{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-b2a116fd55805504", "name": "Stray `console.log` in TS/JS \u2014 agents/datamapper-agent/scripts/download-filebox.js:79", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 agents/datamapper-agent/scripts/download-filebox.js:79"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9aa1b86acdd4683d", "name": "Stray `console.log` in TS/JS \u2014 agents/datamapper-agent/scripts/validate-spec.js:220", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 agents/datamapper-agent/scripts/validate-spec.js:220"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1c42d3ddd24e3557", "name": "Stray `console.log` in TS/JS \u2014 agents/dashboard-agent/scripts/api-put-widget.js:154", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 agents/dashboard-agent/scripts/api-put-widget.js:154"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a0bfadc571bdd4cd", "name": "Stray `console.log` in TS/JS \u2014 agents/dashboard-agent/scripts/grid-engine.js:461", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 agents/dashboard-agent/scripts/grid-engine.js:461"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9bbfaa179cfe28e5", "name": "Stray `console.log` in TS/JS \u2014 scripts/gen-server-maps.js:53", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 scripts/gen-server-maps.js:53"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0af779e8e8d32574", "name": "Stray `console.log` in TS/JS \u2014 scripts/check-frontend-syntax.js:32", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 scripts/check-frontend-syntax.js:32"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-96c61b8a71951a72", "name": "Stray `console.log` in TS/JS \u2014 scripts/gen-update-keypair.js:42", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 scripts/gen-update-keypair.js:42"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6e85a5dbe58abc9a", "name": "Stray `console.log` in TS/JS \u2014 scripts/sign-manifest.js:56", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 scripts/sign-manifest.js:56"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e6ba9f7f5146b91f", "name": "Stray `console.log` in TS/JS \u2014 scripts/lint-agent-paths.js:75", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 scripts/lint-agent-paths.js:75"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-048c7dc9741671cb", "name": "Stray `console.log` in TS/JS \u2014 lib/log.js:66", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 lib/log.js:66"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-74c17930f791ce83", "name": "Insecure pattern 'exec_used' in server.js:1475", "shortDescription": {"text": "Insecure pattern 'exec_used' in server.js:1475"}, "fullDescription": {"text": "Found a known-risky pattern (exec_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-0c73ab9a1d129520", "name": "Insecure pattern 'node_child_process' in server.js:6", "shortDescription": {"text": "Insecure pattern 'node_child_process' in server.js:6"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2cb045ce513d85b1", "name": "Insecure pattern 'node_child_process' in agents/datamapper-agent/scripts/download-filebox.js:17", "shortDescription": {"text": "Insecure pattern 'node_child_process' in agents/datamapper-agent/scripts/download-filebox.js:17"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5e319bebc6d132ca", "name": "Insecure pattern 'node_child_process' in scripts/check-frontend-syntax.js:10", "shortDescription": {"text": "Insecure pattern 'node_child_process' in scripts/check-frontend-syntax.js:10"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-444c69113366262b", "name": "Insecure pattern 'node_child_process' in scripts/gen-update-keypair.js:14", "shortDescription": {"text": "Insecure pattern 'node_child_process' in scripts/gen-update-keypair.js:14"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-397e942967fc0bb8", "name": "Insecure pattern 'exec_used' in packaging/open-browser.js:59", "shortDescription": {"text": "Insecure pattern 'exec_used' in packaging/open-browser.js:59"}, "fullDescription": {"text": "Found a known-risky pattern (exec_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-191c0dc88e092cc7", "name": "Insecure pattern 'node_child_process' in packaging/open-browser.js:5", "shortDescription": {"text": "Insecure pattern 'node_child_process' in packaging/open-browser.js:5"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e7817c16d9a4afa1", "name": "Insecure pattern 'node_child_process' in lib/server-lock.js:26", "shortDescription": {"text": "Insecure pattern 'node_child_process' in lib/server-lock.js:26"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-64fed30fe0456203", "name": "Insecure pattern 'node_child_process' in lib/virtual-desktop.js:1", "shortDescription": {"text": "Insecure pattern 'node_child_process' in lib/virtual-desktop.js:1"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-aa51e8407e568384", "name": "Insecure pattern 'node_child_process' in lib/dr-cli.js:1", "shortDescription": {"text": "Insecure pattern 'node_child_process' in lib/dr-cli.js:1"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6f05d41c5e31608e", "name": "Insecure pattern 'node_child_process' in lib/tray.js:1", "shortDescription": {"text": "Insecure pattern 'node_child_process' in lib/tray.js:1"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-071619e33a5702f1", "name": "Insecure pattern 'node_child_process' in lib/workspace.js:4", "shortDescription": {"text": "Insecure pattern 'node_child_process' in lib/workspace.js:4"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-69a6873db5740385", "name": "Insecure pattern 'node_child_process' in lib/run-command.js:1", "shortDescription": {"text": "Insecure pattern 'node_child_process' in lib/run-command.js:1"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-879a06790ba2eb8e", "name": "Insecure pattern 'node_child_process' in lib/chrome.js:1", "shortDescription": {"text": "Insecure pattern 'node_child_process' in lib/chrome.js:1"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d1ada6b80415e6f1", "name": "Possible secret in lib/auth.js", "shortDescription": {"text": "Possible secret in lib/auth.js"}, "fullDescription": {"text": "Detected pattern matching password_literal. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-f9054dbb9353d245", "name": "Insecure pattern 'exec_used' in lib/auth.js:168", "shortDescription": {"text": "Insecure pattern 'exec_used' in lib/auth.js:168"}, "fullDescription": {"text": "Found a known-risky pattern (exec_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-93510b2a4ec6ff7c", "name": "Insecure pattern 'node_child_process' in lib/auth.js:5", "shortDescription": {"text": "Insecure pattern 'node_child_process' in lib/auth.js:5"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ade9591ec5aa05e1", "name": "Insecure pattern 'node_child_process' in lib/restart.js:31", "shortDescription": {"text": "Insecure pattern 'node_child_process' in lib/restart.js:31"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d5e397815703be8a", "name": "Insecure pattern 'node_child_process' in lib/sessions.js:1", "shortDescription": {"text": "Insecure pattern 'node_child_process' in lib/sessions.js:1"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6956ccd23c67bcf6", "name": "Insecure pattern 'direct_innerhtml_assignment' in public/js/diagnostics.mjs:16", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in public/js/diagnostics.mjs:16"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f1a0eec86b6d9e4e", "name": "Insecure pattern 