{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-331cfee214dd792d", "name": "Stray `console.log` in TS/JS \u2014 apps/frontend/build.ts:33", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 apps/frontend/build.ts:33"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bf471cb9dd387449", "name": "Stray `console.log` in TS/JS \u2014 apps/cli/build.ts:33", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 apps/cli/build.ts:33"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0d188ede6e1ca99e", "name": "Stray `console.log` in TS/JS \u2014 apps/cli/src/index.ts:68", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 apps/cli/src/index.ts:68"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6eb21d589897643b", "name": "Stray `console.log` in TS/JS \u2014 apps/cli/src/dry-run.ts:185", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 apps/cli/src/dry-run.ts:185"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fb3bb088728eb6ec", "name": "Stray `console.log` in TS/JS \u2014 apps/cli/src/commands/auth.ts:15", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 apps/cli/src/commands/auth.ts:15"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9364bfe25e90da54", "name": "Stray `console.log` in TS/JS \u2014 apps/cli/src/commands/provider.ts:95", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 apps/cli/src/commands/provider.ts:95"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b46be2d3cdc24919", "name": "Stray `console.log` in TS/JS \u2014 apps/cli/src/commands/plugin.ts:13", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 apps/cli/src/commands/plugin.ts:13"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-318d15ab402dd467", "name": "Stray `console.log` in TS/JS \u2014 apps/cli/src/commands/mcp.ts:15", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 apps/cli/src/commands/mcp.ts:15"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a46f29722d37d45a", "name": "Stray `console.log` in TS/JS \u2014 apps/cli/src/commands/main.ts:145", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 apps/cli/src/commands/main.ts:145"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-323e6a718115f4e5", "name": "Stray `console.log` in TS/JS \u2014 apps/cli/src/commands/cron.ts:20", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 apps/cli/src/commands/cron.ts:20"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a6a1672c8edf1346", "name": "Stray `console.log` in TS/JS \u2014 apps/cli/src/commands/setup.ts:79", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 apps/cli/src/commands/setup.ts:79"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-24526fefa05edbbb", "name": "Stray `console.log` in TS/JS \u2014 apps/cli/src/commands/channels.ts:107", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 apps/cli/src/commands/channels.ts:107"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-29657140ef0e625e", "name": "TODO/FIXME marker in shipping code \u2014 packages/swarm/src/worktree.ts:150", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 packages/swarm/src/worktree.ts:150"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-f5a545835736366b", "name": "Stray `console.log` in TS/JS \u2014 packages/auth/src/index.ts:65", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/auth/src/index.ts:65"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8fe37b5c6cb427a5", "name": "Insecure pattern 'node_child_process' in apps/frontend/src/hooks/useBackendSession.ts:2", "shortDescription": {"text": "Insecure pattern 'node_child_process' in apps/frontend/src/hooks/useBackendSession.ts:2"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6ae9451c7ef9cf45", "name": "Insecure pattern 'node_child_process' in apps/cli/src/runtime.ts:1", "shortDescription": {"text": "Insecure pattern 'node_child_process' in apps/cli/src/runtime.ts:1"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-bab7c492dfeb71b3", "name": "Insecure pattern 'node_child_process' in apps/cli/src/commands/resolveBun.test.ts:2", "shortDescription": {"text": "Insecure pattern 'node_child_process' in apps/cli/src/commands/resolveBun.test.ts:2"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-de629a717832b13f", "name": "Insecure pattern 'node_child_process' in apps/cli/src/commands/resolveBun.ts:1", "shortDescription": {"text": "Insecure pattern 'node_child_process' in apps/cli/src/commands/resolveBun.ts:1"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7bb96b0b38fcb6ff", "name": "Insecure pattern 'node_child_process' in packages/swarm/src/worktree.test.ts:2", "shortDescription": {"text": "Insecure pattern 'node_child_process' in packages/swarm/src/worktree.test.ts:2"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5c6cec1ca45e2bd4", "name": "Insecure pattern 'node_child_process' in packages/swarm/src/team-lifecycle.ts:12", "shortDescription": {"text": "Insecure pattern 'node_child_process' in packages/swarm/src/team-lifecycle.ts:12"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-be928cc6f374e483", "name": "Insecure pattern 'node_child_process' in packages/hooks/src/index.ts:1", "shortDescription": {"text": "Insecure pattern 'node_child_process' in packages/hooks/src/index.ts:1"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d8b59ccd0751c84b", "name": "Insecure pattern 'node_child_process' in packages/services/src/tasks/index.ts:1", "shortDescription": {"text": "Insecure pattern 'node_child_process' in packages/services/src/tasks/index.ts:1"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-cc07b791e6bdddcc", "name": "Insecure pattern 'node_child_process' in packages/services/src/lsp/index.ts:1", "shortDescription": {"text": "Insecure pattern 'node_child_process' in packages/services/src/lsp/index.ts:1"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5773b37615c44495", "name": "Insecure pattern 'node_child_process' in