{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-ea980577aca45369", "name": "Stray `console.log` in TS/JS \u2014 packages/messaging/src/bridge.ts:132", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/messaging/src/bridge.ts:132"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-625bc67aeff897de", "name": "Stray `console.log` in TS/JS \u2014 packages/messaging/src/adapters/resend/index.ts:319", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/messaging/src/adapters/resend/index.ts:319"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-60b2ae93950c8c4d", "name": "Stray `console.log` in TS/JS \u2014 packages/browser/src/session.ts:236", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/browser/src/session.ts:236"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e28af7ec0bb03346", "name": "Stray `console.log` in TS/JS \u2014 packages/cli/src/index.ts:4370", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/cli/src/index.ts:4370"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3a335309f3166f1c", "name": "Icon-only button without accessible name \u2014 packages/cli/src/web-ui-client.ts:4265", "shortDescription": {"text": "Icon-only button without accessible name \u2014 packages/cli/src/web-ui-client.ts:4265"}, "fullDescription": {"text": "A `<button>` whose only child is a single glyph or symbol needs `title=` or `aria-label=` so screen readers (and tooltips on hover) work.\n\nWhy: P3 in CHECKLIST.md \u2014 icon-only buttons skipped a title.\nRule id: fq.button.no-label"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2b7ec17c5e3c99bb", "name": "Stray `console.log` in TS/JS \u2014 packages/cli/src/web-ui-client.ts:2207", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/cli/src/web-ui-client.ts:2207"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6806c638667c9692", "name": "Stray `console.log` in TS/JS \u2014 packages/cli/src/run-interactive-ink.ts:160", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/cli/src/run-interactive-ink.ts:160"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6f78cc12d646799e", "name": "Stray `console.log` in TS/JS \u2014 packages/harness/scripts/embed-docs.js:26", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/harness/scripts/embed-docs.js:26"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ecf2d5f127bab0ff", "name": "Stray `console.log` in TS/JS \u2014 packages/harness/scripts/update-test-mocks.js:45", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/harness/scripts/update-test-mocks.js:45"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-44860df69e5ce832", "name": "Stray `console.log` in TS/JS \u2014 packages/harness/src/isolate/type-stubs.ts:119", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/harness/src/isolate/type-stubs.ts:119"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bf9eec81f232f474", "name": "Stray `console.log` in TS/JS \u2014 packages/harness/src/isolate/polyfills.ts:750", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/harness/src/isolate/polyfills.ts:750"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-646a0faf2318ea25", "name": "Stray `console.log` in TS/JS \u2014 packages/harness/src/orchestrator/orchestrator.ts:562", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/harness/src/orchestrator/orchestrator.ts:562"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fd23c969d73158cb", "name": "Stray `console.log` in TS/JS \u2014 packages/harness/test/vfs.test.ts:92", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/harness/test/vfs.test.ts:92"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-988d729a1bf01d43", "name": "Stray `console.log` in TS/JS \u2014 packages/harness/test/isolate.test.ts:22", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/harness/test/isolate.test.ts:22"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f805270bc9d7ccfa", "name": "Insecure pattern 'node_child_process' in packages/browser/package.json:25", "shortDescription": {"text": "Insecure pattern 'node_child_process' in packages/browser/package.json:25"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1d44644a53c74cd3", "name": "Insecure pattern 'node_child_process' in packages/cli/src/skills.ts:1", "shortDescription": {"text": "Insecure pattern 'node_child_process' in packages/cli/src/skills.ts:1"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6741951e17719c60", "name": "Insecure pattern 'direct_innerhtml_assignment' in packages/cli/src/web-ui-client.ts:220", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in packages/cli/src/web-ui-client.ts:220"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-87bc2ad6663f4f92", "name": "Insecure pattern 'insert_adjacent_html' in packages/cli/src/web-ui-client.ts:1396", "shortDescription": {"text": "Insecure pattern 'insert_adjacent_html' in packages/cli/src/web-ui-client.ts:1396"}, "fullDescription": {"text": "Found a known-risky pattern (insert_adjacent_html). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-57f413ee3031d5d5", "name": "Insecure pattern 'local_storage_auth_token' in packages/cli/src/web-ui-client.ts:17", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in packages/cli/src/web-ui-client.ts:17"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-21481805f9e547ad", "name": "Insecure pattern 'node_child_process' in packages/cli/src/project-init.ts:1", "shortDescription": {"text": "Insecure pattern 'node_child_process' in packages/cli/src/project-init.ts:1"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7be19b6bd21d39ca", "name": "Insecure pattern 'exec_used' in packages/harness/src/storage/sql-dialect.ts:81", "shortDescription": {"text": "Insecure pattern 'exec_used' in packages/harness/src/storage/sql-dialect.ts:81"}, "fullDescription": {"text": "Found a known-risky pattern (exec_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-46c644c6227e4d4a", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1838a141491ce38c", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-094156cc70b23ccc", "name": "Install-time lifecycle script performs network/shell-sensitive actions", "shortDescription": {"text": "Install-time lifecycle script performs network/shell-sensitive actions"}, "fullDescription": {"text": "preinstall/install/postinstall/prepare scripts execute during dependency installation. Review them carefully for network calls, obfuscation, shell execution, or credential access."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0a5e9944e0f2aa3a", "name": "Very large file: packages/cli/src/index.ts (4627 lines)", "shortDescription": {"text": "Very large file: packages/cli/src/index.ts (4627 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-adb26fbcdacdc394", "name": "Very large file: packages/cli/src/web-ui-styles.ts (2675 lines)", "shortDescription": {"text": "Very large file: packages/cli/src/web-ui-styles.ts (2675 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6fd4294bf445a053", "name": "Very large file: packages/cli/src/web-ui-client.ts (6121 lines)", "shortDescription": {"text": "Very large file: packages/cli/src/web-ui-client.ts (6121 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-029fda5914af60ee", "name": "Very large file: packages/harness/src/harness.ts (4046 lines)", "shortDescription": {"text": "Very large file: packages/harness/src/harness.ts (4046 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2197f2f1c1245742", "name": "Very large file: packages/harness/src/orchestrator/orchestrator.ts (1923 lines)", "shortDescription": {"text": "Very large file: packages/harness/src/orchestrator/orchestrator.ts (1923 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8e14911f330d91c1", "name": "Very large file: packages/harness/src/storage/sql-dialect.ts (1426 lines)", "shortDescription": {"text": "Very large file: packages/harness/src/storage/sql-dialect.ts (1426 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0a7867617369a3d3", "name": "Very large file: packages/harness/test/harness.test.ts (1770 lines)", "shortDescription": {"text": "Very large file: packages/harness/test/harness.test.ts (1770 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-203b7a59a73e7df3", "name": "Node manifest has dependencies but no lockfile: packages/messaging/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/messaging/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-64f69fc7b5d088a3", "name": "Node manifest has dependencies but no lockfile: packages/browser/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/browser/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f1f0c52db7c97cef", "name": "Node manifest has dependencies but no lockfile: packages/client/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/client/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8c2e3196a4ef0cdd", "name": "Node manifest has dependencies but no lockfile: packages/cli/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/cli/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1b41494f14e4bd8a", "name": "Node manifest has dependencies but no lockfile: packages/harness/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/harness/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ae014485ab255591", "name": "Node manifest has dependencies but no lockfile: packages/sdk/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/sdk/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 131 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 65 placeholder/mock markers across 13 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-749d4bc1bd66df5f", "name": "Agent instructions exist but release-hardening basics are missing", "shortDescription": {"text": "Agent instructions exist but release-hardening basics are missing"}, "fullDescription": {"text": "AI-coder instruction files were found, but the repo is missing lockfile. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2679282aa1c484b5", "name": "Agent authority lacks a verifier contract: AGENTS.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: AGENTS.