'direct_innerhtml_assignment' in public/js/update.mjs:70", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in public/js/update.mjs:70"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6f3672280a4e07fd", "name": "Insecure pattern 'direct_innerhtml_assignment' in public/js/cleanup.mjs:25", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in public/js/cleanup.mjs:25"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3acda4b20000e596", "name": "Insecure pattern 'direct_innerhtml_assignment' in public/js/orgroster.mjs:45", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in public/js/orgroster.mjs:45"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-711e20e42b04de95", "name": "Insecure pattern 'direct_innerhtml_assignment' in public/js/cli-tools.mjs:29", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in public/js/cli-tools.mjs:29"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d70b4fc0f2728172", "name": "Insecure pattern 'direct_innerhtml_assignment' in public/js/settings.mjs:35", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in public/js/settings.mjs:35"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a5270732c6983426", "name": "Insecure pattern 'direct_innerhtml_assignment' in public/js/restart.mjs:14", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in public/js/restart.mjs:14"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-33d2d73fd78b9a1f", "name": "Insecure pattern 'direct_innerhtml_assignment' in public/js/main.mjs:136", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in public/js/main.mjs:136"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-27924aa79fa4a517", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/upload-artifact@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-191d6b92595141db", "name": "Very large file: server.js (1484 lines)", "shortDescription": {"text": "Very large file: server.js (1484 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a6af47f40a0b62d1", "name": "Very large file: public/js/main.mjs (2453 lines)", "shortDescription": {"text": "Very large file: public/js/main.mjs (2453 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-141b30a41e03817b", "name": "No license file detected", "shortDescription": {"text": "No license file detected"}, "fullDescription": {"text": "No LICENSE/COPYING/NOTICE file was found. Generated repositories often omit licensing, which blocks reuse and automated intake."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 35 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-749d4bc1bd66df5f", "name": "Agent instructions exist but release-hardening basics are missing", "shortDescription": {"text": "Agent instructions exist but release-hardening basics are missing"}, "fullDescription": {"text": "AI-coder instruction files were found, but the repo is missing license. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-28cdbe61a5893a3d", "name": "Agent authority lacks a verifier contract: agents/dashboard-agent/CLAUDE.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: agents/dashboard-agent/CLAUDE.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-526136b19aebf73b", "name": "Commented-code block (5 lines) in server.js:337", "shortDescription": {"text": "Commented-code block (5 lines) in server.js:337"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-cab8db007eb34704", "name": "Commented-code block (5 lines) in tests/run-command.test.js:10", "shortDescription": {"text": "Commented-code block (5 lines) in tests/run-command.test.js:10"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-06f5e9f76c1c6e58", "name": "Legacy-named symbol `reusedLegacy` in tests/slug.test.js:107", "shortDescription": {"text": "Legacy-named symbol `reusedLegacy` in tests/slug.test.js:107"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a36e8df8aadf0251", "name": "Commented-code block (5 lines) in tests/virtual-desktop.test.js:15", "shortDescription": {"text": "Commented-code block (5 lines) in tests/virtual-desktop.test.js:15"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-0d21487f2d04ff9f", "name": "Commented-code block (6 lines) in tests/esc.test.js:4", "shortDescription": {"text": "Commented-code block (6 lines) in tests/esc.test.js:4"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-d4a7a7c6f6d365a8", "name": "Legacy-named symbol `reusedLegacy` in tests/org-launch.test.js:90", "shortDescription": {"text": "Legacy-named symbol `reusedLegacy` in tests/org-launch.test.js:90"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c24a646f05fc2094", "name": "Commented-code block (5 lines) in scripts/check-frontend-syntax.js:3", "shortDescription": {"text": "Commented-code block (5 lines) in scripts/check-frontend-syntax.js:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-e20338252a954682", "name": "Commented-code block (5 lines) in scripts/gen-update-keypair.js:5", "shortDescription": {"text": "Commented-code block (5 lines) in scripts/gen-update-keypair.js:5"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-36457167f002dd95", "name": "Commented-code block (5 lines) in packaging/open-browser.js:76", "shortDescription": {"text": "Commented-code block (5 lines) in packaging/open-browser.js:76"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-fe441fab71e6e103", "name": "Commented-code block (6 lines) in lib/identity.js:37", "shortDescription": {"text": "Commented-code block (6 lines) in lib/identity.js:37"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-8eb3ea728a2d9dfe", "name": "Commented-code block (14 lines) in lib/server-lock.js:3", "shortDescription": {"text": "Commented-code block (14 lines) in lib/server-lock.js:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-489fa21151d1cb11", "name": "Commented-code block (6 lines) in lib/atomic-write.js:4", "shortDescription": {"text": "Commented-code block (6 lines) in lib/atomic-write.js:4"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-dc7427393d152ca9", "name": "Legacy-named symbol `reusedLegacy` in lib/org-launch.js:139", "shortDescription": {"text": "Legacy-named symbol `reusedLegacy` in lib/org-launch.js:139"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d96e77c2a9fbcea3", "name": "Commented-code block (12 lines) in lib/org-launch.js:6", "shortDescription": {"text": "Commented-code block (12 lines) in lib/org-launch.js:6"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-53a9d7133e615b7f", "name": "Commented-code block (7 lines) in lib/net-acquire.js:3", "shortDescription": {"text": "Commented-code block (7 lines) in lib/net-acquire.js:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-36729b9f788214b8", "name": "Commented-code block (5 lines) in lib/update-fetch.js:1", "shortDescription": {"text": "Commented-code block (5 lines) in lib/update-fetch.js:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-33173764aaad63d0", "name": "Commented-code block (5 lines) in lib/dr-cli.js:154", "shortDescription": {"text": "Commented-code block (5 lines) in lib/dr-cli.js:154"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-eed460c65d181e76", "name": "Commented-code block (9 lines) in lib/log.js:100", "shortDescription": {"text": "Commented-code block (9 lines) in lib/log.js:100"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-5c74f26a716ca79d", "name": "Commented-code block (7 lines) in lib/launch-tokens.js:3", "shortDescription": {"text": "Commented-code block (7 lines) in lib/launch-tokens.js:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-fe8daf1e98f7bcc0", "name": "Commented-code block (6 lines) in