{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-a93ee975321b6e02", "name": "Possibly dead Python function: remove_listener", "shortDescription": {"text": "Possibly dead Python function: remove_listener"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2c6450f97ac29845", "name": "Possibly dead Python function: create_robot_from_object", "shortDescription": {"text": "Possibly dead Python function: create_robot_from_object"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-627d9a47966dae5c", "name": "Possibly dead Python function: process_bind_param", "shortDescription": {"text": "Possibly dead Python function: process_bind_param"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fc519aaeda8ffdd0", "name": "Possibly dead Python function: process_result_value", "shortDescription": {"text": "Possibly dead Python function: process_result_value"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-24c3c0fee041123e", "name": "Possibly dead Python function: build_life_moments_prompt", "shortDescription": {"text": "Possibly dead Python function: build_life_moments_prompt"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3b41bdd8fdb34d58", "name": "Possibly dead Python function: build_moment_detail_prompt", "shortDescription": {"text": "Possibly dead Python function: build_moment_detail_prompt"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1a69454fdb2bbaca", "name": "Possibly dead Python function: build_moment_summary_prompt", "shortDescription": {"text": "Possibly dead Python function: build_moment_summary_prompt"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-950f47b30bbf568b", "name": "Possibly dead Python function: do_run_migrations", "shortDescription": {"text": "Possibly dead Python function: do_run_migrations"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d6666216510e1ef0", "name": "Possibly dead Python function: upgrade", "shortDescription": {"text": "Possibly dead Python function: upgrade"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ab3c1f5cd30a9ea4", "name": "Possibly dead Python function: downgrade", "shortDescription": {"text": "Possibly dead Python function: downgrade"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1310a864becd3b62", "name": "Possibly dead Python function: upgrade", "shortDescription": {"text": "Possibly dead Python function: upgrade"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5e317d211bbf2147", "name": "Possibly dead Python function: downgrade", "shortDescription": {"text": "Possibly dead Python function: downgrade"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b47afd5f7df5458d", "name": "Possibly dead Python function: upgrade", "shortDescription": {"text": "Possibly dead Python function: upgrade"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2427c97affa93429", "name": "Possibly dead Python function: downgrade", "shortDescription": {"text": "Possibly dead Python function: downgrade"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-da9480529de94628", "name": "Possibly dead Python function: upgrade", "shortDescription": {"text": "Possibly dead Python function: upgrade"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-377d07a05f6b07a9", "name": "Possibly dead Python function: downgrade", "shortDescription": {"text": "Possibly dead Python function: downgrade"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0273b2754db41251", "name": "Possibly dead Python function: upgrade", "shortDescription": {"text": "Possibly dead Python function: upgrade"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-42c84175cb43747b", "name": "Possibly dead Python function: downgrade", "shortDescription": {"text": "Possibly dead Python function: downgrade"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fea896b8b7f98eb4", "name": "Possibly dead Python function: upgrade", "shortDescription": {"text": "Possibly dead Python function: upgrade"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7bd8e2472d5c338f", "name": "Possibly dead Python function: downgrade", "shortDescription": {"text": "Possibly dead Python function: downgrade"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d87c7a6c6a5be961", "name": "Possibly dead Python function: upgrade", "shortDescription": {"text": "Possibly dead Python function: upgrade"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a7e6652b5afba67c", "name": "Possibly dead Python function: downgrade", "shortDescription": {"text": "Possibly dead Python function: downgrade"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3e508216d6f43e68", "name": "Possibly dead Python function: upgrade", "shortDescription": {"text": "Possibly dead Python function: upgrade"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f9055af3d6ace099", "name": "Possibly dead Python function: downgrade", "shortDescription": {"text": "Possibly dead Python function: downgrade"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f9f35fb911d0e12c", "name": "Possibly dead Python function: upgrade", "shortDescription": {"text": "Possibly dead Python function: upgrade"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e2f845e8b24436b1", "name": "Possibly dead Python function: downgrade", "shortDescription": {"text": "Possibly dead Python function: downgrade"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4affb636399d8ba2", "name": "Possibly dead Python function: upgrade", "shortDescription": {"text": "Possibly dead Python function: upgrade"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-30f81bddf9d1c424", "name": "Possibly dead Python function: downgrade", "shortDescription": {"text": "Possibly dead Python function: downgrade"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d7a9cb26abe3011e", "name": "Possibly dead Python function: upgrade", "shortDescription": {"text": "Possibly dead Python function: upgrade"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7825c13e364846e9", "name": "Stray `console.log` in TS/JS \u2014 frontend/src/app/api/tts/speak/route.ts:14", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 frontend/src/app/api/tts/speak/route.ts:14"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4a3a8d4cda0f80dc", "name": "`truncate` class without `title=` for hover reveal \u2014 frontend/src/app/group-chat/page.tsx:618", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 frontend/src/app/group-chat/page.tsx:618"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-fe1f0bd81d1376dc", "name": "Stray `console.log` in TS/JS \u2014 desktop/src/renderer/api.ts:39", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 desktop/src/renderer/api.ts:39"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3c65a4d16e9efd61", "name": "Stray `console.log` in TS/JS \u2014 desktop/src/renderer/App.tsx:227", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 desktop/src/renderer/App.tsx:227"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7571e8a9f0862e36", "name": "Stray `console.log` in TS/JS \u2014 desktop/src/main/backend.ts:36", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 desktop/src/main/backend.ts:36"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e8e8a874dcc6d26c", "name": "Stray `console.log` in TS/JS \u2014 desktop/src/main/index.ts:92", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 desktop/src/main/index.ts:92"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-491e61901dd82bde", "name": "Stray `console.log` in TS/JS \u2014 desktop/src/main/ipc.ts:51", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 desktop/src/main/ipc.ts:51"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-80f28e5ac86a769c", "name": "Stray `console.log` in TS/JS \u2014 desktop/src/main/agent/sensor-manager.ts:59", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 desktop/src/main/agent/sensor-manager.ts:59"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-98ad9f8894a4f62a", "name": "Stray `console.log` in TS/JS \u2014 desktop/src/main/agent/screen-sensor.ts:68", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 desktop/src/main/agent/screen-sensor.ts:68"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-60427b03771411b6", "name": "Dockerfile runs as root: frontend/Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: frontend/Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6f6b2022eed0806a", "name": "Docker base image is tag-pinned but not digest-pinned: node:22-slim", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: node:22-slim"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1f66ad88286ca30a", "name": "Dockerfile runs as root: backend/Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: backend/Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-714c31ca9f474ae6", "name": "Docker base image is tag-pinned but not digest-pinned: python:3.12-slim", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.12-slim"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-aa5acaa49eb8315b", "name": "Containers defined but no K8s/orchestration manifest found", "shortDescription": {"text": "Containers defined but no K8s/orchestration manifest found"}, "fullDescription": {"text": "Repo has Dockerfiles/compose but no Kubernetes/Nomad manifests. If the target deployment is K8s, the manifests may live in a separate ops repo."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d51394c24fab39ae", "name": "Insecure pattern 'direct_innerhtml_assignment' in desktop/assets/characters/preview.html:199", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in desktop/assets/characters/preview.html:199"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7d6509f43f939819", "name": "Insecure pattern 'node_child_process' in desktop/src/main/backend.ts:1", "shortDescription": {"text": "Insecure pattern 'node_child_process' in desktop/src/main/backend.ts:1"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b4ee373e43869f10", "name": "Insecure pattern 'node_child_process' in desktop/src/main/index.ts:102", "shortDescription": {"text": "Insecure pattern 'node_child_process' in desktop/src/main/index.ts:102"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1977e3e62920d08b", "name": "Insecure pattern 'node_child_process' in desktop/src/main/ipc.ts:52", "shortDescription": {"text": "Insecure pattern 'node_child_process' in desktop/src/main/ipc.ts:52"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f7852282ca246840", "name": "Insecure pattern 'exec_used' in desktop/src/main/agent/app-sensor.ts:24", "shortDescription": {"text": "Insecure pattern 'exec_used' in desktop/src/main/agent/app-sensor.ts:24"}, "fullDescription": {"text": "Found a known-risky pattern (exec_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-66b92b22fde40802", "name": "Insecure pattern 'node_child_process' in desktop/src/main/agent/app-sensor.ts:1", "shortDescription": {"text": "Insecure pattern 'node_child_process' in desktop/src/main/agent/app-sensor.ts:1"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0af9f85198971c9b", "name": "Insecure pattern 'node_child_process' in desktop/src/main/agent/screen-sensor.ts:77", "shortDescription": {"text": "Insecure pattern 'node_child_process' in desktop/src/main/agent/screen-sensor.ts:77"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e2f322b6e806b8e3", "name": "Insecure pattern 'direct_innerhtml_assignment' in backend/app/admin_panel.html:409", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in backend/app/admin_panel.html:409"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6372cebde0220094", "name": "No auth library detected", "shortDescription": {"text": "No auth library detected"}, "fullDescription": {"text": "The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). The repo has auth/admin/session surface indicators, so auth may live in custom code, in a separate service, or be missing."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4601e3ad3bb28677", "name": "No CI/CD pipelines detected", "shortDescription": {"text": "No CI/CD pipelines detected"}, "fullDescription": {"text": "No GitHub Actions, GitLab CI, or CircleCI configs found. Without CI you can't gate deploys on tests/lints."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea3b5e389d8c9c0f", "name": "Low test-to-source ratio", "shortDescription": {"text": "Low test-to-source ratio"}, "fullDescription": {"text": "27 tests / 138 src (ratio 0.20)."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-141b30a41e03817b", "name": "No license file detected", "shortDescription": {"text": "No license file detected"}, "fullDescription": {"text": "No LICENSE/COPYING/NOTICE file was found. Generated repositories often omit licensing, which blocks reuse and automated intake."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 137 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b9088664ace7f748", "name": "Composite production-readiness gap", "shortDescription": {"text": "Composite production-readiness gap"}, "fullDescription": {"text": "Multiple low-cost hardening controls are missing together: license, ci. Opus verification showed these co-occurring gaps are a better readiness signal than reading each flag in isolation."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-749d4bc1bd66df5f", "name": "Agent instructions exist but release-hardening basics are missing", "shortDescription": {"text": "Agent instructions exist but release-hardening basics are missing"}, "fullDescription": {"text": "AI-coder instruction files were found, but the repo is missing license, ci. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-5dae24a8be607801", "name": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/src/app/page.tsx:354", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/src/app/page.tsx:354"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b055a19226c6df68", "name": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/src/app/api/objects/observe/route.ts:8", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/src/app/api/objects/observe/route.ts:8"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-44aebd045fb3f645", "name": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/src/app/api/robots/[id]/route.ts:10", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/src/app/api/robots/[id]/route.ts:10"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-48049774e42a97c1", "name": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/src/app/api/robots/[id]/activity/route.ts:12", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/src/app/api/robots/[id]/activity/route.ts:12"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-315f49059ce25579", "name": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/src/app/api/robots/[id]/skills/route.ts:10", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/src/app/api/robots/[id]/skills/route.ts:10"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-da3ae93c3d296349", "name": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/src/app/api/robots/from-image/route.ts:8", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/src/app/api/robots/from-image/route.ts:8"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b0e3d87f405a2e80", "name": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/src/app/api/robots/creation-status/[jobId]/route.ts:11", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/src/app/api/robots/creation-status/[jobId]/route.ts:11"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-df6e327c185ecce3", "name": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/src/app/api/tts/regenerate/[robotId]/route.ts:10", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/src/app/api/tts/regenerate/[robotId]/route.ts:10"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-43190efc0722443a", "name": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/src/app/api/heartbeat/trigger/[robotId]/[action]/route.ts:10", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/src/app/api/heartbeat/trigger/[robotId]/[action]/route.ts:10"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b380bf13d3af6393", "name": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/src/app/api/heartbeat/interval/route.ts:8", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/src/app/api/heartbeat/interval/route.ts:8"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d2c2db7e245f4914", "name": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/src/app/api/heartbeat/busy/route.ts:8", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/src/app/api/heartbeat/busy/route.ts:8"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-40a5134f1406c90f", "name": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/src/app/api/stt/transcribe/route.ts:7", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/src/app/api/stt/transcribe/route.ts:7"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d924415a48fcdf8a", "name": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/src/lib/api.ts:4", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/src/lib/api.ts:4"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a12f16268a36e652", "name": "`fetch()` without try/.catch or AbortSignal \u2014 desktop/src/renderer/api.ts:6", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 desktop/src/renderer/api.ts:6"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f5f52c117cf7367b", "name": "`fetch()` without try/.catch or AbortSignal \u2014 desktop/src/renderer/components/VoiceButton.tsx:39", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 desktop/src/renderer/components/VoiceButton.tsx:39"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-58167b4ececd2487", "name": "`fetch()` without try/.catch or AbortSignal \u2014 desktop/src/renderer/public/live2dcubismcore.min.js:9", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 desktop/src/renderer/public/live2dcubismcore.min.js:9"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-affbeb82dc339051", "name": "Commented-code block (6 lines) in backend/tests/test_sleep_cycle.py:52", "shortDescription": {"text": "Commented-code block (6 lines) in backend/tests/test_sleep_cycle.py:52"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-15a4b410e1e3e349", "name": "Network/subprocess call without timeout or try/except \u2014 backend/app/api/tts.py:515", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 backend/app/api/tts.py:515"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-250f57e8a1dbd3c5", "name": "4 env vars used in code but missing from .env.example", "shortDescription": {"text": "4 env vars used in code but missing from .env.example"}, "fullDescription": {"text": "Drift between code and config docs. The first few: `BACKEND_URL`, `COSYVOICE_URL`, `NEXT_PUBLIC_API_URL`, `NODE_ENV`. Add them (with a placeholder/comment) to .env.example so onboarding doesn't break."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-33a6b62e30ce7ab4", "name": "Near-duplicate function bodies in 6 places", "shortDescription": {"text": "Near-duplicate function bodies in 6 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nbackend/app/services/llm/openai.py:generate, backend/app/services/llm/anthropic.py:generate, backend/app/services/llm/deepseek.py:generate, backend/app/services/llm/claude_cli.py:generate\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2c04133e54348533", "name": "Near-duplicate function bodies in 2 places", "shortDescription": {"text": "Near-duplicate function bodies in 2 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nbackend/app/db/models_sqlite.py:process_bind_param, backend/app/db/models_sqlite.py:process_bind_param\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c34db5bde2c83c1f", "name": "FastAPI POST `wake` without auth dependency \u2014 backend/app/api/heartbeat.py:36", "shortDescription": {"text": "FastAPI POST `wake` without auth dependency \u2014 backend/app/api/heartbeat.py:36"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-85b4a55de5fa3346", "name": "FastAPI POST `sleep` without auth dependency \u2014 backend/app/api/heartbeat.py:45", "shortDescription": {"text": "FastAPI POST `sleep` without auth dependency \u2014 backend/app/api/heartbeat.py:45"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-c1238e063cf927b2", "name": "FastAPI POST `busy` without auth dependency \u2014 backend/app/api/heartbeat.py:51", "shortDescription": {"text": "FastAPI POST `busy` without auth dependency \u2014 backend/app/api/heartbeat.py:51"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-78c19c47b12c9506", "name": "FastAPI POST `set_interval` without auth dependency \u2014 backend/app/api/heartbeat.py:58", "shortDescription": {"text": "FastAPI POST `set_interval` without auth dependency \u2014 backend/app/api/heartbeat.py:58"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-c56b70c054631878", "name": "FastAPI POST `trigger_action` without auth dependency \u2014 backend/app/api/heartbeat.py:114", "shortDescription": {"text": "FastAPI POST `trigger_action` without auth dependency \u2014 backend/app/api/heartbeat.py:114"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-1d8c983ea0d74de1", "name": "FastAPI POST `create_robot_from_image` without auth dependency \u2014 backend/app/api/robots.py:40", "shortDescription": {"text": "FastAPI POST `create_robot_from_image` without auth dependency \u2014 backend/app/api/robots.py:40"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-1e1314f4167d5c01", "name": "FastAPI POST `set_voice_lang` without auth dependency \u2014 backend/app/api/admin.py:91", "shortDescription": {"text": "FastAPI POST `set_voice_lang` without auth dependency \u2014 backend/app/api/admin.py:91"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-9bf463cf78f97cf4", "name": "FastAPI POST `generate_images` without auth dependency \u2014 backend/app/api/admin.py:108", "shortDescription": {"text": "FastAPI POST `generate_images` without auth dependency \u2014 backend/app/api/admin.py:108"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-e98167cdc7c8405f", "name": "FastAPI POST `remove_backgrounds` without auth dependency \u2014 backend/app/api/admin.py:184", "shortDescription": {"text": "FastAPI POST `remove_backgrounds` without auth dependency \u2014 backend/app/api/admin.py:184"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-ea7dbc203eae4fe4", "name": "FastAPI POST `upload_voice` without auth dependency \u2014 backend/app/api/admin.py:227", "shortDescription": {"text": "FastAPI POST `upload_voice` without auth dependency \u2014 backend/app/api/admin.py:227"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-a856ad73432d3862", "name": "FastAPI POST `upload_reference` without auth dependency \u2014 backend/app/api/admin.py:260", "shortDescription": {"text": "FastAPI POST `upload_reference` without auth dependency \u2014 backend/app/api/admin.py:260"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-358c53f35b141def", "name": "FastAPI POST `create_character` without auth dependency \u2014 backend/app/api/admin.py:283", "shortDescription": {"text": "FastAPI POST `create_character` without auth dependency \u2014 backend/app/api/admin.py:283"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-2208b9c2c9a98f9e", "name": "FastAPI POST `activate_version` without auth dependency \u2014 backend/app/api/admin.py:464", "shortDescription": {"text": "FastAPI POST `activate_version` without auth dependency \u2014 backend/app/api/admin.py:464"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-83e4c045be3c3e38", "name": "FastAPI POST `toggle_star` without auth dependency \u2014 backend/app/api/admin.py:502", "shortDescription": {"text": "FastAPI POST `toggle_star` without auth dependency \u2014 backend/app/api/admin.py:502"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-b4a308d1b2352198", "name": "FastAPI POST `create_from_web` without auth dependency \u2014 backend/app/api/admin_web_creation.py:29", "shortDescription": {"text": "FastAPI POST `create_from_web` without auth dependency \u2014 backend/app/api/admin_web_creation.py:29"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-5790eeb257f5a6b9", "name": "FastAPI POST `build_memories_for_existing` without auth dependency \u2014 backend/app/api/admin_web_creation.py:57", "shortDescription": {"text": "FastAPI POST `build_memories_for_existing` without auth dependency \u2014 backend/app/api/admin_web_creation.py:57"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-36471596e57829c0", "name": "FastAPI POST `transcribe` without auth dependency \u2014 backend/app/api/stt.py:25", "shortDescription": {"text": "FastAPI POST `transcribe` without auth dependency \u2014 backend/app/api/stt.py:25"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-c020b7f4bcb8eb6a", "name": "FastAPI POST `set_tts_config` without auth dependency \u2014 backend/app/api/tts_genie.py:73", "shortDescription": {"text": "FastAPI POST `set_tts_config` without auth dependency \u2014 backend/app/api/tts_genie.py:73"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-6899fd76093b464f", "name": "Dangling fetch: GET /api/robots/creation-status/${jobId} (frontend/src/app/page.tsx:56)", "shortDescription": {"text": "Dangling fetch: GET /api/robots/creation-status/${jobId} (frontend/src/app/page.tsx:56)"}, "fullDescription": {"text": "`frontend/src/app/page.tsx:56` calls `GET /api/robots/creation-status/${jobId}` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/robots/creation-status/<p>`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-0bf09b136fa4aee2", "name": "Dangling fetch: POST /api/robots/from-image (frontend/src/app/page.tsx:112)", "shortDescription": {"text": "Dangling fetch: POST /api/robots/from-image (frontend/src/app/page.tsx:112)"}, "fullDescription": {"text": "`frontend/src/app/page.tsx:112` calls `POST /api/robots/from-image` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/robots/from-image`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-07e1fbf4669638a1", "name": "Dangling fetch: DELETE /api/conversations/all (frontend/src/app/page.tsx:354)", "shortDescription": {"text": "Dangling fetch: DELETE /api/conversations/all (frontend/src/app/page.tsx:354)"}, "fullDescription": {"text": "`frontend/src/app/page.tsx:354` calls `DELETE /api/conversations/all` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/conversations/all`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-60b103866cdaef23", "name": "Dangling fetch: DELETE /api/robots/activity/all (frontend/src/app/page.tsx:365)", "shortDescription": {"text": "Dangling fetch: DELETE /api/robots/activity/all (frontend/src/app/page.tsx:365)"}, "fullDescription": {"text": "`frontend/src/app/page.tsx:365` calls `DELETE /api/robots/activity/all` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/robots/activity/all`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-87fbfbde71573ac2", "name": "Dangling fetch: GET /api/heartbeat/status (frontend/src/app/group-chat/page.tsx:144)", "shortDescription": {"text": "Dangling fetch: GET /api/heartbeat/status (frontend/src/app/group-chat/page.tsx:144)"}, "fullDescription": {"text": "`frontend/src/app/group-chat/page.tsx:144` calls `GET /api/heartbeat/status` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/heartbeat/status`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-8c373fcccf4ed61b", "name": "Dangling fetch: POST /api/heartbeat/busy?busy=${busy} (frontend/src/app/group-chat/page.tsx:165)", "shortDescription": {"text": "Dangling fetch: POST /api/heartbeat/busy?busy=${busy} (frontend/src/app/group-chat/page.tsx:165)"}, "fullDescription": {"text": "`frontend/src/app/group-chat/page.tsx:165` calls `POST /api/heartbeat/busy?busy=${busy}` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/heartbeat/busy`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-3ab522793f89df65", "name": "Dangling fetch: GET /api/heartbeat/events?after=${lastSeq.current}&_t=${Date.now()} (frontend/src/app/group-chat/page.ts", "shortDescription": {"text": "Dangling fetch: GET /api/heartbeat/events?after=${lastSeq.current}&_t=${Date.now()} (frontend/src/app/group-chat/page.tsx:191)"}, "fullDescription": {"text": "`frontend/src/app/group-chat/page.tsx:191` calls `GET /api/heartbeat/events?after=${lastSeq.current}&_t=${Date.now()}` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/heartbeat/events`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-62354a276d436bdb", "name": "Dangling fetch: POST /api/stt/transcribe (frontend/src/app/group-chat/page.tsx:351)", "shortDescription": {"text": "Dangling fetch: POST /api/stt/transcribe (frontend/src/app/group-chat/page.tsx:351)"}, "fullDescription": {"text": "`frontend/src/app/group-chat/page.tsx:351` calls `POST /api/stt/transcribe` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/stt/transcribe`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-e956abd59bd39f7a", "name": "Dangling fetch: POST /api/heartbeat/sleep (frontend/src/app/group-chat/page.tsx:390)", "shortDescription": {"text": "Dangling fetch: POST /api/heartbeat/sleep (frontend/src/app/group-chat/page.tsx:390)"}, "fullDescription": {"text": "`frontend/src/app/group-chat/page.tsx:390` calls `POST /api/heartbeat/sleep` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/heartbeat/sleep`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-e031a1de72589ff8", "name": "Dangling fetch: POST /api/heartbeat/wake (frontend/src/app/group-chat/page.tsx:394)", "shortDescription": {"text": "Dangling fetch: POST /api/heartbeat/wake (frontend/src/app/group-chat/page.tsx:394)"}, "fullDescription": {"text": "`frontend/src/app/group-chat/page.tsx:394` calls `POST /api/heartbeat/wake` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/heartbeat/wake`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-98f65d171d450198", "name": "Dangling fetch: POST /api/heartbeat/wake (frontend/src/app/group-chat/page.tsx:410)", "shortDescription": {"text": "Dangling fetch: POST /api/heartbeat/wake (frontend/src/app/group-chat/page.tsx:410)"}, "fullDescription": {"text": "`frontend/src/app/group-chat/page.tsx:410` calls `POST /api/heartbeat/wake` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/heartbeat/wake`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-9dbd79f894fb449c", "name": "Dangling fetch: POST /api/heartbeat/interval?seconds=${v} (frontend/src/app/group-chat/page.tsx:517)", "shortDescription": {"text": "Dangling fetch: POST /api/heartbeat/interval?seconds=${v} (frontend/src/app/group-chat/page.tsx:517)"}, "fullDescription": {"text": "`frontend/src/app/group-chat/page.tsx:517` calls `POST /api/heartbeat/interval?seconds=${v}` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/heartbeat/interval`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-04c26789b0ec1cb3", "name": "Dangling fetch: POST https://nomi-api.zhuchao.life/api/robots/from-image (frontend/src/lib/api.ts:26)", "shortDescription": {"text": "Dangling fetch: POST https://nomi-api.zhuchao.life/api/robots/from-image (frontend/src/lib/api.ts:26)"}, "fullDescription": {"text": "`frontend/src/lib/api.ts:26` calls `POST https://nomi-api.zhuchao.life/api/robots/from-image` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/https:/nomi-api.zhuchao.life/api/robots/from-image`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-e0e88974ddf7ffe9", "name": "Dangling fetch: POST https://nomi-api.zhuchao.life/api/agents/idle-chat (frontend/src/lib/api.ts:76)", "shortDescription": {"text": "Dangling fetch: POST https://nomi-api.zhuchao.life/api/agents/idle-chat (frontend/src/lib/api.ts:76)"}, "fullDescription": {"text": "`frontend/src/lib/api.ts:76` calls `POST https://nomi-api.zhuchao.life/api/agents/idle-chat` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/https:/nomi-api.zhuchao.life/api/agents/idle-chat`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-c615c464bf00f5f1", "name": "Dangling fetch: POST /api/robots (frontend/src/lib/api.ts:16)", "shortDescription": {"text": "Dangling fetch: POST /api/robots (frontend/src/lib/api.ts:16)"}, "fullDescription": {"text": "`frontend/src/lib/api.ts:16` calls `POST /api/robots` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: helper:request\nNormalized path used for matching: `/robots`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-cefdd903ba84005c", "name": "Dangling fetch: GET /api/robots (frontend/src/lib/api.ts:33)", "shortDescription": {"text": "Dangling fetch: GET /api/robots (frontend/src/lib/api.ts:33)"}, "fullDescription": {"text": "`frontend/src/lib/api.ts:33` calls `GET /api/robots` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: helper:request\nNormalized path used for matching: `/robots`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-aed52d3179b7b260", "name": "Dangling fetch: GET /api/robots/${id} (frontend/src/lib/api.ts:36)", "shortDescription": {"text": "Dangling fetch: GET /api/robots/${id} (frontend/src/lib/api.ts:36)"}, "fullDescription": {"text": "`frontend/src/lib/api.ts:36` calls `GET /api/robots/${id}` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: helper:request\nNormalized path used for matching: `/robots/<p>`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-0dbd7f589f4d8636", "name": "Dangling fetch: POST /api/objects/observe (frontend/src/lib/api.ts:39)", "shortDescription": {"text": "Dangling fetch: POST /api/objects/observe (frontend/src/lib/api.ts:39)"}, "fullDescription": {"text": "`frontend/src/lib/api.ts:39` calls `POST /api/objects/observe` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: helper:request\nNormalized path used for matching: `/objects/observe`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-996774b7dad672e0", "name": "Dangling fetch: POST /api/conversations (frontend/src/lib/api.ts:48)", "shortDescription": {"text": "Dangling fetch: POST /api/conversations (frontend/src/lib/api.ts:48)"}, "fullDescription": {"text": "`frontend/src/lib/api.ts:48` calls `POST /api/conversations` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: helper:request\nNormalized path used for matching: `/conversations`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-5d6bf209f895720a", "name": "Dangling fetch: DELETE /api/robots/${id} (frontend/src/lib/api.ts:61)", "shortDescription": {"text": "Dangling fetch: DELETE /api/robots/${id} (frontend/src/lib/api.ts:61)"}, "fullDescription": {"text": "`frontend/src/lib/api.ts:61` calls `DELETE /api/robots/${id}` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: helper:request\nNormalized path used for matching: `/robots/<p>`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-6270268d9cab4306", "name": "Dangling fetch: GET /api/conversations/models (frontend/src/lib/api.ts:63)", "shortDescription": {"text": "Dangling fetch: GET /api/conversations/models (frontend/src/lib/api.ts:63)"}, "fullDescription": {"text": "`frontend/src/lib/api.ts:63` calls `GET /api/conversations/models` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: helper:request\nNormalized path used for matching: `/conversations/models`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-5685b534ed2c70fe", "name": "Dangling fetch: GET /api/robots?desktop=true (desktop/src/renderer/api.ts:59)", "shortDescription": {"text": "Dangling fetch: GET /api/robots?desktop=true (desktop/src/renderer/api.ts:59)"}, "fullDescription": {"text": "`desktop/src/renderer/api.ts:59` calls `GET /api/robots?desktop=true` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: helper:request\nNormalized path used for matching: `/robots`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-b77b869fad4a0cbd", "name": "Dangling fetch: POST /api/conversations (desktop/src/renderer/api.ts:62)", "shortDescription": {"text": "Dangling fetch: POST /api/conversations (desktop/src/renderer/api.ts:62)"}, "fullDescription": {"text": "`desktop/src/renderer/api.ts:62` calls `POST /api/conversations` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: helper:request\nNormalized path used for matching: `/conversations`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-653e43be7262f736", "name": "Dangling fetch: GET /api/conversations/latest (desktop/src/renderer/api.ts:74)", "shortDescription": {"text": "Dangling fetch: GET /api/conversations/latest (desktop/src/renderer/api.ts:74)"}, "fullDescription": {"text": "`desktop/src/renderer/api.ts:74` calls `GET /api/conversations/latest` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: helper:request\nNormalized path used for matching: `/conversations/latest`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-7e7b6e94a7369a48", "name": "Dangling fetch: POST http://127.0.0.1:8100/api/stt/transcribe (desktop/src/renderer/components/VoiceButton.tsx:39)", "shortDescription": {"text": "Dangling fetch: POST http://127.0.0.1:8100/api/stt/transcribe (desktop/src/renderer/components/VoiceButton.tsx:39)"}, "fullDescription": {"text": "`desktop/src/renderer/components/VoiceButton.tsx:39` calls `POST http://127.0.0.1:8100/api/stt/transcribe` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/http:/127.0.0.1:8100/api/stt/transcribe`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-4756b4c4da7d2088", "name": "Unused endpoint: GET /api/health", "shortDescription": {"text": "Unused endpoint: GET /api/health"}, "fullDescription": {"text": "`backend/app/main.py` declares `GET /api/health` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-953ec1a0ee6df50d", "name": "Unused endpoint: GET /admin", "shortDescription": {"text": "Unused endpoint: GET /admin"}, "fullDescription": {"text": "`backend/app/main.py` declares `GET /admin` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-25a148d51e6704dd", "name": "Unused endpoint: POST /wake", "shortDescription": {"text": "Unused endpoint: POST /wake"}, "fullDescription": {"text": "`backend/app/api/heartbeat.py` declares `POST /wake` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-350a8ab893a9ae45", "name": "Unused endpoint: POST /sleep", "shortDescription": {"text": "Unused endpoint: POST /sleep"}, "fullDescription": {"text": "`backend/app/api/heartbeat.py` declares `POST /sleep` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fd9759b09cb41abe", "name": "Unused endpoint: POST /busy", "shortDescription": {"text": "Unused endpoint: POST /busy"}, "fullDescription": {"text": "`backend/app/api/heartbeat.py` declares `POST /busy` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c87c2d608d38851d", "name": "Unused endpoint: POST /interval", "shortDescription": {"text": "Unused endpoint: POST /interval"}, "fullDescription": {"text": "`backend/app/api/heartbeat.py` declares `POST /interval` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-43269e4e79c2e69e", "name": "Unused endpoint: GET /events", "shortDescription": {"text": "Unused endpoint: GET /events"}, "fullDescription": {"text": "`backend/app/api/heartbeat.py` declares `GET /events` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-67ac400ef2f71a59", "name": "Unused endpoint: POST /trigger/{robot_id}/{action}", "shortDescription": {"text": "Unused endpoint: POST /trigger/{robot_id}/{action}"}, "fullDescription": {"text": "`backend/app/api/heartbeat.py` declares `POST /trigger/{robot_id}/{action}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9ded26c8fff30981", "name": "Unused endpoint: POST /observe", "shortDescription": {"text": "Unused endpoint: POST /observe"}, "fullDescription": {"text": "`backend/app/api/objects.py` declares `POST /observe` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2ab9bf5db6820af4", "name": "Unused endpoint: GET /models", "shortDescription": {"text": "Unused endpoint: GET /models"}, "fullDescription": {"text": "`backend/app/api/conversations.py` declares `GET /models` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d0e963cf059012cb", "name": "Unused endpoint: DELETE /all", "shortDescription": {"text": "Unused endpoint: DELETE /all"}, "fullDescription": {"text": "`backend/app/api/conversations.py` declares `DELETE /all` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-37157900d71c21d3", "name": "Unused endpoint: GET /latest", "shortDescription": {"text": "Unused endpoint: GET /latest"}, "fullDescription": {"text": "`backend/app/api/conversations.py` declares `GET /latest` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7a009b1a56794f45", "name": "Unused endpoint: POST /", "shortDescription": {"text": "Unused endpoint: POST /"}, "fullDescription": {"text": "`backend/app/api/conversations.py` declares `POST /` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a2d9f4ab80e5aa03", "name": "Unused endpoint: POST /{conversation_id}/message", "shortDescription": {"text": "Unused endpoint: POST /{conversation_id}/message"}, "fullDescription": {"text": "`backend/app/api/conversations.py` declares `POST /{conversation_id}/message` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-593c6efeb9f4cfb8", "name": "Unused endpoint: GET /{conversation_id}/messages", "shortDescription": {"text": "Unused endpoint: GET /{conversation_id}/messages"}, "fullDescription": {"text": "`backend/app/api/conversations.py` declares `GET /{conversation_id}/messages` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2719b3547f089dbc", "name": "Unused endpoint: POST /from-image", "shortDescription": {"text": "Unused endpoint: POST /from-image"}, "fullDescription": {"text": "`backend/app/api/robots.py` declares `POST /from-image` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a1b6902a92b267a5", "name": "Unused endpoint: GET /creation-status/{job_id}", "shortDescription": {"text": "Unused endpoint: GET /creation-status/{job_id}"}, "fullDescription": {"text": "`backend/app/api/robots.py` declares `GET /creation-status/{job_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3818454b7f639786", "name": "Unused endpoint: DELETE /{robot_id}", "shortDescription": {"text": "Unused endpoint: DELETE /{robot_id}"}, "fullDescription": {"text": "`backend/app/api/robots.py` declares `DELETE /{robot_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-359e464900424224", "name": "Unused endpoint: DELETE /activity/all", "shortDescription": {"text": "Unused endpoint: DELETE /activity/all"}, "fullDescription": {"text": "`backend/app/api/robots.py` declares `DELETE /activity/all` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-10640d78666bba32", "name": "Unused endpoint: GET /{robot_id}/activity", "shortDescription": {"text": "Unused endpoint: GET /{robot_id}/activity"}, "fullDescription": {"text": "`backend/app/api/robots.py` declares `GET /{robot_id}/activity` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-63d59118e2887601", "name": "Unused endpoint: GET /{robot_id}/skills", "shortDescription": {"text": "Unused endpoint: GET /{robot_id}/skills"}, "fullDescription": {"text": "`backend/app/api/robots.py` declares `GET /{robot_id}/skills` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c6d31928e31a96bf", "name": "Unused endpoint: GET /{robot_id}/memories", "shortDescription": {"text": "Unused endpoint: GET /{robot_id}/memories"}, "fullDescription": {"text": "`backend/app/api/robots.py` declares `GET /{robot_id}/memories` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5baa8971ebe192a1", "name": "Unused endpoint: GET /", "shortDescription": {"text": "Unused endpoint: GET /"}, "fullDescription": {"text": "`backend/app/api/robots.py` declares `GET /` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-078dea1e938e89bb", "name": "Unused endpoint: PATCH /{robot_id}", "shortDescription": {"text": "Unused endpoint: PATCH /{robot_id}"}, "fullDescription": {"text": "`backend/app/api/robots.py` declares `PATCH /{robot_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b2ebc3fc3c83ffd1", "name": "Unused endpoint: GET /{robot_id}", "shortDescription": {"text": "Unused endpoint: GET /{robot_id}"}, "fullDescription": {"text": "`backend/app/api/robots.py` declares `GET /{robot_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-963710f42a2c8219", "name": "Unused endpoint: GET /api/status", "shortDescription": {"text": "Unused endpoint: GET /api/status"}, "fullDescription": {"text": "`backend/app/api/status.py` declares `GET /api/status` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d388b5b75933d1a8", "name": "Unused endpoint: GET /characters", "shortDescription": {"text": "Unused endpoint: GET /characters"}, "fullDescription": {"text": "`backend/app/api/admin.py` declares `GET /characters` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9ac9c1933a0da878", "name": "Unused endpoint: POST /characters/{char_id}/voice-lang", "shortDescription": {"text": "Unused endpoint: POST /characters/{char_id}/voice-lang"}, "fullDescription": {"text": "`backend/app/api/admin.py` declares `POST /characters/{char_id}/voice-lang` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0fa5a1890c36b58f", "name": "Unused endpoint: POST /characters/{char_id}/generate-images", "shortDescription": {"text": "Unused endpoint: POST /characters/{char_id}/generate-images"}, "fullDescription": {"text": "`backend/app/api/admin.py` declares `POST /characters/{char_id}/generate-images` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4bc95d761c4562cd", "name": "Unused endpoint: POST /characters/{char_id}/remove-bg", "shortDescription": {"text": "Unused endpoint: POST /characters/{char_id}/remove-bg"}, "fullDescription": {"text": "`backend/app/api/admin.py` declares `POST /characters/{char_id}/remove-bg` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9f8b8e9179ea084e", "name": "Unused endpoint: POST /characters/{char_id}/upload-voice", "shortDescription": {"text": "Unused endpoint: POST /characters/{char_id}/upload-voice"}, "fullDescription": {"text": "`backend/app/api/admin.py` declares `POST /characters/{char_id}/upload-voice` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ac50e75f6e70a803", "name": "Unused endpoint: POST /characters/{char_id}/upload-reference", "shortDescription": {"text": "Unused endpoint: POST /characters/{char_id}/upload-reference"}, "fullDescription": {"text": "`backend/app/api/admin.py` declares `POST /characters/{char_id}/upload-reference` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-785b0cb551e95559", "name": "Unused endpoint: POST /characters/create", "shortDescription": {"text": "Unused endpoint: POST /characters/create"}, "fullDescription": {"text": "`backend/app/api/admin.py` declares `POST /characters/create` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f6a9b89b89b57a5b", "name": "Unused endpoint: GET /characters/{char_id}/image/{state}", "shortDescription": {"text": "Unused endpoint: GET /characters/{char_id}/image/{state}"}, "fullDescription": {"text": "`backend/app/api/admin.py` declares `GET /characters/{char_id}/image/{state}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-85b303485f8885ff", "name": "Unused endpoint: GET /characters/{char_id}/voice-ref", "shortDescription": {"text": "Unused endpoint: GET /characters/{char_id}/voice-ref"}, "fullDescription": {"text": "`backend/app/api/admin.py` declares `GET /characters/{char_id}/voice-ref` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d662e3ae47d55e03", "name": "Unused endpoint: GET /characters/{char_id}/versions", "shortDescription": {"text": "Unused endpoint: GET /characters/{char_id}/versions"}, "fullDescription": {"text": "`backend/app/api/admin.py` declares `GET /characters/{char_id}/versions` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9c7e2df6ec03b3fd", "name": "Unused endpoint: POST /characters/{char_id}/versions/{version_id}/activate", "shortDescription": {"text": "Unused endpoint: POST /characters/{char_id}/versions/{version_id}/activate"}, "fullDescription": {"text": "`backend/app/api/admin.py` declares `POST /characters/{char_id}/versions/{version_id}/activate` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c0cf12a600606cf6", "name": "Unused endpoint: POST /characters/{char_id}/versions/{version_id}/star", "shortDescription": {"text": "Unused endpoint: POST /characters/{char_id}/versions/{version_id}/star"}, "fullDescription": {"text": "`backend/app/api/admin.py` declares `POST /characters/{char_id}/versions/{version_id}/star` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b44bd61d6dedf65e", "name": "Unused endpoint: GET /characters/{char_id}/versions/{version_id}/file", "shortDescription": {"text": "Unused endpoint: GET /characters/{char_id}/versions/{version_id}/file"}, "fullDescription": {"text": "`backend/app/api/admin.py` declares `GET /characters/{char_id}/versions/{version_id}/file` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fae6a0d85c179af5", "name": "Unused endpoint: GET /characters/{char_id}/memories", "shortDescription": {"text": "Unused endpoint: GET /characters/{char_id}/memories"}, "fullDescription": {"text": "`backend/app/api/admin.py` declares `GET /characters/{char_id}/memories` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-582b00fca2796501", "name": "Unused endpoint: GET /tools", "shortDescription": {"text": "Unused endpoint: GET /tools"}, "fullDescription": {"text": "`backend/app/api/admin.py` declares `GET /tools` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1a58cbed371732ce", "name": "Unused endpoint: PUT /tools/{tool_name}", "shortDescription": {"text": "Unused endpoint: PUT /tools/{tool_name}"}, "fullDescription": {"text": "`backend/app/api/admin.py` declares `PUT /tools/{tool_name}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-844bc08cf00246ee", "name": "Unused endpoint: GET /speak-qwen3", "shortDescription": {"text": "Unused endpoint: GET /speak-qwen3"}, "fullDescription": {"text": "`backend/app/api/tts_qwen3.py` declares `GET /speak-qwen3` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-83368c90586b5733", "name": "Unused endpoint: POST /characters/create-from-web", "shortDescription": {"text": "Unused endpoint: POST /characters/create-from-web"}, "fullDescription": {"text": "`backend/app/api/admin_web_creation.py` declares `POST /characters/create-from-web` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8e2ec7c6317e767f", "name": "Unused endpoint: GET /characters/create-from-web/status/{job_id}", "shortDescription": {"text": "Unused endpoint: GET /characters/create-from-web/status/{job_id}"}, "fullDescription": {"text": "`backend/app/api/admin_web_creation.py` declares `GET /characters/create-from-web/status/{job_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-dd9f84ffb463be6e", "name": "Unused endpoint: POST /characters/{char_id}/build-memories", "shortDescription": {"text": "Unused endpoint: POST /characters/{char_id}/build-memories"}, "fullDescription": {"text": "`backend/app/api/admin_web_creation.py` declares `POST /characters/{char_id}/build-memories` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7de4e88d608e05fe", "name": "Unused endpoint: POST /transcribe", "shortDescription": {"text": "Unused endpoint: POST /transcribe"}, "fullDescription": {"text": "`backend/app/api/stt.py` declares `POST /transcribe` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b829d4b89c082982", "name": "Unused endpoint: POST /idle-chat", "shortDescription": {"text": "Unused endpoint: POST /idle-chat"}, "fullDescription": {"text": "`backend/app/api/agents.py` declares `POST /idle-chat` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a641ecf39e8431f9", "name": "Unused endpoint: POST /react", "shortDescription": {"text": "Unused endpoint: POST /react"}, "fullDescription": {"text": "`backend/app/api/agents.py` declares `POST /react` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-17a164638609b114", "name": "Unused endpoint: POST /search", "shortDescription": {"text": "Unused endpoint: POST /search"}, "fullDescription": {"text": "`backend/app/api/agents.py` declares `POST /search` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/19702"}, "properties": {"repository": "simplelost-chao/nomi", "repoUrl": "https://github.com/simplelost-chao/nomi", "branch": "main"}, "results": [{"ruleId": "scanner-a93ee975321b6e02", "level": "note", "message": {"text": "Possibly dead Python function: remove_listener"}, "properties": {"repobilityId": "83d4f34496364966", "scanner": "scanner-primary", "fingerprint": "a93ee975321b6e02", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/services/heartbeat.py:157"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2c6450f97ac29845", "level": "note", "message": {"text": "Possibly dead Python function: create_robot_from_object"}, "properties": {"repobilityId": "d4d7d920a145c6a5", "scanner": "scanner-primary", "fingerprint": "2c6450f97ac29845", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/services/robot.py:23"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-627d9a47966dae5c", "level": "note", "message": {"text": "Possibly dead Python function: process_bind_param"}, "properties": {"repobilityId": "a51428934072abb6", "scanner": "scanner-primary", "fingerprint": "627d9a47966dae5c", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/db/models_sqlite.py:45"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-fc519aaeda8ffdd0", "level": "note", "message": {"text": "Possibly dead Python function: process_result_value"}, "properties": {"repobilityId": "2b4ef95eaf3928de", "scanner": "scanner-primary", "fingerprint": "fc519aaeda8ffdd0", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/db/models_sqlite.py:50"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-24c3c0fee041123e", "level": "note", "message": {"text": "Possibly dead Python function: build_life_moments_prompt"}, "properties": {"repobilityId": "45ad0313f113d5c0", "scanner": "scanner-primary", "fingerprint": "24c3c0fee041123e", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/prompts/creation.py:348"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3b41bdd8fdb34d58", "level": "note", "message": {"text": "Possibly