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5f26ff192a27aa1a", "name": "`fetch()` without try/.catch or AbortSignal \u2014 packages/messaging/src/adapters/telegram/utils.ts:91", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/messaging/src/adapters/telegram/utils.ts:91"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4715384ebbcc523a", "name": "`fetch()` without try/.catch or AbortSignal \u2014 packages/messaging/src/adapters/slack/utils.ts:50", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/messaging/src/adapters/slack/utils.ts:50"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3a431ca7879b67b1", "name": "Commented-code block (5 lines) in packages/cli/src/scaffolding.ts:247", "shortDescription": {"text": "Commented-code block (5 lines) in packages/cli/src/scaffolding.ts:247"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-1e7b09cd98a625c0", "name": "Commented-code block (5 lines) in packages/cli/src/index.ts:385", "shortDescription": {"text": "Commented-code block (5 lines) in packages/cli/src/index.ts:385"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-70bfca58900628a7", "name": "Commented-code block (5 lines) in packages/cli/src/cli.ts:2", "shortDescription": {"text": "Commented-code block (5 lines) in packages/cli/src/cli.ts:2"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-8bc447763ac84a35", "name": "Commented-code block (5 lines) in packages/cli/src/web-ui-client.ts:1287", "shortDescription": {"text": "Commented-code block (5 lines) in packages/cli/src/web-ui-client.ts:1287"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-756887936369c58a", "name": "`fetch()` without try/.catch or AbortSignal \u2014 packages/cli/src/web-ui-client.ts:214", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/cli/src/web-ui-client.ts:214"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-35cbe27703773842", "name": "Commented-code block (8 lines) in packages/cli/test/cli.test.ts:143", "shortDescription": {"text": "Commented-code block (8 lines) in packages/cli/test/cli.test.ts:143"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-1318a79f436d2b1e", "name": "`fetch()` without try/.catch or AbortSignal \u2014 packages/cli/test/cli.test.ts:634", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/cli/test/cli.test.ts:634"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-48ce8d0de4cddb4f", "name": "`fetch()` without try/.catch or AbortSignal \u2014 packages/harness/scripts/migrate-to-engine.mjs:70", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/harness/scripts/migrate-to-engine.mjs:70"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3e98377cd2c2c2bb", "name": "Commented-code block (8 lines) in packages/harness/src/harness.ts:75", "shortDescription": {"text": "Commented-code block (8 lines) in packages/harness/src/harness.ts:75"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-b82112bde0e38aee", "name": "`fetch()` without try/.catch or AbortSignal \u2014 packages/harness/src/harness.ts:2829", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/harness/src/harness.ts:2829"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9170896024afda10", "name": "Commented-code block (5 lines) in packages/harness/src/upload-store.ts:352", "shortDescription": {"text": "Commented-code block (5 lines) in packages/harness/src/upload-store.ts:352"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-a94513b7dc6ac748", "name": "`fetch()` without try/.catch or AbortSignal \u2014 packages/harness/src/upload-store.ts:123", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/harness/src/upload-store.ts:123"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3830a1d40f10c672", "name": "`fetch()` without try/.catch or AbortSignal \u2014 packages/harness/src/model-factory.ts:182", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/harness/src/model-factory.ts:182"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6cadb048af89c739", "name": "Commented-code block (6 lines) in packages/harness/src/default-agent.ts:4", "shortDescription": {"text": "Commented-code block (6 lines) in packages/harness/src/default-agent.ts:4"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-0d66dc8861d037e9", "name": "Commented-code block (5 lines) in packages/harness/src/skill-context.ts:215", "shortDescription": {"text": "Commented-code block (5 lines) in packages/harness/src/skill-context.ts:215"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-fa5812fead65e9a2", "name": "`fetch()` without try/.catch or AbortSignal \u2014 packages/harness/src/openai-codex-auth.ts:160", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/harness/src/openai-codex-auth.ts:160"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-57de4661de4c42af", "name": "Commented-code block (7 lines) in packages/harness/src/vfs/poncho-fs-adapter.ts:4", "shortDescription": {"text": "Commented-code block (7 lines) in packages/harness/src/vfs/poncho-fs-adapter.ts:4"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-32662995af01a9c9", "name": "`fetch()` without try/.catch or AbortSignal \u2014 packages/harness/src/isolate/type-stubs.ts:18", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/harness/src/isolate/type-stubs.ts:18"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-344a07176eabcb94", "name": "Commented-code block (5 lines) in packages/harness/src/isolate/runtime.ts:45", "shortDescription": {"text": "Commented-code block (5 lines) in packages/harness/src/isolate/runtime.ts:45"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-9d41eef8dd1f2ca6", "name": "`fetch()` without try/.catch or AbortSignal \u2014 packages/harness/src/isolate/bindings.ts:187", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/harness/src/isolate/bindings.ts:187"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e936b5e0ad190cb1", "name": "Commented-code