lib/launch-identity.js:6", "shortDescription": {"text": "Commented-code block (6 lines) in lib/launch-identity.js:6"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-6490e2b81c8ebfc3", "name": "Commented-code block (8 lines) in lib/slug.js:11", "shortDescription": {"text": "Commented-code block (8 lines) in lib/slug.js:11"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-c5759228e9c6b1c1", "name": "Commented-code block (5 lines) in lib/auth-health.js:26", "shortDescription": {"text": "Commented-code block (5 lines) in lib/auth-health.js:26"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-b1704d5f4142b0db", "name": "Legacy-named symbol `reusedLegacy` in lib/slug-lookup.js:40", "shortDescription": {"text": "Legacy-named symbol `reusedLegacy` in lib/slug-lookup.js:40"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-37b9774efb10ac3c", "name": "Commented-code block (6 lines) in lib/slug-lookup.js:5", "shortDescription": {"text": "Commented-code block (6 lines) in lib/slug-lookup.js:5"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-c92d944c9953d5a5", "name": "Commented-code block (10 lines) in lib/run-command.js:7", "shortDescription": {"text": "Commented-code block (10 lines) in lib/run-command.js:7"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-eb56ae66e0730850", "name": "Commented-code block (5 lines) in lib/agents.js:183", "shortDescription": {"text": "Commented-code block (5 lines) in lib/agents.js:183"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-f1275e3aa5a3ec40", "name": "Commented-code block (7 lines) in lib/path-safety.js:9", "shortDescription": {"text": "Commented-code block (7 lines) in lib/path-safety.js:9"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-9c072f45086b4781", "name": "Commented-code block (5 lines) in lib/update-policy.js:3", "shortDescription": {"text": "Commented-code block (5 lines) in lib/update-policy.js:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-b85ee6f4bb0de577", "name": "Legacy-named symbol `reusedLegacy` in lib/org-launch-route.js:90", "shortDescription": {"text": "Legacy-named symbol `reusedLegacy` in lib/org-launch-route.js:90"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4cb9dc9e5be01a98", "name": "Commented-code block (12 lines) in lib/org-launch-route.js:6", "shortDescription": {"text": "Commented-code block (12 lines) in lib/org-launch-route.js:6"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-e8f32c04931faa8b", "name": "Commented-code block (5 lines) in lib/cookie.js:1", "shortDescription": {"text": "Commented-code block (5 lines) in lib/cookie.js:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-41f44f893cbe7f6a", "name": "Commented-code block (5 lines) in lib/auth.js:70", "shortDescription": {"text": "Commented-code block (5 lines) in lib/auth.js:70"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-9822cf302c886cd9", "name": "Commented-code block (10 lines) in lib/restart.js:16", "shortDescription": {"text": "Commented-code block (10 lines) in lib/restart.js:16"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-45ac69ed232016d0", "name": "Commented-code block (6 lines) in tests-e2e/server.mjs:1", "shortDescription": {"text": "Commented-code block (6 lines) in tests-e2e/server.mjs:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-119f43f6da5908c4", "name": "Commented-code block (5 lines) in public/js/rowstate.mjs:16", "shortDescription": {"text": "Commented-code block (5 lines) in public/js/rowstate.mjs:16"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-a712e77fdcf5b7d9", "name": "Commented-code block (7 lines) in public/js/diagnostics.mjs:5", "shortDescription": {"text": "Commented-code block (7 lines) in public/js/diagnostics.mjs:5"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-75d0ae391a09fb9f", "name": "Commented-code block (7 lines) in public/js/api.mjs:1", "shortDescription": {"text": "Commented-code block (7 lines) in public/js/api.mjs:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-070b5379a9fa0b32", "name": "Commented-code block (6 lines) in public/js/update.mjs:1", "shortDescription": {"text": "Commented-code block (6 lines) in public/js/update.mjs:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-1a9345e1ba8c7a2b", "name": "Commented-code block (5 lines) in public/js/dropdown.mjs:1", "shortDescription": {"text": "Commented-code block (5 lines) in public/js/dropdown.mjs:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-5c6127895b5694aa", "name": "Commented-code block (5 lines) in public/js/orgroster.mjs:5", "shortDescription": {"text": "Commented-code block (5 lines) in public/js/orgroster.mjs:5"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-f2c0aeb512b0885d", "name": "Commented-code block (7 lines) in public/js/cli-tools.mjs:5", "shortDescription": {"text": "Commented-code block (7 lines) in public/js/cli-tools.mjs:5"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-8ed309337a6cf397", "name": "`fetch()` without try/.catch or AbortSignal \u2014 public/js/cli-tools.mjs:75", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 public/js/cli-tools.mjs:75"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d1f1082a99972497", "name": "Commented-code block (9 lines) in public/js/settings.mjs:5", "shortDescription": {"text": "Commented-code block (9 lines) in public/js/settings.mjs:5"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-21b2cffe472c825e", "name": "Commented-code block (7 lines) in public/js/main.mjs:83", "shortDescription": {"text": "Commented-code block (7 lines) in public/js/main.mjs:83"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-0ac64b6cc5fc591f", "name": "`fetch()` without try/.catch or AbortSignal \u2014 public/js/main.mjs:138", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 public/js/main.mjs:138"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-10a74c59422443f1", "name": "Commented-code block (5 lines) in public/js/prereqs.mjs:1", "shortDescription": {"text": "Commented-code block (5 lines) in public/js/prereqs.mjs:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-5baa8971ebe192a1", "name": "Unused endpoint: GET /", "shortDescription": {"text": "Unused endpoint: GET /"}, "fullDescription": {"text": "`server.js` declares `GET /` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f1c12077ee7ef0d2", "name": "Unused endpoint: USE /static", "shortDescription": {"text": "Unused endpoint: USE /static"}, "fullDescription": {"text": "`server.js` declares `USE /static` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1480187b44a5fd90", "name": "Unused endpoint: GET /auth/callback", "shortDescription": {"text": "Unused endpoint: GET /auth/callback"}, "fullDescription": {"text": "`server.js` declares `GET /auth/callback` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-562322a28c342d7f", "name": "Unused endpoint: GET /api/auth/status", "shortDescription": {"text": "Unused endpoint: GET /api/auth/status"}, "fullDescription": {"text": "`server.js` declares `GET /api/auth/status` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4756b4c4da7d2088", "name": "Unused endpoint: GET /api/health", "shortDescription": {"text": "Unused endpoint: GET /api/health"}, "fullDescription": {"text": "`server.js` declares `GET /api/health` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-17db1ff43849fc59", "name": "Unused endpoint: GET /api/update-check", "shortDescription": {"text": "Unused endpoint: GET /api/update-check"}, "fullDescription": {"text": "`server.js` declares `GET /api/update-check` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5c8fcfd1fb18a7c8", "name": "Unused