dead Python function: build_moment_detail_prompt"}, "properties": {"repobilityId": "a84c4a3959eebb8b", "scanner": "scanner-primary", "fingerprint": "3b41bdd8fdb34d58", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/prompts/creation.py:351"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1a69454fdb2bbaca", "level": "note", "message": {"text": "Possibly dead Python function: build_moment_summary_prompt"}, "properties": {"repobilityId": "2bba62d3fb680521", "scanner": "scanner-primary", "fingerprint": "1a69454fdb2bbaca", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/prompts/creation.py:354"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-950f47b30bbf568b", "level": "note", "message": {"text": "Possibly dead Python function: do_run_migrations"}, "properties": {"repobilityId": "087acb17722cfd2f", "scanner": "scanner-primary", "fingerprint": "950f47b30bbf568b", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/alembic/env.py:27"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d6666216510e1ef0", "level": "note", "message": {"text": "Possibly dead Python function: upgrade"}, "properties": {"repobilityId": "cf0b8e5e6e2f8bc4", "scanner": "scanner-primary", "fingerprint": "d6666216510e1ef0", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/alembic/versions/b2c3d4e5f6a7_add_memory_layer.py:17"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ab3c1f5cd30a9ea4", "level": "note", "message": {"text": "Possibly dead Python function: downgrade"}, "properties": {"repobilityId": "c03debbf11efa0c5", "scanner": "scanner-primary", "fingerprint": "ab3c1f5cd30a9ea4", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/alembic/versions/b2c3d4e5f6a7_add_memory_layer.py:21"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1310a864becd3b62", "level": "note", "message": {"text": "Possibly dead Python function: upgrade"}, "properties": {"repobilityId": "cf0b8e5e6e2f8bc4", "scanner": "scanner-primary", "fingerprint": "1310a864becd3b62", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/alembic/versions/f9d645c515d6_add_tool_name_to_robot_skills.py:21"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5e317d211bbf2147", "level": "note", "message": {"text": "Possibly dead Python function: downgrade"}, "properties": {"repobilityId": "c03debbf11efa0c5", "scanner": "scanner-primary", "fingerprint": "5e317d211bbf2147", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/alembic/versions/f9d645c515d6_add_tool_name_to_robot_skills.py:25"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b47afd5f7df5458d", "level": "note", "message": {"text": "Possibly dead Python function: upgrade"}, "properties": {"repobilityId": "cf0b8e5e6e2f8bc4", "scanner": "scanner-primary", "fingerprint": "b47afd5f7df5458d", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/alembic/versions/66c72ef2d99a_add_batch_index_to_yearly_memories.py:21"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2427c97affa93429", "level": "note", "message": {"text": "Possibly dead Python function: downgrade"}, "properties": {"repobilityId": "c03debbf11efa0c5", "scanner": "scanner-primary", "fingerprint": "2427c97affa93429", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/alembic/versions/66c72ef2d99a_add_batch_index_to_yearly_memories.py:28"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-da9480529de94628", "level": "note", "message": {"text": "Possibly dead Python function: upgrade"}, "properties": {"repobilityId": "cf0b8e5e6e2f8bc4", "scanner": "scanner-primary", "fingerprint": "da9480529de94628", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/alembic/versions/d82eedec33e0_add_activity_logs_table.py:21"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-377d07a05f6b07a9", "level": "note", "message": {"text": "Possibly dead Python function: downgrade"}, "properties": {"repobilityId": "c03debbf11efa0c5", "scanner": "scanner-primary", "fingerprint": "377d07a05f6b07a9", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/alembic/versions/d82eedec33e0_add_activity_logs_table.py:37"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0273b2754db41251", "level": "note", "message": {"text": "Possibly dead Python function: upgrade"}, "properties": {"repobilityId": "cf0b8e5e6e2f8bc4", "scanner": "scanner-primary", "fingerprint": "0273b2754db41251", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/alembic/versions/f87721d7f0c2_add_robot_skills_table.py:21"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-42c84175cb43747b", "level": "note", "message": {"text": "Possibly dead Python function: downgrade"}, "properties": {"repobilityId": "c03debbf11efa0c5", "scanner": "scanner-primary", "fingerprint": "42c84175cb43747b", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/alembic/versions/f87721d7f0c2_add_robot_skills_table.py:41"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-fea896b8b7f98eb4", "level": "note", "message": {"text": "Possibly dead Python function: upgrade"}, "properties": {"repobilityId": "cf0b8e5e6e2f8bc4", "scanner": "scanner-primary", "fingerprint": "fea896b8b7f98eb4", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/alembic/versions/39c38b95bc32_add_memory_strength_and_importance_to_.py:21"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7bd8e2472d5c338f", "level": "note", "message": {"text": "Possibly dead Python function: downgrade"}, "properties": {"repobilityId": "c03debbf11efa0c5", "scanner": "scanner-primary", "fingerprint": "7bd8e2472d5c338f", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/alembic/versions/39c38b95bc32_add_memory_strength_and_importance_to_.py:29"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d87c7a6c6a5be961", "level": "note", "message": {"text": "Possibly dead Python function: upgrade"}, "properties": {"repobilityId": "cf0b8e5e6e2f8bc4", "scanner": "scanner-primary", "fingerprint": "d87c7a6c6a5be961", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/alembic/versions/ae36e5831db0_add_asset_versions_table.py:21"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a7e6652b5afba67c", "level": "note", "message": {"text": "Possibly dead Python function: downgrade"}, "properties": {"repobilityId": "c03debbf11efa0c5", "scanner": "scanner-primary", "fingerprint": "a7e6652b5afba67c", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/alembic/versions/ae36e5831db0_add_asset_versions_table.py:41"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3e508216d6f43e68", "level": "note", "message": {"text": "Possibly dead Python function: upgrade"}, "properties": {"repobilityId": "cf0b8e5e6e2f8bc4", "scanner": "scanner-primary", "fingerprint": "3e508216d6f43e68", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/alembic/versions/57fbf61d4fcf_add_relationships_snapshot_to_robots.py:21"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f9055af3d6ace099", "level": "note", "message": {"text": "Possibly dead Python function: downgrade"}, "properties": {"repobilityId": "c03debbf11efa0c5", "scanner": "scanner-primary", "fingerprint": "f9055af3d6ace099", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/alembic/versions/57fbf61d4fcf_add_relationships_snapshot_to_robots.py:28"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f9f35fb911d0e12c", "level": "note", "message": {"text": "Possibly dead Python function: upgrade"}, "properties": {"repobilityId": "cf0b8e5e6e2f8bc4", "scanner": "scanner-primary", "fingerprint": "f9f35fb911d0e12c", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/alembic/versions/9346fcfb1039_add_desktop_visible_to_robots.py:21"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e2f845e8b24436b1", "level": "note", "message": {"text": "Possibly dead Python function: downgrade"}, "properties": {"repobilityId": "c03debbf11efa0c5", "scanner": "scanner-primary", "fingerprint": "e2f845e8b24436b1", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/alembic/versions/9346fcfb1039_add_desktop_visible_to_robots.py:28"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4affb636399d8ba2", "level": "note", "message": {"text": "Possibly dead Python function: upgrade"}, "properties": {"repobilityId": "cf0b8e5e6e2f8bc4", "scanner": "scanner-primary", "fingerprint": "4affb636399d8ba2", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/alembic/versions/5ee4eb5eea8e_add_memory_evolution_fields.py:21"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-30f81bddf9d1c424", "level": "note", "message": {"text": "Possibly dead Python function: downgrade"}, "properties": {"repobilityId": "c03debbf11efa0c5", "scanner": "scanner-primary", "fingerprint": "30f81bddf9d1c424", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/alembic/versions/5ee4eb5eea8e_add_memory_evolution_fields.py:33"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d7a9cb26abe3011e", "level": "note", "message": {"text": "Possibly dead Python function: upgrade"}, "properties": {"repobilityId": "cf0b8e5e6e2f8bc4", "scanner": "scanner-primary", "fingerprint": "d7a9cb26abe3011e", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/alembic/versions/a0e12534ebb0_add_energy_field.py:21"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7825c13e364846e9", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 frontend/src/app/api/tts/speak/route.ts:14"}, "properties": {"repobilityId": "1e23571948fc5791", "scanner": "scanner-primary", "fingerprint": "7825c13e364846e9", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-4a3a8d4cda0f80dc", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 frontend/src/app/group-chat/page.tsx:618"}, "properties": {"repobilityId": "d3a04d0d00bf4a4d", "scanner": "scanner-primary", "fingerprint": "4a3a8d4cda0f80dc", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-fe1f0bd81d1376dc", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 desktop/src/renderer/api.ts:39"}, "properties": {"repobilityId": "ce309278727e04c3", "scanner": "scanner-primary", "fingerprint": "fe1f0bd81d1376dc", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-3c65a4d16e9efd61", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 desktop/src/renderer/App.tsx:227"}, "properties": {"repobilityId": "d27293b1db589f7f", "scanner": "scanner-primary", "fingerprint": "3c65a4d16e9efd61", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-7571e8a9f0862e36", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 desktop/src/main/backend.ts:36"}, "properties": {"repobilityId": "fd796920f1f2af57", "scanner": "scanner-primary", "fingerprint": "7571e8a9f0862e36", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-e8e8a874dcc6d26c", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 desktop/src/main/index.ts:92"}, "properties": {"repobilityId": "91eae312176fe5ec", "scanner": "scanner-primary", "fingerprint": "e8e8a874dcc6d26c", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-491e61901dd82bde", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 desktop/src/main/ipc.ts:51"}, "properties": {"repobilityId": "012a163b7de8866e", "scanner": "scanner-primary", "fingerprint": "491e61901dd82bde", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-80f28e5ac86a769c", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 desktop/src/main/agent/sensor-manager.ts:59"}, "properties": {"repobilityId": "e85c63fb2b70c580", "scanner": "scanner-primary", "fingerprint": "80f28e5ac86a769c", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-98ad9f8894a4f62a", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 desktop/src/main/agent/screen-sensor.ts:68"}, "properties": {"repobilityId": "0e0f897129258de8", "scanner": "scanner-primary", "fingerprint": "98ad9f8894a4f62a", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-60427b03771411b6", "level": "warning", "message": {"text": "Dockerfile runs as root: frontend/Dockerfile"}, "properties": {"repobilityId": "735c01d8531dfd2c", "scanner": "scanner-primary", "fingerprint": "60427b03771411b6", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-6f6b2022eed0806a", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: node:22-slim"}, "properties": {"repobilityId": "16d79e2e1ae9cf40", "scanner": "scanner-primary", "fingerprint": "6f6b2022eed0806a", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/Dockerfile"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1f66ad88286ca30a", "level": "warning", "message": {"text": "Dockerfile runs as root: backend/Dockerfile"}, "properties": {"repobilityId": "7afd2b0e8a8c9eeb", "scanner": "scanner-primary", "fingerprint": "1f66ad88286ca30a", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-714c31ca9f474ae6", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.12-slim"}, "properties": {"repobilityId": "f614a1e41f331b37", "scanner": "scanner-primary", "fingerprint": "714c31ca9f474ae6", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/Dockerfile"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-aa5acaa49eb8315b", "level": "note", "message": {"text": "Containers defined but no K8s/orchestration manifest found"}, "properties": {"repobilityId": "b230ea9b68736081", "scanner": "scanner-primary", "fingerprint": "aa5acaa49eb8315b", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["coverage", "deployment"]}}, {"ruleId": "scanner-d51394c24fab39ae", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in