block (7 lines) in packages/harness/src/isolate/polyfills.ts:7", "shortDescription": {"text": "Commented-code block (7 lines) in packages/harness/src/isolate/polyfills.ts:7"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-e5a16d3f6cf38a48", "name": "`fetch()` without try/.catch or AbortSignal \u2014 packages/harness/src/isolate/polyfills.ts:5", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/harness/src/isolate/polyfills.ts:5"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-98435af928cbb4ec", "name": "Commented-code block (6 lines) in packages/harness/src/orchestrator/entries-dual-write.ts:4", "shortDescription": {"text": "Commented-code block (6 lines) in packages/harness/src/orchestrator/entries-dual-write.ts:4"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-2ade76dcbf0094c9", "name": "Commented-code block (7 lines) in packages/harness/src/orchestrator/run-conversation-turn.ts:14", "shortDescription": {"text": "Commented-code block (7 lines) in packages/harness/src/orchestrator/run-conversation-turn.ts:14"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-fa107caf813d8bf9", "name": "Commented-code block (6 lines) in packages/harness/src/orchestrator/orchestrator.ts:1202", "shortDescription": {"text": "Commented-code block (6 lines) in packages/harness/src/orchestrator/orchestrator.ts:1202"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-7fbe0d39eb191718", "name": "Commented-code block (5 lines) in packages/harness/src/storage/schema.ts:201", "shortDescription": {"text": "Commented-code block (5 lines) in packages/harness/src/storage/schema.ts:201"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-7469641d95663dd8", "name": "Commented-code block (5 lines) in packages/harness/src/storage/sql-dialect.ts:4", "shortDescription": {"text": "Commented-code block (5 lines) in packages/harness/src/storage/sql-dialect.ts:4"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-ce376f35a60beaf1", "name": "Commented-code block (10 lines) in packages/harness/src/storage/postgres-engine.ts:45", "shortDescription": {"text": "Commented-code block (10 lines) in packages/harness/src/storage/postgres-engine.ts:45"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-6ce558455a8841cb", "name": "`fetch()` without try/.catch or AbortSignal \u2014 packages/harness/test/isolate-vfs.test.ts:387", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/harness/test/isolate-vfs.test.ts:387"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a527926505a8a097", "name": "Legacy-named symbol `sub_old` in packages/harness/test/compaction.test.ts:185", "shortDescription": {"text": "Legacy-named symbol `sub_old` in packages/harness/test/compaction.test.ts:185"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e6faee2186fefc7c", "name": "Legacy-named symbol `rt_old` in packages/harness/test/openai-codex-auth.test.ts:51", "shortDescription": {"text": "Legacy-named symbol `rt_old` in packages/harness/test/openai-codex-auth.test.ts:51"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-04bb68527fae8107", "name": "Commented-code block (7 lines) in packages/harness/test/upload-store-decode.test.ts:4", "shortDescription": {"text": "Commented-code block (7 lines) in packages/harness/test/upload-store-decode.test.ts:4"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/24877"}, "properties": {"repository": "cesr/poncho-ai", "repoUrl": "https://github.com/cesr/poncho-ai", "branch": "main"}, "results": [{"ruleId": "scanner-ea980577aca45369", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/messaging/src/bridge.ts:132"}, "properties": {"repobilityId": "43275f3b42830511", "scanner": "scanner-primary", "fingerprint": "ea980577aca45369", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-625bc67aeff897de", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/messaging/src/adapters/resend/index.ts:319"}, "properties": {"repobilityId": "74bb3015ea72e480", "scanner": "scanner-primary", "fingerprint": "625bc67aeff897de", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-60b2ae93950c8c4d", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/browser/src/session.ts:236"}, "properties": {"repobilityId": "93e9b36fc157ad4f", "scanner": "scanner-primary", "fingerprint": "60b2ae93950c8c4d", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-e28af7ec0bb03346", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/cli/src/index.ts:4370"}, "properties": {"repobilityId": "7d672af1a16d6a76", "scanner": "scanner-primary", "fingerprint": "e28af7ec0bb03346", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-3a335309f3166f1c", "level": "note", "message": {"text": "Icon-only button without accessible name \u2014 