endpoint: GET /api/cli/install", "shortDescription": {"text": "Unused endpoint: GET /api/cli/install"}, "fullDescription": {"text": "`server.js` declares `GET /api/cli/install` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ee3024ecbb71f73d", "name": "Unused endpoint: GET /api/servers", "shortDescription": {"text": "Unused endpoint: GET /api/servers"}, "fullDescription": {"text": "`server.js` declares `GET /api/servers` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f3bf72f059406b13", "name": "Unused endpoint: GET /api/logs", "shortDescription": {"text": "Unused endpoint: GET /api/logs"}, "fullDescription": {"text": "`server.js` declares `GET /api/logs` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-379b09f9de636500", "name": "Unused endpoint: GET /api/settings", "shortDescription": {"text": "Unused endpoint: GET /api/settings"}, "fullDescription": {"text": "`server.js` declares `GET /api/settings` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e14186867a1f8a88", "name": "Unused endpoint: POST /api/settings", "shortDescription": {"text": "Unused endpoint: POST /api/settings"}, "fullDescription": {"text": "`server.js` declares `POST /api/settings` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ccb5c92d24b19c26", "name": "Unused endpoint: POST /api/refresh", "shortDescription": {"text": "Unused endpoint: POST /api/refresh"}, "fullDescription": {"text": "`server.js` declares `POST /api/refresh` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bdb8ebb5103a4d1f", "name": "Unused endpoint: GET /api/recents", "shortDescription": {"text": "Unused endpoint: GET /api/recents"}, "fullDescription": {"text": "`server.js` declares `GET /api/recents` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f76535c12b518739", "name": "Unused endpoint: POST /api/recents", "shortDescription": {"text": "Unused endpoint: POST /api/recents"}, "fullDescription": {"text": "`server.js` declares `POST /api/recents` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a6003b5e1b49c691", "name": "Unused endpoint: POST /api/sync/init", "shortDescription": {"text": "Unused endpoint: POST /api/sync/init"}, "fullDescription": {"text": "`server.js` declares `POST /api/sync/init` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9331fd384ba44a82", "name": "Unused endpoint: POST /api/sync", "shortDescription": {"text": "Unused endpoint: POST /api/sync"}, "fullDescription": {"text": "`server.js` declares `POST /api/sync` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c3cdecb263117dff", "name": "Unused endpoint: GET /api/sync/status", "shortDescription": {"text": "Unused endpoint: GET /api/sync/status"}, "fullDescription": {"text": "`server.js` declares `GET /api/sync/status` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c4b0361ac0f5eeb9", "name": "Unused endpoint: GET /api/agents", "shortDescription": {"text": "Unused endpoint: GET /api/agents"}, "fullDescription": {"text": "`server.js` declares `GET /api/agents` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bf2e6e2188a510ee", "name": "Unused endpoint: GET /api/sessions", "shortDescription": {"text": "Unused endpoint: GET /api/sessions"}, "fullDescription": {"text": "`server.js` declares `GET /api/sessions` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-702add13cde847c5", "name": "Unused endpoint: GET /api/sessions/health", "shortDescription": {"text": "Unused endpoint: GET /api/sessions/health"}, "fullDescription": {"text": "`server.js` declares `GET /api/sessions/health` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e383ce0fe70c3e68", "name": "Unused endpoint: POST /api/auth-health/check", "shortDescription": {"text": "Unused endpoint: POST /api/auth-health/check"}, "fullDescription": {"text": "`server.js` declares `POST /api/auth-health/check` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-13565b300e28581f", "name": "Unused endpoint: GET /api/launch-stream", "shortDescription": {"text": "Unused endpoint: GET /api/launch-stream"}, "fullDescription": {"text": "`server.js` declares `GET /api/launch-stream` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-21cf56c09f860b64", "name": "Unused endpoint: GET /index.html", "shortDescription": {"text": "Unused endpoint: GET /index.html"}, "fullDescription": {"text": "`tests-e2e/server.mjs` declares `GET /index.html` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/25078"}, "properties": {"repository": "conorb-DR/dr-launcher", "repoUrl": "https://github.com/conorb-DR/dr-launcher", "branch": "main"}, "results": [{"ruleId": "scanner-b2a116fd55805504", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 agents/datamapper-agent/scripts/download-filebox.js:79"}, "properties": {"repobilityId": "9067d6a779d03e93", "scanner": "scanner-primary", "fingerprint": "b2a116fd55805504", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-9aa1b86acdd4683d", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 agents/datamapper-agent/scripts/validate-spec.js:220"}, "properties": {"repobilityId": "98491b309401a0d3", "scanner": "scanner-primary", "fingerprint": "9aa1b86acdd4683d", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-1c42d3ddd24e3557", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 agents/dashboard-agent/scripts/api-put-widget.js:154"}, "properties": {"repobilityId": "337c7f81f715bf36", "scanner": "scanner-primary", "fingerprint": "1c42d3ddd24e3557", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-a0bfadc571bdd4cd", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 agents/dashboard-agent/scripts/grid-engine.js:461"}, "properties": {"repobilityId": "28d64597607a6553", "scanner": "scanner-primary", "fingerprint": "a0bfadc571bdd4cd", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-9bbfaa179cfe28e5", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 scripts/gen-server-maps.js:53"}, "properties": {"repobilityId": "087dceb35d8bc2da", "scanner": "scanner-primary", "fingerprint": "9bbfaa179cfe28e5", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-0af779e8e8d32574", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 scripts/check-frontend-syntax.js:32"}, "properties": {"repobilityId": "cf83136cffc91e39", "scanner": "scanner-primary", "fingerprint": "0af779e8e8d32574", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-96c61b8a71951a72", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 scripts/gen-update-keypair.js:42"}, "properties": {"repobilityId": "3ec2cd0f997747af", "scanner": "scanner-primary", "fingerprint": "96c61b8a71951a72", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-6e85a5dbe58abc9a", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 scripts/sign-manifest.js:56"}, "properties": {"repobilityId": "ddfcfa74b4c42cb0", "scanner": "scanner-primary", "fingerprint": "6e85a5dbe58abc9a", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-e6ba9f7f5146b91f", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 scripts/lint-agent-paths.js:75"}, "properties": {"repobilityId": "c52591b4919a7afa", "scanner": "scanner-primary", "fingerprint": "e6ba9f7f5146b91f", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-048c7dc9741671cb", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 lib/log.js:66"}, "properties": {"repobilityId": "0c79fff1228f0c49", "scanner": "scanner-primary", "fingerprint": "048c7dc9741671cb", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-74c17930f791ce83", "level": "error", "message": {"text": "Insecure pattern 'exec_used' in