desktop/assets/characters/preview.html:199"}, "properties": {"repobilityId": "d8e9599ff771dd08", "scanner": "scanner-primary", "fingerprint": "d51394c24fab39ae", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "desktop/assets/characters/preview.html"}, "region": {"startLine": 199}}}]}, {"ruleId": "scanner-7d6509f43f939819", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in desktop/src/main/backend.ts:1"}, "properties": {"repobilityId": "c432cd959c9e3a98", "scanner": "scanner-primary", "fingerprint": "7d6509f43f939819", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "desktop/src/main/backend.ts"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b4ee373e43869f10", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in desktop/src/main/index.ts:102"}, "properties": {"repobilityId": "c4af7e1de222788a", "scanner": "scanner-primary", "fingerprint": "b4ee373e43869f10", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "desktop/src/main/index.ts"}, "region": {"startLine": 102}}}]}, {"ruleId": "scanner-1977e3e62920d08b", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in desktop/src/main/ipc.ts:52"}, "properties": {"repobilityId": "860b8facccf081c2", "scanner": "scanner-primary", "fingerprint": "1977e3e62920d08b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "desktop/src/main/ipc.ts"}, "region": {"startLine": 52}}}]}, {"ruleId": "scanner-f7852282ca246840", "level": "error", "message": {"text": "Insecure pattern 'exec_used' in desktop/src/main/agent/app-sensor.ts:24"}, "properties": {"repobilityId": "96eb955ee5a549a5", "scanner": "scanner-primary", "fingerprint": "f7852282ca246840", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "exec_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "desktop/src/main/agent/app-sensor.ts"}, "region": {"startLine": 24}}}]}, {"ruleId": "scanner-66b92b22fde40802", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in desktop/src/main/agent/app-sensor.ts:1"}, "properties": {"repobilityId": "2f88d66443b3d18d", "scanner": "scanner-primary", "fingerprint": "66b92b22fde40802", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "desktop/src/main/agent/app-sensor.ts"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0af9f85198971c9b", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in desktop/src/main/agent/screen-sensor.ts:77"}, "properties": {"repobilityId": "d1ba4c666e2a7ada", "scanner": "scanner-primary", "fingerprint": "0af9f85198971c9b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "desktop/src/main/agent/screen-sensor.ts"}, "region": {"startLine": 77}}}]}, {"ruleId": "scanner-e2f322b6e806b8e3", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in backend/app/admin_panel.html:409"}, "properties": {"repobilityId": "27f22aa7c61cc5fc", "scanner": "scanner-primary", "fingerprint": "e2f322b6e806b8e3", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/admin_panel.html"}, "region": {"startLine": 409}}}]}, {"ruleId": "scanner-6372cebde0220094", "level": "warning", "message": {"text": "No auth library detected"}, "properties": {"repobilityId": "a5b6035a5bbf8054", "scanner": "scanner-primary", "fingerprint": "6372cebde0220094", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["coverage", "auth"]}}, {"ruleId": "scanner-4601e3ad3bb28677", "level": "warning", "message": {"text": "No CI/CD pipelines detected"}, "properties": {"repobilityId": "c3ee439bce2bc51e", "scanner": "scanner-primary", "fingerprint": "4601e3ad3bb28677", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-ea3b5e389d8c9c0f", "level": "note", "message": {"text": "Low test-to-source ratio"}, "properties": {"repobilityId": "ef7b2552cc00a375", "scanner": "scanner-primary", "fingerprint": "ea3b5e389d8c9c0f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["tests"]}}, {"ruleId": "scanner-141b30a41e03817b", "level": "note", "message": {"text": "No license file detected"}, "properties": {"repobilityId": "132a5f851d8b3cca", "scanner": "scanner-primary", "fingerprint": "141b30a41e03817b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["license", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "7d18038dc03ea60c", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "00d313be7dd28188", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-b9088664ace7f748", "level": "note", "message": {"text": "Composite production-readiness gap"}, "properties": {"repobilityId": "cf3ada123d46ba7f", "scanner": "scanner-primary", "fingerprint": "b9088664ace7f748", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["production-readiness", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-749d4bc1bd66df5f", "level": "warning", "message": {"text": "Agent instructions exist but release-hardening basics are missing"}, "properties": {"repobilityId": "f670464d13ad47ea", "scanner": "scanner-primary", "fingerprint": "749d4bc1bd66df5f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "475b3f786c9e0ac7", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "c1c97972d495150c", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-5dae24a8be607801", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/src/app/page.tsx:354"}, "properties": {"repobilityId": "9ed26d3d6ef45a05", "scanner": "scanner-primary", "fingerprint": "5dae24a8be607801", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-b055a19226c6df68", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/src/app/api/objects/observe/route.ts:8"}, "properties": {"repobilityId": "76626888a2e392eb", "scanner": "scanner-primary", "fingerprint": "b055a19226c6df68", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-44aebd045fb3f645", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/src/app/api/robots/[id]/route.ts:10"}, "properties": {"repobilityId": "6100c6371c215970", "scanner": "scanner-primary", "fingerprint": "44aebd045fb3f645", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-48049774e42a97c1", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/src/app/api/robots/[id]/activity/route.ts:12"}, "properties": {"repobilityId": "d855c580a37c5b6b", "scanner": "scanner-primary", "fingerprint": "48049774e42a97c1", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-315f49059ce25579", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/src/app/api/robots/[id]/skills/route.ts:10"}, "properties": {"repobilityId": "e276d315f7cc3d54", "scanner": "scanner-primary", "fingerprint": "315f49059ce25579", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-da3ae93c3d296349", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/src/app/api/robots/from-image/route.ts:8"}, "properties": {"repobilityId": "379e26bcbea93447", "scanner": "scanner-primary", "fingerprint": "da3ae93c3d296349", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-b0e3d87f405a2e80", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/src/app/api/robots/creation-status/[jobId]/route.ts:11"}, "properties": {"repobilityId": "841a8487357bd61b", "scanner": "scanner-primary", "fingerprint": "b0e3d87f405a2e80", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-df6e327c185ecce3", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/src/app/api/tts/regenerate/[robotId]/route.ts:10"}, "properties": {"repobilityId": "61f9e723845eea28", "scanner": "scanner-primary", "fingerprint": "df6e327c185ecce3", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-43190efc0722443a", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/src/app/api/heartbeat/trigger/[robotId]/[action]/route.ts:10"}, "properties": {"repobilityId": "5a7e6e40399e049f", "scanner": "scanner-primary", "fingerprint": "43190efc0722443a", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-b380bf13d3af6393", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/src/app/api/heartbeat/interval/route.ts:8"}, "properties": {"repobilityId": "beda1d8a340af627", "scanner": "scanner-primary", "fingerprint": "b380bf13d3af6393", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-d2c2db7e245f4914", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/src/app/api/heartbeat/busy/route.ts:8"}, "properties": {"repobilityId": "ea8ff624a42501db", "scanner": "scanner-primary", "fingerprint": "d2c2db7e245f4914", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-40a5134f1406c90f", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/src/app/api/stt/transcribe/route.ts:7"}, "properties": {"repobilityId": "be36bb6b0f356e72", "scanner": "scanner-primary", "fingerprint": "40a5134f1406c90f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-d924415a48fcdf8a", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/src/lib/api.ts:4"}, "properties": {"repobilityId": "8414eb867710806b", "scanner": "scanner-primary", "fingerprint": "d924415a48fcdf8a", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-a12f16268a36e652", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 desktop/src/renderer/api.ts:6"}, "properties": {"repobilityId": "f3fbee2535bac38d", "scanner": "scanner-primary", "fingerprint": "a12f16268a36e652", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-f5f52c117cf7367b", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 desktop/src/renderer/components/VoiceButton.tsx:39"}, "properties": {"repobilityId": "df30fa3984d15693", "scanner": "scanner-primary", "fingerprint": "f5f52c117cf7367b", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-58167b4ececd2487", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 desktop/src/renderer/public/live2dcubismcore.min.js:9"}, "properties": {"repobilityId": "d0aa4f43c0535d94", "scanner": "scanner-primary", "fingerprint": "58167b4ececd2487", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-affbeb82dc339051", "level": "none", "message": {"text": "Commented-code block (6 lines) in backend/tests/test_sleep_cycle.py:52"}, "properties": {"repobilityId": "eaaff15b521e9465", "scanner": "scanner-primary", "fingerprint": "affbeb82dc339051", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-15a4b410e1e3e349", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 backend/app/api/tts.py:515"}, "properties": {"repobilityId": "761b98a70c2c2282", "scanner": "scanner-primary", "fingerprint": "15a4b410e1e3e349", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-250f57e8a1dbd3c5", "level": "none", "message": {"text": "4 env vars used in code but missing from .env.example"}, "properties": {"repobilityId": "57584f22b735b5ee", "scanner": "scanner-primary", "fingerprint": "250f57e8a1dbd3c5", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "config-drift"]}}, {"ruleId": "scanner-33a6b62e30ce7ab4", "level": "note", "message": {"text": "Near-duplicate function bodies in 6 places"}, "properties": {"repobilityId": "7ce941ff1ae23b7b", "scanner": "scanner-primary", "fingerprint": "33a6b62e30ce7ab4", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-33a6b62e30ce7ab4", "level": "note", "message": {"text": "Near-duplicate function bodies in 6 places"}, "properties": {"repobilityId": "f2aa09154a9a69a1", "scanner": "scanner-primary", "fingerprint": "33a6b62e30ce7ab4", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "4c74157fcec04e00", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "d00cfeab0b09049a", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "b49597b438493415", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "f343114189172196", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "436685d8e464d1b7", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "4e0a6c49a1776d8f", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-c34db5bde2c83c1f", "level": "error", "message": {"text": "FastAPI POST `wake` without auth dependency \u2014 backend/app/api/heartbeat.py:36"}, "properties": {"repobilityId": "2b6a53abef2723da", "scanner": "scanner-primary", "fingerprint": "c34db5bde2c83c1f", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/api/heartbeat.py"}, "region": {"startLine": 36}}}]}, {"ruleId": "scanner-85b4a55de5fa3346", "level": "error", "message": {"text": "FastAPI POST `sleep` without auth dependency \u2014 backend/app/api/heartbeat.py:45"}, "properties": {"repobilityId": "ffc8c4aa85059b38", "scanner": "scanner-primary", "fingerprint": "85b4a55de5fa3346", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/api/heartbeat.py"}, "region": {"startLine": 45}}}]}, {"ruleId": "scanner-c1238e063cf927b2", "level": "error", "message": {"text": "FastAPI POST `busy` without auth dependency \u2014 backend/app/api/heartbeat.py:51"}, "properties": {"repobilityId": "18ed61e4e4b575c1", "scanner": "scanner-primary", "fingerprint": "c1238e063cf927b2", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/api/heartbeat.py"}, "region": {"startLine": 51}}}]}, {"ruleId": "scanner-78c19c47b12c9506", "level": "error", "message": {"text": "FastAPI POST `set_interval` without auth dependency \u2014 backend/app/api/heartbeat.py:58"}, "properties": {"repobilityId": "8892710d7155be39", "scanner": "scanner-primary", "fingerprint": "78c19c47b12c9506", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/api/heartbeat.py"}, "region": {"startLine": 58}}}]}, {"ruleId": "scanner-c56b70c054631878", "level": "error", "message": {"text": "FastAPI POST `trigger_action` without auth dependency \u2014 backend/app/api/heartbeat.py:114"}, "properties": {"repobilityId": "3c63bbc709b5dbc7", "scanner": "scanner-primary", "fingerprint": "c56b70c054631878", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/api/heartbeat.py"}, "region": {"startLine": 114}}}]}, {"ruleId": "scanner-1d8c983ea0d74de1", "level": "error", "message": {"text": "FastAPI POST `create_robot_from_image` without