packages/cli/src/web-ui-client.ts:4265"}, "properties": {"repobilityId": "fc9e8aa4843b9a30", "scanner": "scanner-primary", "fingerprint": "3a335309f3166f1c", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.button.no-label"]}}, {"ruleId": "scanner-2b7ec17c5e3c99bb", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/cli/src/web-ui-client.ts:2207"}, "properties": {"repobilityId": "2e82e127977fa228", "scanner": "scanner-primary", "fingerprint": "2b7ec17c5e3c99bb", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-6806c638667c9692", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/cli/src/run-interactive-ink.ts:160"}, "properties": {"repobilityId": "7741cb7d977c42f6", "scanner": "scanner-primary", "fingerprint": "6806c638667c9692", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-6f78cc12d646799e", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/harness/scripts/embed-docs.js:26"}, "properties": {"repobilityId": "56fb70a4e1823333", "scanner": "scanner-primary", "fingerprint": "6f78cc12d646799e", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-ecf2d5f127bab0ff", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/harness/scripts/update-test-mocks.js:45"}, "properties": {"repobilityId": "a08eebaed59647ed", "scanner": "scanner-primary", "fingerprint": "ecf2d5f127bab0ff", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-44860df69e5ce832", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/harness/src/isolate/type-stubs.ts:119"}, "properties": {"repobilityId": "7593cfbc143eae5c", "scanner": "scanner-primary", "fingerprint": "44860df69e5ce832", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-bf9eec81f232f474", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/harness/src/isolate/polyfills.ts:750"}, "properties": {"repobilityId": "607a5655d54e5b03", "scanner": "scanner-primary", "fingerprint": "bf9eec81f232f474", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-646a0faf2318ea25", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/harness/src/orchestrator/orchestrator.ts:562"}, "properties": {"repobilityId": "6b0a7f745c646d00", "scanner": "scanner-primary", "fingerprint": "646a0faf2318ea25", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-fd23c969d73158cb", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/harness/test/vfs.test.ts:92"}, "properties": {"repobilityId": "2404ffe9b3c0ba68", "scanner": "scanner-primary", "fingerprint": "fd23c969d73158cb", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-988d729a1bf01d43", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/harness/test/isolate.test.ts:22"}, "properties": {"repobilityId": "9b5ef502e41cc1f0", "scanner": "scanner-primary", "fingerprint": "988d729a1bf01d43", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-f805270bc9d7ccfa", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in packages/browser/package.json:25"}, "properties": {"repobilityId": "7e0def4f4c62a4d1", "scanner": "scanner-primary", "fingerprint": "f805270bc9d7ccfa", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/browser/package.json"}, "region": {"startLine": 25}}}]}, {"ruleId": "scanner-1d44644a53c74cd3", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in packages/cli/src/skills.ts:1"}, "properties": {"repobilityId": "a89a237ad2abfdc0", "scanner": "scanner-primary", "fingerprint": "1d44644a53c74cd3", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/cli/src/skills.ts"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6741951e17719c60", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in packages/cli/src/web-ui-client.ts:220"}, "properties": {"repobilityId": "2d8814bff74ab0d9", "scanner": "scanner-primary", "fingerprint": "6741951e17719c60", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/cli/src/web-ui-client.ts"}, "region": {"startLine": 220}}}]}, {"ruleId": "scanner-87bc2ad6663f4f92", "level": "warning", "message": {"text": "Insecure pattern 'insert_adjacent_html' in packages/cli/src/web-ui-client.ts:1396"}, "properties": {"repobilityId": "8cb3d0c030945365", "scanner": "scanner-primary", "fingerprint": "87bc2ad6663f4f92", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "insert_adjacent_html"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/cli/src/web-ui-client.ts"}, "region": {"startLine": 1396}}}]}, {"ruleId": "scanner-57f413ee3031d5d5", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in packages/cli/src/web-ui-client.ts:17"}, "properties": {"repobilityId": "fbcbbcd173100a14", "scanner": "scanner-primary", "fingerprint": "57f413ee3031d5d5", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/cli/src/web-ui-client.ts"}, "region": {"startLine": 17}}}]}, {"ruleId": "scanner-21481805f9e547ad", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in packages/cli/src/project-init.ts:1"}, "properties": {"repobilityId": "ea2addcb9de21314", "scanner": "scanner-primary", "fingerprint": "21481805f9e547ad", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/cli/src/project-init.ts"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7be19b6bd21d39ca", "level": "error", "message": {"text": "Insecure pattern 'exec_used' in packages/harness/src/storage/sql-dialect.ts:81"}, "properties": {"repobilityId": "e963949ebccf00d6", "scanner": "scanner-primary", "fingerprint": "7be19b6bd21d39ca", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "exec_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/harness/src/storage/sql-dialect.ts"}, "region": {"startLine": 81}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "2644034c718fb80d", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 23}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "4a76b700066ca8f5", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 28}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "eeb76410cc935c30", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 