server.js:1475"}, "properties": {"repobilityId": "b39c750257fe94e1", "scanner": "scanner-primary", "fingerprint": "74c17930f791ce83", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "exec_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server.js"}, "region": {"startLine": 1475}}}]}, {"ruleId": "scanner-0c73ab9a1d129520", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in server.js:6"}, "properties": {"repobilityId": "23f3ba0b6e438ed3", "scanner": "scanner-primary", "fingerprint": "0c73ab9a1d129520", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server.js"}, "region": {"startLine": 6}}}]}, {"ruleId": "scanner-2cb045ce513d85b1", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in agents/datamapper-agent/scripts/download-filebox.js:17"}, "properties": {"repobilityId": "ee3686a36ef65542", "scanner": "scanner-primary", "fingerprint": "2cb045ce513d85b1", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "agents/datamapper-agent/scripts/download-filebox.js"}, "region": {"startLine": 17}}}]}, {"ruleId": "scanner-5e319bebc6d132ca", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in scripts/check-frontend-syntax.js:10"}, "properties": {"repobilityId": "21cf61312dabd045", "scanner": "scanner-primary", "fingerprint": "5e319bebc6d132ca", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/check-frontend-syntax.js"}, "region": {"startLine": 10}}}]}, {"ruleId": "scanner-444c69113366262b", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in scripts/gen-update-keypair.js:14"}, "properties": {"repobilityId": "c70266361557ac3c", "scanner": "scanner-primary", "fingerprint": "444c69113366262b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/gen-update-keypair.js"}, "region": {"startLine": 14}}}]}, {"ruleId": "scanner-397e942967fc0bb8", "level": "error", "message": {"text": "Insecure pattern 'exec_used' in packaging/open-browser.js:59"}, "properties": {"repobilityId": "cd21536b4ce5a888", "scanner": "scanner-primary", "fingerprint": "397e942967fc0bb8", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "exec_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packaging/open-browser.js"}, "region": {"startLine": 59}}}]}, {"ruleId": "scanner-191c0dc88e092cc7", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in packaging/open-browser.js:5"}, "properties": {"repobilityId": "33824c6af9b95980", "scanner": "scanner-primary", "fingerprint": "191c0dc88e092cc7", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packaging/open-browser.js"}, "region": {"startLine": 5}}}]}, {"ruleId": "scanner-e7817c16d9a4afa1", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in lib/server-lock.js:26"}, "properties": {"repobilityId": "63dc90e1b3ffa29d", "scanner": "scanner-primary", "fingerprint": "e7817c16d9a4afa1", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "lib/server-lock.js"}, "region": {"startLine": 26}}}]}, {"ruleId": "scanner-64fed30fe0456203", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in lib/virtual-desktop.js:1"}, "properties": {"repobilityId": "8ca62423c23175ca", "scanner": "scanner-primary", "fingerprint": "64fed30fe0456203", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "lib/virtual-desktop.js"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-aa51e8407e568384", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in lib/dr-cli.js:1"}, "properties": {"repobilityId": "38598967c547e40b", "scanner": "scanner-primary", "fingerprint": "aa51e8407e568384", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "lib/dr-cli.js"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6f05d41c5e31608e", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in lib/tray.js:1"}, "properties": {"repobilityId": "ed180ed2f72fc717", "scanner": "scanner-primary", "fingerprint": "6f05d41c5e31608e", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "lib/tray.js"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-071619e33a5702f1", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in lib/workspace.js:4"}, "properties": {"repobilityId": "a9b441ba08a67816", "scanner": "scanner-primary", "fingerprint": "071619e33a5702f1", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "lib/workspace.js"}, "region": {"startLine": 4}}}]}, {"ruleId": "scanner-69a6873db5740385", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in lib/run-command.js:1"}, "properties": {"repobilityId": "7f2c847eada4c90b", "scanner": "scanner-primary", "fingerprint": "69a6873db5740385", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "lib/run-command.js"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-879a06790ba2eb8e", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in lib/chrome.js:1"}, "properties": {"repobilityId": "0fe206063bc760da", "scanner": "scanner-primary", "fingerprint": "879a06790ba2eb8e", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "lib/chrome.js"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d1ada6b80415e6f1", "level": "error", "message": {"text": "Possible secret in lib/auth.js"}, "properties": {"repobilityId": "b351b1766a961e63", "scanner": "scanner-primary", "fingerprint": "d1ada6b80415e6f1", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "lib/auth.js"}, "region": {"startLine": 15}}}]}, {"ruleId": "scanner-f9054dbb9353d245", "level": "error", "message": {"text": "Insecure pattern 'exec_used' in lib/auth.js:168"}, "properties": {"repobilityId": "944745a77602e3af", "scanner": "scanner-primary", "fingerprint": "f9054dbb9353d245", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "exec_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "lib/auth.js"}, "region": {"startLine": 168}}}]}, {"ruleId": "scanner-93510b2a4ec6ff7c", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in lib/auth.js:5"}, "properties": {"repobilityId": "3c31a668d1b50b61", "scanner": "scanner-primary", "fingerprint": "93510b2a4ec6ff7c", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "lib/auth.js"}, "region": {"startLine": 5}}}]}, {"ruleId": "scanner-ade9591ec5aa05e1", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in lib/restart.js:31"}, "properties": {"repobilityId": "8c0cc371b52bc86f", "scanner": "scanner-primary", "fingerprint": "ade9591ec5aa05e1", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "lib/restart.js"}, "region": {"startLine": 31}}}]}, {"ruleId": "scanner-d5e397815703be8a", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in lib/sessions.js:1"}, "properties": {"repobilityId": "3563a419c00d9f60", "scanner": "scanner-primary", "fingerprint": "d5e397815703be8a", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "lib/sessions.js"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6956ccd23c67bcf6", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in public/js/diagnostics.mjs:16"}, "properties": {"repobilityId": "95486f0add93cddc", "scanner": "scanner-primary", "fingerprint": "6956ccd23c67bcf6", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "public/js/diagnostics.mjs"}, "region": {"startLine": 16}}}]}, {"ruleId": "scanner-f1a0eec86b6d9e4e", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in public/js/update.mjs:70"}, "properties": {"repobilityId": "c6094ba8ac734532", "scanner": "scanner-primary", "fingerprint": "f1a0eec86b6d9e4e", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "public/js/update.mjs"}, "region": {"startLine": 70}}}]}, {"ruleId": "scanner-6f3672280a4e07fd", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in public/js/cleanup.mjs:25"}, "properties": {"repobilityId": "37b1d9b4a92b8809", "scanner": "scanner-primary", "fingerprint": "6f3672280a4e07fd", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "public/js/cleanup.mjs"}, "region": {"startLine": 