auth dependency \u2014 backend/app/api/robots.py:40"}, "properties": {"repobilityId": "7558e553c438582e", "scanner": "scanner-primary", "fingerprint": "1d8c983ea0d74de1", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/api/robots.py"}, "region": {"startLine": 40}}}]}, {"ruleId": "scanner-1e1314f4167d5c01", "level": "error", "message": {"text": "FastAPI POST `set_voice_lang` without auth dependency \u2014 backend/app/api/admin.py:91"}, "properties": {"repobilityId": "0a6a05e868cec70c", "scanner": "scanner-primary", "fingerprint": "1e1314f4167d5c01", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/api/admin.py"}, "region": {"startLine": 91}}}]}, {"ruleId": "scanner-9bf463cf78f97cf4", "level": "error", "message": {"text": "FastAPI POST `generate_images` without auth dependency \u2014 backend/app/api/admin.py:108"}, "properties": {"repobilityId": "80298c3fe59b4cd9", "scanner": "scanner-primary", "fingerprint": "9bf463cf78f97cf4", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/api/admin.py"}, "region": {"startLine": 108}}}]}, {"ruleId": "scanner-e98167cdc7c8405f", "level": "error", "message": {"text": "FastAPI POST `remove_backgrounds` without auth dependency \u2014 backend/app/api/admin.py:184"}, "properties": {"repobilityId": "10eb78879e847ef4", "scanner": "scanner-primary", "fingerprint": "e98167cdc7c8405f", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/api/admin.py"}, "region": {"startLine": 184}}}]}, {"ruleId": "scanner-ea7dbc203eae4fe4", "level": "error", "message": {"text": "FastAPI POST `upload_voice` without auth dependency \u2014 backend/app/api/admin.py:227"}, "properties": {"repobilityId": "84f951134fde581e", "scanner": "scanner-primary", "fingerprint": "ea7dbc203eae4fe4", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/api/admin.py"}, "region": {"startLine": 227}}}]}, {"ruleId": "scanner-a856ad73432d3862", "level": "error", "message": {"text": "FastAPI POST `upload_reference` without auth dependency \u2014 backend/app/api/admin.py:260"}, "properties": {"repobilityId": "b95f2472910f16bc", "scanner": "scanner-primary", "fingerprint": "a856ad73432d3862", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/api/admin.py"}, "region": {"startLine": 260}}}]}, {"ruleId": "scanner-358c53f35b141def", "level": "error", "message": {"text": "FastAPI POST `create_character` without auth dependency \u2014 backend/app/api/admin.py:283"}, "properties": {"repobilityId": "1783eec3a347d6f5", "scanner": "scanner-primary", "fingerprint": "358c53f35b141def", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/api/admin.py"}, "region": {"startLine": 283}}}]}, {"ruleId": "scanner-2208b9c2c9a98f9e", "level": "error", "message": {"text": "FastAPI POST `activate_version` without auth dependency \u2014 backend/app/api/admin.py:464"}, "properties": {"repobilityId": "639a887a79950f1f", "scanner": "scanner-primary", "fingerprint": "2208b9c2c9a98f9e", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/api/admin.py"}, "region": {"startLine": 464}}}]}, {"ruleId": "scanner-83e4c045be3c3e38", "level": "error", "message": {"text": "FastAPI POST `toggle_star` without auth dependency \u2014 backend/app/api/admin.py:502"}, "properties": {"repobilityId": "dbc77e64d6eeae2f", "scanner": "scanner-primary", "fingerprint": "83e4c045be3c3e38", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/api/admin.py"}, "region": {"startLine": 502}}}]}, {"ruleId": "scanner-b4a308d1b2352198", "level": "error", "message": {"text": "FastAPI POST `create_from_web` without auth dependency \u2014 backend/app/api/admin_web_creation.py:29"}, "properties": {"repobilityId": "6df5da64feea6748", "scanner": "scanner-primary", "fingerprint": "b4a308d1b2352198", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/api/admin_web_creation.py"}, "region": {"startLine": 29}}}]}, {"ruleId": "scanner-5790eeb257f5a6b9", "level": "error", "message": {"text": "FastAPI POST `build_memories_for_existing` without auth dependency \u2014 backend/app/api/admin_web_creation.py:57"}, "properties": {"repobilityId": "dfb15bf6b31a668b", "scanner": "scanner-primary", "fingerprint": "5790eeb257f5a6b9", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/api/admin_web_creation.py"}, "region": {"startLine": 57}}}]}, {"ruleId": "scanner-36471596e57829c0", "level": "error", "message": {"text": "FastAPI POST `transcribe` without auth dependency \u2014 backend/app/api/stt.py:25"}, "properties": {"repobilityId": "be7bbb8215957dce", "scanner": "scanner-primary", "fingerprint": "36471596e57829c0", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/api/stt.py"}, "region": {"startLine": 25}}}]}, {"ruleId": "scanner-c020b7f4bcb8eb6a", "level": "error", "message": {"text": "FastAPI POST `set_tts_config` without auth dependency \u2014 backend/app/api/tts_genie.py:73"}, "properties": {"repobilityId": "0d2ed8be2996cc40", "scanner": "scanner-primary", "fingerprint": "c020b7f4bcb8eb6a", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/api/tts_genie.py"}, "region": {"startLine": 73}}}]}, {"ruleId": "scanner-6899fd76093b464f", "level": "error", "message": {"text": "Dangling fetch: GET /api/robots/creation-status/${jobId} (frontend/src/app/page.tsx:56)"}, "properties": {"repobilityId": "7e9479946379c1a4", "scanner": "scanner-primary", "fingerprint": "6899fd76093b464f", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-0bf09b136fa4aee2", "level": "error", "message": {"text": "Dangling fetch: POST /api/robots/from-image (frontend/src/app/page.tsx:112)"}, "properties": {"repobilityId": "5224201c89eda48d", "scanner": "scanner-primary", "fingerprint": "0bf09b136fa4aee2", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-07e1fbf4669638a1", "level": "error", "message": {"text": "Dangling fetch: DELETE /api/conversations/all (frontend/src/app/page.tsx:354)"}, "properties": {"repobilityId": "eb23065657feefbc", "scanner": "scanner-primary", "fingerprint": "07e1fbf4669638a1", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-60b103866cdaef23", "level": "error", "message": {"text": "Dangling fetch: DELETE /api/robots/activity/all (frontend/src/app/page.tsx:365)"}, "properties": {"repobilityId": "c2ab9195eaa4adca", "scanner": "scanner-primary", "fingerprint": "60b103866cdaef23", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-87fbfbde71573ac2", "level": "error", "message": {"text": "Dangling fetch: GET /api/heartbeat/status (frontend/src/app/group-chat/page.tsx:144)"}, "properties": {"repobilityId": "6463d43ed8ec6e2a", "scanner": "scanner-primary", "fingerprint": "87fbfbde71573ac2", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-8c373fcccf4ed61b", "level": "error", "message": {"text": "Dangling fetch: POST /api/heartbeat/busy?busy=${busy} (frontend/src/app/group-chat/page.tsx:165)"}, "properties": {"repobilityId": "470046cf67a0c2b7", "scanner": "scanner-primary", "fingerprint": "8c373fcccf4ed61b", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-3ab522793f89df65", "level": "error", "message": {"text": "Dangling fetch: GET /api/heartbeat/events?after=${lastSeq.current}&_t=${Date.now()} (frontend/src/app/group-chat/page.tsx:191)"}, "properties": {"repobilityId": "0cea12d727afc292", "scanner": "scanner-primary", "fingerprint": "3ab522793f89df65", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-62354a276d436bdb", "level": "error", "message": {"text": "Dangling fetch: POST /api/stt/transcribe (frontend/src/app/group-chat/page.tsx:351)"}, "properties": {"repobilityId": "c475ae00eeedb92a", "scanner": "scanner-primary", "fingerprint": "62354a276d436bdb", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-e956abd59bd39f7a", "level": "error", "message": {"text": "Dangling fetch: POST /api/heartbeat/sleep (frontend/src/app/group-chat/page.tsx:390)"}, "properties": {"repobilityId": "b05042ec270343cc", "scanner": "scanner-primary", "fingerprint": "e956abd59bd39f7a", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-e031a1de72589ff8", "level": "error", "message": {"text": "Dangling fetch: POST /api/heartbeat/wake (frontend/src/app/group-chat/page.tsx:394)"}, "properties": {"repobilityId": "590a63c0d7e490c6", "scanner": "scanner-primary", "fingerprint": "e031a1de72589ff8", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-98f65d171d450198", "level": "error", "message": {"text": "Dangling fetch: POST /api/heartbeat/wake (frontend/src/app/group-chat/page.tsx:410)"}, "properties": {"repobilityId": "0cf177762511a2a1", "scanner": "scanner-primary", "fingerprint": "98f65d171d450198", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-9dbd79f894fb449c", "level": "error", "message": {"text": "Dangling fetch: POST /api/heartbeat/interval?seconds=${v} (frontend/src/app/group-chat/page.tsx:517)"}, "properties": {"repobilityId": "b22ae4f8ce89c037", "scanner": "scanner-primary", "fingerprint": "9dbd79f894fb449c", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-04c26789b0ec1cb3", "level": "error", "message": {"text": "Dangling fetch: POST https://nomi-api.zhuchao.life/api/robots/from-image (frontend/src/lib/api.ts:26)"}, "properties": {"repobilityId": "f8a3cffb3e31486e", "scanner": "scanner-primary", "fingerprint": "04c26789b0ec1cb3", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-e0e88974ddf7ffe9", "level": "error", "message": {"text": "Dangling fetch: POST https://nomi-api.zhuchao.life/api/agents/idle-chat (frontend/src/lib/api.ts:76)"}, "properties": {"repobilityId": "636ec80e167f2587", "scanner": "scanner-primary", "fingerprint": "e0e88974ddf7ffe9", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-c615c464bf00f5f1", "level": "error", "message": {"text": "Dangling fetch: POST /api/robots (frontend/src/lib/api.ts:16)"}, "properties": {"repobilityId": "21ee48b9f44d15b5", "scanner": "scanner-primary", "fingerprint": "c615c464bf00f5f1", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "helper:request"]}}, {"ruleId": "scanner-cefdd903ba84005c", "level": "error", "message": {"text": "Dangling fetch: GET /api/robots (frontend/src/lib/api.ts:33)"}, "properties": {"repobilityId": "b70d011b2c000224", "scanner": "scanner-primary", "fingerprint": "cefdd903ba84005c", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "helper:request"]}}, {"ruleId": "scanner-aed52d3179b7b260", "level": "error", "message": {"text": "Dangling fetch: GET /api/robots/${id} (frontend/src/lib/api.ts:36)"}, "properties": {"repobilityId": "b5cbf1c2ec903911", "scanner": "scanner-primary", "fingerprint": "aed52d3179b7b260", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "helper:request"]}}, {"ruleId": "scanner-0dbd7f589f4d8636", "level": "error", "message": {"text": "Dangling fetch: POST /api/objects/observe (frontend/src/lib/api.ts:39)"}, "properties": {"repobilityId": "775bf9943e568e40", "scanner": "scanner-primary", "fingerprint": "0dbd7f589f4d8636", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "helper:request"]}}, {"ruleId": "scanner-996774b7dad672e0", "level": "error", "message": {"text": "Dangling fetch: POST /api/conversations (frontend/src/lib/api.ts:48)"}, "properties": {"repobilityId": "4a79811201b6d967", "scanner": "scanner-primary", "fingerprint": "996774b7dad672e0", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "helper:request"]}}, {"ruleId": "scanner-5d6bf209f895720a", "level": "error", "message": {"text": "Dangling fetch: DELETE /api/robots/${id} (frontend/src/lib/api.ts:61)"}, "properties": {"repobilityId": "6601495e51202397", "scanner": "scanner-primary", "fingerprint": "5d6bf209f895720a", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "helper:request"]}}, {"ruleId": "scanner-6270268d9cab4306", "level": "error", "message": {"text": "Dangling fetch: GET /api/conversations/models (frontend/src/lib/api.ts:63)"}, "properties": {"repobilityId": "c26e70ad5a220e27", "scanner": "scanner-primary", "fingerprint": "6270268d9cab4306", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "helper:request"]}}, {"ruleId": "scanner-5685b534ed2c70fe", "level": "error", "message": {"text": "Dangling fetch: GET /api/robots?desktop=true (desktop/src/renderer/api.ts:59)"}, "properties": {"repobilityId": "25e32b76b441e05e", "scanner": "scanner-primary", "fingerprint": "5685b534ed2c70fe", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "helper:request"]}}, {"ruleId": "scanner-b77b869fad4a0cbd", "level": "error", "message": {"text": "Dangling fetch: POST /api/conversations (desktop/src/renderer/api.ts:62)"}, "properties": {"repobilityId": "18269ecd7b9ddd2f", "scanner": "scanner-primary", "fingerprint": "b77b869fad4a0cbd", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "helper:request"]}}, {"ruleId": "scanner-653e43be7262f736", "level": "error", "message": {"text": "Dangling fetch: GET /api/conversations/latest (desktop/src/renderer/api.ts:74)"}, "properties": {"repobilityId": "e39f9f0393397751", "scanner": "scanner-primary", "fingerprint": "653e43be7262f736", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "helper:request"]}}, {"ruleId": "scanner-7e7b6e94a7369a48", "level": "error", "message": {"text": "Dangling fetch: POST http://127.0.0.1:8100/api/stt/transcribe (desktop/src/renderer/components/VoiceButton.tsx:39)"}, "properties": {"repobilityId": "fa03ed560225a74e", "scanner": "scanner-primary", "fingerprint": "7e7b6e94a7369a48", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-4756b4c4da7d2088", "level": "note", "message": {"text": "Unused endpoint: GET /api/health"}, "properties": {"repobilityId": "414de3a0f9ad89dd", "scanner": "scanner-primary", "fingerprint": "4756b4c4da7d2088", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-953ec1a0ee6df50d", "level": "note", "message": {"text": "Unused endpoint: GET /admin"}, "properties": {"repobilityId": "dd6a13f5d063e5ba", "scanner": "scanner-primary", "fingerprint": "953ec1a0ee6df50d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-25a148d51e6704dd", "level": "note", "message": {"text": "Unused endpoint: POST /wake"}, "properties": {"repobilityId": "f87b70d08cf98a2f", "scanner": "scanner-primary", "fingerprint": "25a148d51e6704dd", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-350a8ab893a9ae45", "level": "note", "message": {"text": "Unused endpoint: POST /sleep"}, "properties": {"repobilityId": "d2481864ce42e854", "scanner": "scanner-primary", "fingerprint": "350a8ab893a9ae45", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-fd9759b09cb41abe", "level": "note", "message": {"text": "Unused endpoint: POST /busy"}, "properties": {"repobilityId": "ac6b01181c3e46d7", "scanner": "scanner-primary", "fingerprint": "fd9759b09cb41abe", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c87c2d608d38851d", "level": "note", "message": {"text": "Unused endpoint: POST /interval"}, "properties": {"repobilityId": "749151419ad8eb12", "scanner": "scanner-primary", "fingerprint": "c87c2d608d38851d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-43269e4e79c2e69e", "level": "note", "message": {"text": "Unused endpoint: GET /events"}, "properties": {"repobilityId": "40b145c4f70f160b", "scanner": "scanner-primary", "fingerprint": "43269e4e79c2e69e", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-67ac400ef2f71a59", "level": "note", "message": {"text": "Unused endpoint: POST /trigger/{robot_id}/{action}"}, "properties": {"repobilityId": "dde9eaaeafced708", "scanner": "scanner-primary", "fingerprint": "67ac400ef2f71a59", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-9ded26c8fff30981", "level": "note", "message": {"text": "Unused endpoint: POST /observe"}, "properties": {"repobilityId": "bd9d92a7a0c7b7a1", "scanner": "scanner-primary", "fingerprint": "9ded26c8fff30981", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-2ab9bf5db6820af4", "level": "note", "message": {"text": "Unused endpoint: GET /models"}, "properties": {"repobilityId": "7622b4c578a3c561", "scanner": "scanner-primary", "fingerprint": "2ab9bf5db6820af4", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-d0e963cf059012cb", "level": "note", "message": {"text": "Unused endpoint: DELETE /all"}, "properties": {"repobilityId": "eb3098c534bffed6", "scanner": "scanner-primary", "fingerprint": "d0e963cf059012cb", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-37157900d71c21d3", "level": "note", "message": {"text": "Unused endpoint: GET /latest"}, "properties": {"repobilityId": "d0a4035c6061240b", "scanner": "scanner-primary", "fingerprint": "37157900d71c21d3", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-7a009b1a56794f45", "level": "note", "message": {"text": "Unused endpoint: POST /"}, "properties": {"repobilityId": "b468700195992558", "scanner": "scanner-primary", "fingerprint": "7a009b1a56794f45", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-a2d9f4ab80e5aa03", "level": "note", "message": {"text": "Unused endpoint: POST /{conversation_id}/message"}, "properties": {"repobilityId": "a70edb302fd5c8cb", "scanner": "scanner-primary", "fingerprint": "a2d9f4ab80e5aa03", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-593c6efeb9f4cfb8", "level": "note", "message": {"text": "Unused endpoint: GET /{conversation_id}/messages"}, "properties": {"repobilityId": "a5eb9cce4f748ee5", "scanner": "scanner-primary", "fingerprint": "593c6efeb9f4cfb8", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-2719b3547f089dbc", "level": "note", "message": {"text": "Unused endpoint: POST /from-image"}, "properties": {"repobilityId": "6d6019f1982ef9f6", "scanner": "scanner-primary", "fingerprint": "2719b3547f089dbc", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-a1b6902a92b267a5", "level": "note", "message": {"text": "Unused endpoint: GET /creation-status/{job_id}"}, "properties": {"repobilityId": "bdddc3287e37ca25", "scanner": "scanner-primary", "fingerprint": "a1b6902a92b267a5", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-3818454b7f639786", "level": "note", "message": {"text": "Unused endpoint: DELETE /{robot_id}"}, "properties": {"repobilityId": "6e70d906ef495d82", "scanner": "scanner-primary", "fingerprint": "3818454b7f639786", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-359e464900424224", "level": "note", "message": {"text": "Unused endpoint: DELETE /activity/all"}, "properties": {"repobilityId": "e5768f303c147005", "scanner": "scanner-primary", "fingerprint": "359e464900424224", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-10640d78666bba32", "level": "note", "message": {"text": "Unused endpoint: GET /{robot_id}/activity"}, "properties": {"repobilityId": "901f2a6e9088cff1", "scanner": "scanner-primary", "fingerprint": "10640d78666bba32", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-63d59118e2887601", "level": "note", "message": {"text": "Unused endpoint: GET /{robot_id}/skills"}, "properties": {"repobilityId": "efb69cfbc65979a7", "scanner": "scanner-primary", "fingerprint": "63d59118e2887601", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c6d31928e31a96bf", "level": "note", "message": {"text": "Unused endpoint: GET /{robot_id}/memories"}, "properties": {"repobilityId": "bf2f336209c53d42", "scanner": "scanner-primary", "fingerprint": "c6d31928e31a96bf", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5baa8971ebe192a1", "level": "note", "message": {"text": "Unused endpoint: GET /"}, "properties": {"repobilityId": "f078f520fb94239a", "scanner": "scanner-primary", "fingerprint": "5baa8971ebe192a1", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-078dea1e938e89bb", "level": "note", "message": {"text": "Unused endpoint: PATCH /{robot_id}"}, "properties": {"repobilityId": "5a5684dcfc8d019d", "scanner": "scanner-primary", "fingerprint": "078dea1e938e89bb", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-b2ebc3fc3c83ffd1", "level": "note", "message": {"text": "Unused endpoint: GET /{robot_id}"}, "properties": {"repobilityId": "0fb174ae59b2300d", "scanner": "scanner-primary", "fingerprint": "b2ebc3fc3c83ffd1", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-963710f42a2c8219", "level": "note", "message": {"text": "Unused endpoint: GET /api/status"}, "properties": {"repobilityId": "6596fe4f965d244b", "scanner": "scanner-primary", "fingerprint": "963710f42a2c8219", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-d388b5b75933d1a8", "level": "note", "message": {"text": "Unused endpoint: GET /characters"}, "properties": {"repobilityId": "a95547906c3d4ecb", "scanner": "scanner-primary", "fingerprint": "d388b5b75933d1a8", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-9ac9c1933a0da878", "level": "note", "message": {"text": "Unused endpoint: POST /characters/{char_id}/voice-lang"}, "properties": {"repobilityId": "6ef0aaaa1e2d87e8", "scanner": "scanner-primary", "fingerprint": "9ac9c1933a0da878", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-0fa5a1890c36b58f", "level": "note", "message": {"text": "Unused endpoint: POST /characters/{char_id}/generate-images"}, "properties": {"repobilityId": "f132973b4aaafad4", "scanner": "scanner-primary", "fingerprint": "0fa5a1890c36b58f", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-4bc95d761c4562cd", "level": "note", "message": {"text": "Unused endpoint: POST /characters/{char_id}/remove-bg"}, "properties": {"repobilityId": "df7721fec2865752", "scanner": "scanner-primary", "fingerprint": "4bc95d761c4562cd", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-9f8b8e9179ea084e", "level": "note", "message": {"text": "Unused endpoint: POST /characters/{char_id}/upload-voice"}, "properties": {"repobilityId": "6fca744657ae3f7f", "scanner": "scanner-primary", "fingerprint": "9f8b8e9179ea084e", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-ac50e75f6e70a803", "level": "note", "message": {"text": "Unused endpoint: POST /characters/{char_id}/upload-reference"}, "properties": {"repobilityId": "faa59a49b7db5db3", "scanner": "scanner-primary", "fingerprint": "ac50e75f6e70a803", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-785b0cb551e95559", "level": "note", "message": {"text": "Unused endpoint: POST /characters/create"}, "properties": {"repobilityId": "f8bd930348ea607b", "scanner": "scanner-primary", "fingerprint": "785b0cb551e95559", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-f6a9b89b89b57a5b", "level": "note", "message": {"text": "Unused endpoint: GET /characters/{char_id}/image/{state}"}, "properties": {"repobilityId": "21a6c71cdb06b12f", "scanner": "scanner-primary", "fingerprint": "f6a9b89b89b57a5b", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-85b303485f8885ff", "level": "note", "message": {"text": "Unused endpoint: GET /characters/{char_id}/voice-ref"}, "properties": {"repobilityId": "1c79326efa791b70", "scanner": "scanner-primary", "fingerprint": "85b303485f8885ff", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-d662e3ae47d55e03", "level": "note", "message": {"text": "Unused endpoint: GET /characters/{char_id}/versions"}, "properties": {"repobilityId": "fa62c0c5064615ba", "scanner": "scanner-primary", "fingerprint": "d662e3ae47d55e03", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-9c7e2df6ec03b3fd", "level": "note", "message": {"text": "Unused endpoint: POST /characters/{char_id}/versions/{version_id}/activate"}, "properties": {"repobilityId": "fec215945e58289d", "scanner": "scanner-primary", "fingerprint": "9c7e2df6ec03b3fd", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c0cf12a600606cf6", "level": "note", "message": {"text": "Unused endpoint: POST /characters/{char_id}/versions/{version_id}/star"}, "properties": {"repobilityId": "2a8aecb7e10bf649", "scanner": "scanner-primary", "fingerprint": "c0cf12a600606cf6", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-b44bd61d6dedf65e", "level": "note", "message": {"text": "Unused endpoint: GET /characters/{char_id}/versions/{version_id}/file"}, "properties": {"repobilityId": "26fa0c6b7b2516dd", "scanner": "scanner-primary", "fingerprint": "b44bd61d6dedf65e", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-fae6a0d85c179af5", "level": "note", "message": {"text": "Unused endpoint: GET /characters/{char_id}/memories"}, "properties": {"repobilityId": "4e3bdaf5e762f3be", "scanner": "scanner-primary", "fingerprint": "fae6a0d85c179af5", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-582b00fca2796501", "level": "note", "message": {"text": "Unused endpoint: GET /tools"}, "properties": {"repobilityId": "e0f6275638dda8c6", "scanner": "scanner-primary", "fingerprint": "582b00fca2796501", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-1a58cbed371732ce", "level": "note", "message": {"text": "Unused endpoint: PUT /tools/{tool_name}"}, "properties": {"repobilityId": "cccbaef6c06ec17c", "scanner": "scanner-primary", "fingerprint": "1a58cbed371732ce", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-844bc08cf00246ee", "level": "note", "message": {"text": "Unused endpoint: GET /speak-qwen3"}, "properties": {"repobilityId": "68348cc4c5067c26", "scanner": "scanner-primary", "fingerprint": "844bc08cf00246ee", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-83368c90586b5733", "level": "note", "message": {"text": "Unused endpoint: POST /characters/create-from-web"}, "properties": {"repobilityId": "a95b757fb3f82746", "scanner": "scanner-primary", "fingerprint": "83368c90586b5733", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-8e2ec7c6317e767f", "level": "note", "message": {"text": "Unused endpoint: GET /characters/create-from-web/status/{job_id}"}, "properties": {"repobilityId": "da72d808ab4980a9", "scanner": "scanner-primary", "fingerprint": "8e2ec7c6317e767f", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-dd9f84ffb463be6e", "level": "note", "message": {"text": "Unused endpoint: POST /characters/{char_id}/build-memories"}, "properties": {"repobilityId": "ba1f41de792aadcd", "scanner": "scanner-primary", "fingerprint": "dd9f84ffb463be6e", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-7de4e88d608e05fe", "level": "note", "message": {"text": "Unused endpoint: POST /transcribe"}, "properties": {"repobilityId": "926bae68c810b017", "scanner": "scanner-primary", "fingerprint": "7de4e88d608e05fe", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-b829d4b89c082982", "level": "note", "message": {"text": "Unused endpoint: POST /idle-chat"}, "properties": {"repobilityId": "e6c182e83d080154", "scanner": "scanner-primary", "fingerprint": "b829d4b89c082982", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-a641ecf39e8431f9", "level": "note", "message": {"text": "Unused endpoint: POST /react"}, "properties": {"repobilityId": "722f73f288492551", "scanner": "scanner-primary", "fingerprint": "a641ecf39e8431f9", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-17a164638609b114", "level": "note", "message": {"text": "Unused endpoint: POST /search"}, "properties": {"repobilityId": "8ee7d31ea075048a", "scanner": "scanner-primary", "fingerprint": "17a164638609b114", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}]}]}