31}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "795422ca0cf75519", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 40}}}]}, {"ruleId": "scanner-1838a141491ce38c", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "b8fd4f5048f96576", "scanner": "scanner-primary", "fingerprint": "1838a141491ce38c", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-094156cc70b23ccc", "level": "warning", "message": {"text": "Install-time lifecycle script performs network/shell-sensitive actions"}, "properties": {"repobilityId": "57d778bfa2be1b27", "scanner": "scanner-primary", "fingerprint": "094156cc70b23ccc", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "npm", "install-scripts"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/browser/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0a5e9944e0f2aa3a", "level": "note", "message": {"text": "Very large file: packages/cli/src/index.ts (4627 lines)"}, "properties": {"repobilityId": "88fb895ae7ab6412", "scanner": "scanner-primary", "fingerprint": "0a5e9944e0f2aa3a", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-adb26fbcdacdc394", "level": "note", "message": {"text": "Very large file: packages/cli/src/web-ui-styles.ts (2675 lines)"}, "properties": {"repobilityId": "2259ca86540a0c19", "scanner": "scanner-primary", "fingerprint": "adb26fbcdacdc394", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-6fd4294bf445a053", "level": "note", "message": {"text": "Very large file: packages/cli/src/web-ui-client.ts (6121 lines)"}, "properties": {"repobilityId": "0c9470131b5a8d16", "scanner": "scanner-primary", "fingerprint": "6fd4294bf445a053", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-029fda5914af60ee", "level": "note", "message": {"text": "Very large file: packages/harness/src/harness.ts (4046 lines)"}, "properties": {"repobilityId": "e49e44b93e04a41e", "scanner": "scanner-primary", "fingerprint": "029fda5914af60ee", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-2197f2f1c1245742", "level": "note", "message": {"text": "Very large file: packages/harness/src/orchestrator/orchestrator.ts (1923 lines)"}, "properties": {"repobilityId": "6bec218f2efe8983", "scanner": "scanner-primary", "fingerprint": "2197f2f1c1245742", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-8e14911f330d91c1", "level": "note", "message": {"text": "Very large file: packages/harness/src/storage/sql-dialect.ts (1426 lines)"}, "properties": {"repobilityId": "029f910987066418", "scanner": "scanner-primary", "fingerprint": "8e14911f330d91c1", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-0a7867617369a3d3", "level": "note", "message": {"text": "Very large file: packages/harness/test/harness.test.ts (1770 lines)"}, "properties": {"repobilityId": "3e330165cc11fdee", "scanner": "scanner-primary", "fingerprint": "0a7867617369a3d3", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-203b7a59a73e7df3", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/messaging/package.json"}, "properties": {"repobilityId": "1f5336cf7d64a4fa", "scanner": "scanner-primary", "fingerprint": "203b7a59a73e7df3", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/messaging/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-64f69fc7b5d088a3", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/browser/package.json"}, "properties": {"repobilityId": "ac0aff8a053834d3", "scanner": "scanner-primary", "fingerprint": "64f69fc7b5d088a3", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/browser/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f1f0c52db7c97cef", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/client/package.json"}, "properties": {"repobilityId": "708197ec3b624f59", "scanner": "scanner-primary", "fingerprint": "f1f0c52db7c97cef", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/client/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8c2e3196a4ef0cdd", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/cli/package.json"}, "properties": {"repobilityId": "2faf23490612d7a6", "scanner": "scanner-primary", "fingerprint": "8c2e3196a4ef0cdd", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/cli/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1b41494f14e4bd8a", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/harness/package.json"}, "properties": {"repobilityId": "5d233acb3186ff40", "scanner": "scanner-primary", "fingerprint": "1b41494f14e4bd8a", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/harness/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ae014485ab255591", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/sdk/package.json"}, "properties": {"repobilityId": "666cbe5826d686db", "scanner": "scanner-primary", "fingerprint": "ae014485ab255591", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/sdk/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "277daf2775abbe17", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "60e59423df90c50d", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "7ff2713c106b282e", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-749d4bc1bd66df5f", "level": "warning", "message": {"text": "Agent instructions exist but release-hardening basics are missing"}, "properties": {"repobilityId": "f518817440a0c11a", "scanner": "scanner-primary", "fingerprint": "749d4bc1bd66df5f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-2679282aa1c484b5", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: AGENTS.md"}, "properties": {"repobilityId": "27d579812e6be614", "scanner": "scanner-primary", "fingerprint": "2679282aa1c484b5", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "agents_md"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "AGENTS.