25}}}]}, {"ruleId": "scanner-3acda4b20000e596", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in public/js/orgroster.mjs:45"}, "properties": {"repobilityId": "5221e608270f36c6", "scanner": "scanner-primary", "fingerprint": "3acda4b20000e596", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "public/js/orgroster.mjs"}, "region": {"startLine": 45}}}]}, {"ruleId": "scanner-711e20e42b04de95", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in public/js/cli-tools.mjs:29"}, "properties": {"repobilityId": "bd57b997f189b7ab", "scanner": "scanner-primary", "fingerprint": "711e20e42b04de95", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "public/js/cli-tools.mjs"}, "region": {"startLine": 29}}}]}, {"ruleId": "scanner-d70b4fc0f2728172", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in public/js/settings.mjs:35"}, "properties": {"repobilityId": "263f692427734dcd", "scanner": "scanner-primary", "fingerprint": "d70b4fc0f2728172", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "public/js/settings.mjs"}, "region": {"startLine": 35}}}]}, {"ruleId": "scanner-a5270732c6983426", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in public/js/restart.mjs:14"}, "properties": {"repobilityId": "108ac52b7fb5be3c", "scanner": "scanner-primary", "fingerprint": "a5270732c6983426", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "public/js/restart.mjs"}, "region": {"startLine": 14}}}]}, {"ruleId": "scanner-33d2d73fd78b9a1f", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in public/js/main.mjs:136"}, "properties": {"repobilityId": "f67ca31b858ca7ca", "scanner": "scanner-primary", "fingerprint": "33d2d73fd78b9a1f", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "public/js/main.mjs"}, "region": {"startLine": 136}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "bd7f3c1c34d83159", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 44}}}]}, {"ruleId": "scanner-191d6b92595141db", "level": "note", "message": {"text": "Very large file: server.js (1484 lines)"}, "properties": {"repobilityId": "1479ba50e708c5c1", "scanner": "scanner-primary", "fingerprint": "191d6b92595141db", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-a6af47f40a0b62d1", "level": "note", "message": {"text": "Very large file: public/js/main.mjs (2453 lines)"}, "properties": {"repobilityId": "975073c7b0dfa9d7", "scanner": "scanner-primary", "fingerprint": "a6af47f40a0b62d1", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-141b30a41e03817b", "level": "note", "message": {"text": "No license file detected"}, "properties": {"repobilityId": "135e13a0985007e1", "scanner": "scanner-primary", "fingerprint": "141b30a41e03817b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["license", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "4e4b401027a1259c", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "b3577bae90db44f2", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-749d4bc1bd66df5f", "level": "warning", "message": {"text": "Agent instructions exist but release-hardening basics are missing"}, "properties": {"repobilityId": "d3bf4e74ee940f00", "scanner": "scanner-primary", "fingerprint": "749d4bc1bd66df5f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-28cdbe61a5893a3d", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: agents/dashboard-agent/CLAUDE.md"}, "properties": {"repobilityId": "52c5df426f49c6be", "scanner": "scanner-primary", "fingerprint": "28cdbe61a5893a3d", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "agents/dashboard-agent/CLAUDE.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-526136b19aebf73b", "level": "none", "message": {"text": "Commented-code block (5 lines) in server.js:337"}, "properties": {"repobilityId": "68d0c4fdb6cdd7fe", "scanner": "scanner-primary", "fingerprint": "526136b19aebf73b", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-cab8db007eb34704", "level": "none", "message": {"text": "Commented-code block (5 lines) in tests/run-command.test.js:10"}, "properties": {"repobilityId": "8d50e075bd653369", "scanner": "scanner-primary", "fingerprint": "cab8db007eb34704", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-06f5e9f76c1c6e58", "level": "note", "message": {"text": "Legacy-named symbol `reusedLegacy` in tests/slug.test.js:107"}, "properties": {"repobilityId": "610c5c18eec6cb2d", "scanner": "scanner-primary", "fingerprint": "06f5e9f76c1c6e58", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-a36e8df8aadf0251", "level": "none", "message": {"text": "Commented-code block (5 lines) in tests/virtual-desktop.test.js:15"}, "properties": {"repobilityId": "f551d8960a745d35", "scanner": "scanner-primary", "fingerprint": "a36e8df8aadf0251", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-0d21487f2d04ff9f", "level": "none", "message": {"text": "Commented-code block (6 lines) in tests/esc.test.js:4"}, "properties": {"repobilityId": "94cfc97e9ae5c61a", "scanner": "scanner-primary", "fingerprint": "0d21487f2d04ff9f", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-d4a7a7c6f6d365a8", "level": "note", "message": {"text": "Legacy-named symbol `reusedLegacy` in tests/org-launch.test.js:90"}, "properties": {"repobilityId": "15ccf68fb1831430", "scanner": "scanner-primary", "fingerprint": "d4a7a7c6f6d365a8", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-c24a646f05fc2094", "level": "none", "message": {"text": "Commented-code block (5 lines) in scripts/check-frontend-syntax.js:3"}, "properties": {"repobilityId": "7f83cac99b0fa186", "scanner": "scanner-primary", "fingerprint": "c24a646f05fc2094", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-e20338252a954682", "level": "none", "message": {"text": "Commented-code block (5 lines) in scripts/gen-update-keypair.js:5"}, "properties": {"repobilityId": "cf5530ff744458f3", "scanner": "scanner-primary", "fingerprint": "e20338252a954682", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-36457167f002dd95", "level": "none", "message": {"text": "Commented-code block (5 lines) in packaging/open-browser.js:76"}, "properties": {"repobilityId": "e2415ef6b9889c05", "scanner": "scanner-primary", "fingerprint": "36457167f002dd95", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-fe441fab71e6e103", "level": "none", "message": {"text": "Commented-code block (6 lines) in lib/identity.js:37"}, "properties": {"repobilityId": "fc844fc2a037e410", "scanner": "scanner-primary", "fingerprint": "fe441fab71e6e103", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-8eb3ea728a2d9dfe", "level": "none", "message": {"text": "Commented-code block (14 lines) in lib/server-lock.js:3"}, "properties": {"repobilityId": "d17c9f7928fb4784", "scanner": "scanner-primary", "fingerprint": "8eb3ea728a2d9dfe", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-489fa21151d1cb11", "level": "none", "message": {"text": "Commented-code block (6 lines) in lib/atomic-write.js:4"}, "properties": {"repobilityId": "1e261c05e43c63d8", "scanner": "scanner-primary", "fingerprint": "489fa21151d1cb11", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-dc7427393d152ca9", "level": "note", "message": {"text": "Legacy-named symbol `reusedLegacy` in lib/org-launch.js:139"}, "properties": {"repobilityId": "956815d0d82bec61", "scanner": "scanner-primary", "fingerprint": "dc7427393d152ca9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-d96e77c2a9fbcea3", "level": "none", "message": {"text": "Commented-code block (12 lines) in lib/org-launch.js:6"}, "properties": {"repobilityId": "1bacbd9563d81257", "scanner": "scanner-primary", "fingerprint": "d96e77c2a9fbcea3", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-53a9d7133e615b7f", "level": "none", "message": {"text": "Commented-code