "properties": {"repobilityId": "699d330c58a8186c", "scanner": "scanner-primary", "fingerprint": "f69a8fffe56f115a", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-d613b74dc4c37a59", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 pkg/claude/agentd/dashboard/js/modal-cron.js:549"}, "properties": {"repobilityId": "0301aea8872c02f9", "scanner": "scanner-primary", "fingerprint": "d613b74dc4c37a59", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-23bc666e75d07560", "level": "none", "message": {"text": "Commented-code block (6 lines) in pkg/claude/agentd/dashboard/js/render.js:16"}, "properties": {"repobilityId": "14fdd6cc97d41917", "scanner": "scanner-primary", "fingerprint": "23bc666e75d07560", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-7a66c20722ce9972", "level": "none", "message": {"text": "Commented-code block (8 lines) in pkg/claude/agentd/dashboard/js/prefs.js:6"}, "properties": {"repobilityId": "521544aaecf58b3b", "scanner": "scanner-primary", "fingerprint": "7a66c20722ce9972", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-fc017eca4d6b5c7f", "level": "none", "message": {"text": "Commented-code block (10 lines) in pkg/claude/agentd/dashboard/js/config.js:8"}, "properties": {"repobilityId": "d6528a56e764f3e0", "scanner": "scanner-primary", "fingerprint": "fc017eca4d6b5c7f", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-5992d08b70e8ce4a", "level": "none", "message": {"text": "Commented-code block (8 lines) in pkg/claude/agentd/dashboard/js/tabs.js:20"}, "properties": {"repobilityId": "3b6beda8c1aaeac4", "scanner": "scanner-primary", "fingerprint": "5992d08b70e8ce4a", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-a1fede78da98df49", "level": "none", "message": {"text": "Commented-code block (8 lines) in pkg/claude/agentd/dashboard/js/modal-message.js:24"}, "properties": {"repobilityId": "0d580e14452de6e2", "scanner": "scanner-primary", "fingerprint": "a1fede78da98df49", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-d79f875bebfbe4d6", "level": "none", "message": {"text": "Commented-code block (8 lines) in pkg/claude/agentd/dashboard/js/slop-volume.js:3"}, "properties": {"repobilityId": "24a0d3e3af3815fd", "scanner": "scanner-primary", "fingerprint": "d79f875bebfbe4d6", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-81c2d6174c366561", "level": "none", "message": {"text": "Commented-code block (7 lines) in pkg/claude/agentd/dashboard/js/dnd.js:25"}, "properties": {"repobilityId": "6dab5e87004e277a", "scanner": "scanner-primary", "fingerprint": "81c2d6174c366561", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-0d0dfa23940bcd5a", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 pkg/claude/agentd/dashboard/js/dnd.js:292"}, "properties": {"repobilityId": "39f16f5099611495", "scanner": "scanner-primary", "fingerprint": "0d0dfa23940bcd5a", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-9bd5150ba5817521", "level": "none", "message": {"text": "Commented-code block (5 lines) in pkg/claude/agentd/dashboard/js/modal-link-wt.js:155"}, "properties": {"repobilityId": "86d9d035ca5bf8a9", "scanner": "scanner-primary", "fingerprint": "9bd5150ba5817521", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-b2f3c2e99e3dd617", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 pkg/claude/agentd/dashboard/js/modal-link-wt.js:123"}, "properties": {"repobilityId": "807c5ad8c2136aff", "scanner": "scanner-primary", "fingerprint": "b2f3c2e99e3dd617", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-ced16f69644e3ea9", "level": "none", "message": {"text": "Commented-code block (5 lines) in pkg/claude/agentd/dashboard/js/slop.js:1"}, "properties": {"repobilityId": "78970b2770735907", "scanner": "scanner-primary", "fingerprint": "ced16f69644e3ea9", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-39c3089a3208924a", "level": "none", "message": {"text": "Commented-code block (5 lines) in pkg/claude/agentd/dashboard/js/sort.js:3"}, "properties": {"repobilityId": "e6b28ea0fcc8569a", "scanner": "scanner-primary", "fingerprint": "39c3089a3208924a", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-651d7c76a80c7dc4", "level": "none", "message": {"text": "Commented-code block (8 lines) in pkg/claude/agentd/dashboard/js/modal-templates.js:421"}, "properties": {"repobilityId": "d586426462e850e8", "scanner": "scanner-primary", "fingerprint": "651d7c76a80c7dc4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-0842aad810a81092", "level": "none", "message": {"text": "Commented-code block (9 lines) in pkg/claude/agentd/dashboard/js/slop-spectacle.js:6"}, "properties": {"repobilityId": "d66ae85b4e0dd694", "scanner": "scanner-primary", "fingerprint": "0842aad810a81092", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}]}]}