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5f26ff192a27aa1a", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/messaging/src/adapters/telegram/utils.ts:91"}, "properties": {"repobilityId": "36871f77c40303cb", "scanner": "scanner-primary", "fingerprint": "5f26ff192a27aa1a", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-4715384ebbcc523a", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/messaging/src/adapters/slack/utils.ts:50"}, "properties": {"repobilityId": "f38229f3ca8a7de7", "scanner": "scanner-primary", "fingerprint": "4715384ebbcc523a", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-3a431ca7879b67b1", "level": "none", "message": {"text": "Commented-code block (5 lines) in packages/cli/src/scaffolding.ts:247"}, "properties": {"repobilityId": "ebfb101fc8de994b", "scanner": "scanner-primary", "fingerprint": "3a431ca7879b67b1", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-1e7b09cd98a625c0", "level": "none", "message": {"text": "Commented-code block (5 lines) in packages/cli/src/index.ts:385"}, "properties": {"repobilityId": "d71a4bcf81bf6105", "scanner": "scanner-primary", "fingerprint": "1e7b09cd98a625c0", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-70bfca58900628a7", "level": "none", "message": {"text": "Commented-code block (5 lines) in packages/cli/src/cli.ts:2"}, "properties": {"repobilityId": "9a217d9aa5bf4e75", "scanner": "scanner-primary", "fingerprint": "70bfca58900628a7", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-8bc447763ac84a35", "level": "none", "message": {"text": "Commented-code block (5 lines) in packages/cli/src/web-ui-client.ts:1287"}, "properties": {"repobilityId": "c218ab5fbb304693", "scanner": "scanner-primary", "fingerprint": "8bc447763ac84a35", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-756887936369c58a", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/cli/src/web-ui-client.ts:214"}, "properties": {"repobilityId": "fd68a3b7f6212509", "scanner": "scanner-primary", "fingerprint": "756887936369c58a", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-35cbe27703773842", "level": "none", "message": {"text": "Commented-code block (8 lines) in packages/cli/test/cli.test.ts:143"}, "properties": {"repobilityId": "7b955cc0d9022c16", "scanner": "scanner-primary", "fingerprint": "35cbe27703773842", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-1318a79f436d2b1e", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/cli/test/cli.test.ts:634"}, "properties": {"repobilityId": "d69ed1f0a0e0c4be", "scanner": "scanner-primary", "fingerprint": "1318a79f436d2b1e", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-48ce8d0de4cddb4f", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/harness/scripts/migrate-to-engine.mjs:70"}, "properties": {"repobilityId": "c498d59d1394da45", "scanner": "scanner-primary", "fingerprint": "48ce8d0de4cddb4f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-3e98377cd2c2c2bb", "level": "none", "message": {"text": "Commented-code block (8 lines) in packages/harness/src/harness.ts:75"}, "properties": {"repobilityId": "5f3a5d36aad228da", "scanner": "scanner-primary", "fingerprint": "3e98377cd2c2c2bb", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-b82112bde0e38aee", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/harness/src/harness.ts:2829"}, "properties": {"repobilityId": "dd04532c5020abda", "scanner": "scanner-primary", "fingerprint": "b82112bde0e38aee", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-9170896024afda10", "level": "none", "message": {"text": "Commented-code block (5 lines) in packages/harness/src/upload-store.ts:352"}, "properties": {"repobilityId": "130842e4f1b14142", "scanner": "scanner-primary", "fingerprint": "9170896024afda10", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-a94513b7dc6ac748", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/harness/src/upload-store.ts:123"}, "properties": {"repobilityId": "b45df27eff43d130", "scanner": "scanner-primary", "fingerprint": "a94513b7dc6ac748", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-3830a1d40f10c672", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/harness/src/model-factory.ts:182"}, "properties": {"repobilityId": "714c54c01b8f4f10", "scanner": "scanner-primary", "fingerprint": "3830a1d40f10c672", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-6cadb048af89c739", "level": "none", "message": {"text": "Commented-code block (6 lines) in packages/harness/src/default-agent.ts:4"}, "properties": {"repobilityId": "98d6cb45c2e148b0", "scanner": "scanner-primary", "fingerprint": "6cadb048af89c739", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-0d66dc8861d037e9", "level": "none", "message": {"text": "Commented-code block (5 lines) in