block (7 lines) in lib/net-acquire.js:3"}, "properties": {"repobilityId": "a4d5438231723b66", "scanner": "scanner-primary", "fingerprint": "53a9d7133e615b7f", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-36729b9f788214b8", "level": "none", "message": {"text": "Commented-code block (5 lines) in lib/update-fetch.js:1"}, "properties": {"repobilityId": "ea5f344605a9fd96", "scanner": "scanner-primary", "fingerprint": "36729b9f788214b8", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-33173764aaad63d0", "level": "none", "message": {"text": "Commented-code block (5 lines) in lib/dr-cli.js:154"}, "properties": {"repobilityId": "5640b5ccb575522c", "scanner": "scanner-primary", "fingerprint": "33173764aaad63d0", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-eed460c65d181e76", "level": "none", "message": {"text": "Commented-code block (9 lines) in lib/log.js:100"}, "properties": {"repobilityId": "b40a1b06c0941d43", "scanner": "scanner-primary", "fingerprint": "eed460c65d181e76", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-5c74f26a716ca79d", "level": "none", "message": {"text": "Commented-code block (7 lines) in lib/launch-tokens.js:3"}, "properties": {"repobilityId": "6520e32270ddf192", "scanner": "scanner-primary", "fingerprint": "5c74f26a716ca79d", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-fe8daf1e98f7bcc0", "level": "none", "message": {"text": "Commented-code block (6 lines) in lib/launch-identity.js:6"}, "properties": {"repobilityId": "c55dc098e43f8ba6", "scanner": "scanner-primary", "fingerprint": "fe8daf1e98f7bcc0", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-6490e2b81c8ebfc3", "level": "none", "message": {"text": "Commented-code block (8 lines) in lib/slug.js:11"}, "properties": {"repobilityId": "6446875d8aab97b9", "scanner": "scanner-primary", "fingerprint": "6490e2b81c8ebfc3", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-c5759228e9c6b1c1", "level": "none", "message": {"text": "Commented-code block (5 lines) in lib/auth-health.js:26"}, "properties": {"repobilityId": "487131c2950f0803", "scanner": "scanner-primary", "fingerprint": "c5759228e9c6b1c1", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-b1704d5f4142b0db", "level": "note", "message": {"text": "Legacy-named symbol `reusedLegacy` in lib/slug-lookup.js:40"}, "properties": {"repobilityId": "aa0d93e8fc7621c3", "scanner": "scanner-primary", "fingerprint": "b1704d5f4142b0db", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-37b9774efb10ac3c", "level": "none", "message": {"text": "Commented-code block (6 lines) in lib/slug-lookup.js:5"}, "properties": {"repobilityId": "43916a491762f602", "scanner": "scanner-primary", "fingerprint": "37b9774efb10ac3c", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-c92d944c9953d5a5", "level": "none", "message": {"text": "Commented-code block (10 lines) in lib/run-command.js:7"}, "properties": {"repobilityId": "2f45ffcb128525d3", "scanner": "scanner-primary", "fingerprint": "c92d944c9953d5a5", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-eb56ae66e0730850", "level": "none", "message": {"text": "Commented-code block (5 lines) in lib/agents.js:183"}, "properties": {"repobilityId": "ccbc04127e6261e3", "scanner": "scanner-primary", "fingerprint": "eb56ae66e0730850", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-f1275e3aa5a3ec40", "level": "none", "message": {"text": "Commented-code block (7 lines) in lib/path-safety.js:9"}, "properties": {"repobilityId": "3a31cb21f6713bf5", "scanner": "scanner-primary", "fingerprint": "f1275e3aa5a3ec40", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-9c072f45086b4781", "level": "none", "message": {"text": "Commented-code block (5 lines) in lib/update-policy.js:3"}, "properties": {"repobilityId": "2f38dd5105adfd2e", "scanner": "scanner-primary", "fingerprint": "9c072f45086b4781", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-b85ee6f4bb0de577", "level": "note", "message": {"text": "Legacy-named symbol `reusedLegacy` in lib/org-launch-route.js:90"}, "properties": {"repobilityId": "270c740af281c5a1", "scanner": "scanner-primary", "fingerprint": "b85ee6f4bb0de577", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-4cb9dc9e5be01a98", "level": "none", "message": {"text": "Commented-code block (12 lines) in lib/org-launch-route.js:6"}, "properties": {"repobilityId": "3afc7aadb0e436ea", "scanner": "scanner-primary", "fingerprint": "4cb9dc9e5be01a98", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-e8f32c04931faa8b", "level": "none", "message": {"text": "Commented-code block (5 lines) in lib/cookie.js:1"}, "properties": {"repobilityId": "375472817e3405cc", "scanner": "scanner-primary", "fingerprint": "e8f32c04931faa8b", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-41f44f893cbe7f6a", "level": "none", "message": {"text": "Commented-code block (5 lines) in lib/auth.js:70"}, "properties": {"repobilityId": "167dd296682c0107", "scanner": "scanner-primary", "fingerprint": "41f44f893cbe7f6a", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-9822cf302c886cd9", "level": "none", "message": {"text": "Commented-code block (10 lines) in lib/restart.js:16"}, "properties": {"repobilityId": "56d9f89dbeec5826", "scanner": "scanner-primary", "fingerprint": "9822cf302c886cd9", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-45ac69ed232016d0", "level": "none", "message": {"text": "Commented-code block (6 lines) in tests-e2e/server.mjs:1"}, "properties": {"repobilityId": "490c6b25a7f8389b", "scanner": "scanner-primary", "fingerprint": "45ac69ed232016d0", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-119f43f6da5908c4", "level": "none", "message": {"text": "Commented-code block (5 lines) in public/js/rowstate.mjs:16"}, "properties": {"repobilityId": "6edf69944b164ed5", "scanner": "scanner-primary", "fingerprint": "119f43f6da5908c4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-a712e77fdcf5b7d9", "level": "none", "message": {"text": "Commented-code block (7 lines) in public/js/diagnostics.mjs:5"}, "properties": {"repobilityId": "042baaf80677f7d4", "scanner": "scanner-primary", "fingerprint": "a712e77fdcf5b7d9", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-75d0ae391a09fb9f", "level": "none", "message": {"text": "Commented-code block (7 lines) in public/js/api.mjs:1"}, "properties": {"repobilityId": "84c8446e649a421e", "scanner": "scanner-primary", "fingerprint": "75d0ae391a09fb9f", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-070b5379a9fa0b32", "level": "none", "message": {"text": "Commented-code block (6 lines) in public/js/update.mjs:1"}, "properties": {"repobilityId": "6daabb29ff4bda11", "scanner": "scanner-primary", "fingerprint": "070b5379a9fa0b32", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-1a9345e1ba8c7a2b", "level": "none", "message": {"text": "Commented-code block (5 lines) in public/js/dropdown.mjs:1"}, "properties": {"repobilityId": "2d6004b888f45260", "scanner": "scanner-primary", "fingerprint": "1a9345e1ba8c7a2b", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-5c6127895b5694aa", "level": "none", "message": {"text": "Commented-code block (5 lines) in public/js/orgroster.mjs:5"}, "properties": {"repobilityId": "bb2492571a08b020", "scanner": "scanner-primary", "fingerprint": "5c6127895b5694aa", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-f2c0aeb512b0885d", "level": "none", "message": {"text": "Commented-code block (7 lines) in