packages/harness/src/skill-context.ts:215"}, "properties": {"repobilityId": "9a7926ad04d2fdb1", "scanner": "scanner-primary", "fingerprint": "0d66dc8861d037e9", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-fa5812fead65e9a2", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/harness/src/openai-codex-auth.ts:160"}, "properties": {"repobilityId": "b9a85ea73eb1c08f", "scanner": "scanner-primary", "fingerprint": "fa5812fead65e9a2", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-57de4661de4c42af", "level": "none", "message": {"text": "Commented-code block (7 lines) in packages/harness/src/vfs/poncho-fs-adapter.ts:4"}, "properties": {"repobilityId": "305c95c0b1a677a5", "scanner": "scanner-primary", "fingerprint": "57de4661de4c42af", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-32662995af01a9c9", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/harness/src/isolate/type-stubs.ts:18"}, "properties": {"repobilityId": "9e9b2436d01a5ec0", "scanner": "scanner-primary", "fingerprint": "32662995af01a9c9", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-344a07176eabcb94", "level": "none", "message": {"text": "Commented-code block (5 lines) in packages/harness/src/isolate/runtime.ts:45"}, "properties": {"repobilityId": "5d2ee13788161799", "scanner": "scanner-primary", "fingerprint": "344a07176eabcb94", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-9d41eef8dd1f2ca6", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/harness/src/isolate/bindings.ts:187"}, "properties": {"repobilityId": "581fabc9c0019e64", "scanner": "scanner-primary", "fingerprint": "9d41eef8dd1f2ca6", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-e936b5e0ad190cb1", "level": "none", "message": {"text": "Commented-code block (7 lines) in packages/harness/src/isolate/polyfills.ts:7"}, "properties": {"repobilityId": "d152808b33be4301", "scanner": "scanner-primary", "fingerprint": "e936b5e0ad190cb1", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-e5a16d3f6cf38a48", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/harness/src/isolate/polyfills.ts:5"}, "properties": {"repobilityId": "7b2bf728ee336628", "scanner": "scanner-primary", "fingerprint": "e5a16d3f6cf38a48", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-98435af928cbb4ec", "level": "none", "message": {"text": "Commented-code block (6 lines) in packages/harness/src/orchestrator/entries-dual-write.ts:4"}, "properties": {"repobilityId": "b687f7669af9b6cd", "scanner": "scanner-primary", "fingerprint": "98435af928cbb4ec", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-2ade76dcbf0094c9", "level": "none", "message": {"text": "Commented-code block (7 lines) in packages/harness/src/orchestrator/run-conversation-turn.ts:14"}, "properties": {"repobilityId": "858971e2b5d524c3", "scanner": "scanner-primary", "fingerprint": "2ade76dcbf0094c9", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-fa107caf813d8bf9", "level": "none", "message": {"text": "Commented-code block (6 lines) in packages/harness/src/orchestrator/orchestrator.ts:1202"}, "properties": {"repobilityId": "f2bc64f66adfc2b5", "scanner": "scanner-primary", "fingerprint": "fa107caf813d8bf9", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-7fbe0d39eb191718", "level": "none", "message": {"text": "Commented-code block (5 lines) in packages/harness/src/storage/schema.ts:201"}, "properties": {"repobilityId": "3992c25498362d5f", "scanner": "scanner-primary", "fingerprint": "7fbe0d39eb191718", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-7469641d95663dd8", "level": "none", "message": {"text": "Commented-code block (5 lines) in packages/harness/src/storage/sql-dialect.ts:4"}, "properties": {"repobilityId": "167620f451068f6a", "scanner": "scanner-primary", "fingerprint": "7469641d95663dd8", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-ce376f35a60beaf1", "level": "none", "message": {"text": "Commented-code block (10 lines) in packages/harness/src/storage/postgres-engine.ts:45"}, "properties": {"repobilityId": "795c1f0df10f2b81", "scanner": "scanner-primary", "fingerprint": "ce376f35a60beaf1", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-6ce558455a8841cb", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/harness/test/isolate-vfs.test.ts:387"}, "properties": {"repobilityId": "42de94c1173cc18a", "scanner": "scanner-primary", "fingerprint": "6ce558455a8841cb", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-a527926505a8a097", "level": "note", "message": {"text": "Legacy-named symbol `sub_old` in packages/harness/test/compaction.test.ts:185"}, "properties": {"repobilityId": "1deb4a7d7bbb0f70", "scanner": "scanner-primary", "fingerprint": "a527926505a8a097", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-e6faee2186fefc7c", "level": "note", "message": {"text": "Legacy-named symbol `rt_old` in packages/harness/test/openai-codex-auth.test.ts:51"}, "properties": {"repobilityId": "884f0ab62c7e37e8", "scanner": "scanner-primary", "fingerprint": "e6faee2186fefc7c", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-04bb68527fae8107", "level": "none", "message": {"text": "Commented-code block (7 lines) in packages/harness/test/upload-store-decode.test.ts:4"}, "properties": {"repobilityId": "7c5dc7650dad01e6", "scanner": "scanner-primary", "fingerprint": "04bb68527fae8107", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}]}]}