public/js/cli-tools.mjs:5"}, "properties": {"repobilityId": "9b88868392e464ee", "scanner": "scanner-primary", "fingerprint": "f2c0aeb512b0885d", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-8ed309337a6cf397", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 public/js/cli-tools.mjs:75"}, "properties": {"repobilityId": "bb5ccc3325cf56b6", "scanner": "scanner-primary", "fingerprint": "8ed309337a6cf397", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-d1f1082a99972497", "level": "none", "message": {"text": "Commented-code block (9 lines) in public/js/settings.mjs:5"}, "properties": {"repobilityId": "036ab37578ccc9ed", "scanner": "scanner-primary", "fingerprint": "d1f1082a99972497", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-21b2cffe472c825e", "level": "none", "message": {"text": "Commented-code block (7 lines) in public/js/main.mjs:83"}, "properties": {"repobilityId": "2efcdeb6ba736059", "scanner": "scanner-primary", "fingerprint": "21b2cffe472c825e", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-0ac64b6cc5fc591f", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 public/js/main.mjs:138"}, "properties": {"repobilityId": "15cd718836734a75", "scanner": "scanner-primary", "fingerprint": "0ac64b6cc5fc591f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-10a74c59422443f1", "level": "none", "message": {"text": "Commented-code block (5 lines) in public/js/prereqs.mjs:1"}, "properties": {"repobilityId": "d0b22c4ee23dc7e3", "scanner": "scanner-primary", "fingerprint": "10a74c59422443f1", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-5baa8971ebe192a1", "level": "note", "message": {"text": "Unused endpoint: GET /"}, "properties": {"repobilityId": "9b883326e67da4e4", "scanner": "scanner-primary", "fingerprint": "5baa8971ebe192a1", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-f1c12077ee7ef0d2", "level": "note", "message": {"text": "Unused endpoint: USE /static"}, "properties": {"repobilityId": "d2b57aeb55d45a38", "scanner": "scanner-primary", "fingerprint": "f1c12077ee7ef0d2", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-1480187b44a5fd90", "level": "note", "message": {"text": "Unused endpoint: GET /auth/callback"}, "properties": {"repobilityId": "c64b2927c7345262", "scanner": "scanner-primary", "fingerprint": "1480187b44a5fd90", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-562322a28c342d7f", "level": "note", "message": {"text": "Unused endpoint: GET /api/auth/status"}, "properties": {"repobilityId": "54ec2771a288ca77", "scanner": "scanner-primary", "fingerprint": "562322a28c342d7f", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-4756b4c4da7d2088", "level": "note", "message": {"text": "Unused endpoint: GET /api/health"}, "properties": {"repobilityId": "98e09bb8fcd7909b", "scanner": "scanner-primary", "fingerprint": "4756b4c4da7d2088", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-17db1ff43849fc59", "level": "note", "message": {"text": "Unused endpoint: GET /api/update-check"}, "properties": {"repobilityId": "b488fa6fa8465386", "scanner": "scanner-primary", "fingerprint": "17db1ff43849fc59", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5c8fcfd1fb18a7c8", "level": "note", "message": {"text": "Unused endpoint: GET /api/cli/install"}, "properties": {"repobilityId": "76cb13690b5dfbd1", "scanner": "scanner-primary", "fingerprint": "5c8fcfd1fb18a7c8", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-ee3024ecbb71f73d", "level": "note", "message": {"text": "Unused endpoint: GET /api/servers"}, "properties": {"repobilityId": "6dcc94fe4a5a4f56", "scanner": "scanner-primary", "fingerprint": "ee3024ecbb71f73d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-f3bf72f059406b13", "level": "note", "message": {"text": "Unused endpoint: GET /api/logs"}, "properties": {"repobilityId": "33afcc5aed89354c", "scanner": "scanner-primary", "fingerprint": "f3bf72f059406b13", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-379b09f9de636500", "level": "note", "message": {"text": "Unused endpoint: GET /api/settings"}, "properties": {"repobilityId": "ed33f347e73d737c", "scanner": "scanner-primary", "fingerprint": "379b09f9de636500", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-e14186867a1f8a88", "level": "note", "message": {"text": "Unused endpoint: POST /api/settings"}, "properties": {"repobilityId": "522746d249f05b6f", "scanner": "scanner-primary", "fingerprint": "e14186867a1f8a88", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-ccb5c92d24b19c26", "level": "note", "message": {"text": "Unused endpoint: POST /api/refresh"}, "properties": {"repobilityId": "95d8aa9167b74f99", "scanner": "scanner-primary", "fingerprint": "ccb5c92d24b19c26", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-bdb8ebb5103a4d1f", "level": "note", "message": {"text": "Unused endpoint: GET /api/recents"}, "properties": {"repobilityId": "e789bd1ec05a8b44", "scanner": "scanner-primary", "fingerprint": "bdb8ebb5103a4d1f", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-f76535c12b518739", "level": "note", "message": {"text": "Unused endpoint: POST /api/recents"}, "properties": {"repobilityId": "3f443581fd631b01", "scanner": "scanner-primary", "fingerprint": "f76535c12b518739", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-a6003b5e1b49c691", "level": "note", "message": {"text": "Unused endpoint: POST /api/sync/init"}, "properties": {"repobilityId": "0e225813e6a3792d", "scanner": "scanner-primary", "fingerprint": "a6003b5e1b49c691", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-9331fd384ba44a82", "level": "note", "message": {"text": "Unused endpoint: POST /api/sync"}, "properties": {"repobilityId": "22b3768b030915e2", "scanner": "scanner-primary", "fingerprint": "9331fd384ba44a82", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c3cdecb263117dff", "level": "note", "message": {"text": "Unused endpoint: GET /api/sync/status"}, "properties": {"repobilityId": "e421d7d98d368a3b", "scanner": "scanner-primary", "fingerprint": "c3cdecb263117dff", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c4b0361ac0f5eeb9", "level": "note", "message": {"text": "Unused endpoint: GET /api/agents"}, "properties": {"repobilityId": "03512d73d4e65a1a", "scanner": "scanner-primary", "fingerprint": "c4b0361ac0f5eeb9", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-bf2e6e2188a510ee", "level": "note", "message": {"text": "Unused endpoint: GET /api/sessions"}, "properties": {"repobilityId": "994f83d7f7b8b63d", "scanner": "scanner-primary", "fingerprint": "bf2e6e2188a510ee", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-702add13cde847c5", "level": "note", "message": {"text": "Unused endpoint: GET /api/sessions/health"}, "properties": {"repobilityId": "6e99a6320b1e53ae", "scanner": "scanner-primary", "fingerprint": "702add13cde847c5", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-e383ce0fe70c3e68", "level": "note", "message": {"text": "Unused endpoint: POST /api/auth-health/check"}, "properties": {"repobilityId": "b366fe44cab4bc04", "scanner": "scanner-primary", "fingerprint": "e383ce0fe70c3e68", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-13565b300e28581f", "level": "note", "message": {"text": "Unused endpoint: GET /api/launch-stream"}, "properties": {"repobilityId": "3240055befea205c", "scanner": "scanner-primary", "fingerprint": "13565b300e28581f", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-21cf56c09f860b64", "level": "note", "message": {"text": "Unused endpoint: GET /index.html"}, "properties": {"repobilityId": "07db3da4b3dfc724", "scanner": "scanner-primary", "fingerprint": "21cf56c09f860b64", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}]}]}