packages/tools/src/search/grep.ts:4", "shortDescription": {"text": "Insecure pattern 'node_child_process' in packages/tools/src/search/grep.ts:4"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-60b134625d3a83ac", "name": "Insecure pattern 'node_child_process' in packages/tools/src/file/glob.test.ts:5", "shortDescription": {"text": "Insecure pattern 'node_child_process' in packages/tools/src/file/glob.test.ts:5"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2bb787a48a4ce259", "name": "Insecure pattern 'node_child_process' in packages/tools/src/file/glob.ts:3", "shortDescription": {"text": "Insecure pattern 'node_child_process' in packages/tools/src/file/glob.ts:3"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-04983bd78be130c9", "name": "Insecure pattern 'node_child_process' in packages/tools/src/shell/bash.ts:1", "shortDescription": {"text": "Insecure pattern 'node_child_process' in packages/tools/src/shell/bash.ts:1"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-14ff6359d30a1af4", "name": "Insecure pattern 'node_child_process' in packages/prompts/src/index.ts:3", "shortDescription": {"text": "Insecure pattern 'node_child_process' in packages/prompts/src/index.ts:3"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-27924aa79fa4a517", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "pnpm/action-setup@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-cb639d9a10a47b23", "name": "package.json defines install-time lifecycle scripts", "shortDescription": {"text": "package.json defines install-time lifecycle scripts"}, "fullDescription": {"text": "preinstall/install/postinstall/prepare scripts execute during dependency installation. Review them carefully for network calls, obfuscation, shell execution, or credential access."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-604853734c7ef671", "name": "Very large file: apps/cli/src/commands/slash-commands.ts (1550 lines)", "shortDescription": {"text": "Very large file: apps/cli/src/commands/slash-commands.ts (1550 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ef1daef415e49dc9", "name": "Very large file: apps/cli/src/commands/main.ts (1558 lines)", "shortDescription": {"text": "Very large file: apps/cli/src/commands/main.ts (1558 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-141b30a41e03817b", "name": "No license file detected", "shortDescription": {"text": "No license file detected"}, "fullDescription": {"text": "No LICENSE/COPYING/NOTICE file was found. Generated repositories often omit licensing, which blocks reuse and automated intake."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3f02143ce17b7bf9", "name": "Node manifest has dependencies but no lockfile: apps/frontend/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: apps/frontend/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a0165ea166579aa4", "name": "Node manifest has dependencies but no lockfile: apps/cli/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: apps/cli/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-88d18560752fdc03", "name": "Node manifest has dependencies but no lockfile: packages/swarm/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/swarm/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-41b225e183229484", "name": "Node manifest has dependencies but no lockfile: packages/auth/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/auth/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0a0634ffe3eb1107", "name": "Node manifest has dependencies but no lockfile: packages/api/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/api/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-01fd113542f7748c", "name": "Node manifest has dependencies but no lockfile: packages/coordinator/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/coordinator/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b9c03e4b51641936", "name": "Node manifest has dependencies but no lockfile: packages/mcp/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/mcp/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2d405bd46bd998cb", "name": "Node manifest has dependencies but no lockfile: packages/commands/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/commands/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fe4628fb72418d63", "name": "Node manifest has dependencies but no lockfile: packages/personalization/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/personalization/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-47edb5907af5997f", "name": "Node manifest has dependencies but no lockfile: packages/utils/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/utils/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-901ddb4831c99b06", "name": "Node manifest has dependencies but no lockfile: packages/keybindings/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/keybindings/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e926db3ae2513f47", "name": "Node manifest has dependencies but no lockfile: packages/themes/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/themes/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9d2c9328e507f1c5", "name": "Node manifest has dependencies but no lockfile: packages/voice/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/voice/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8cad527fa7b2fdd7", "name": "Node manifest has dependencies but no lockfile: packages/sandbox/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/sandbox/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6980af6f44bc070f", "name": "Node manifest has dependencies but no lockfile: packages/memory/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/memory/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-002002f2508ee68a", "name": "Node manifest has dependencies but no lockfile: packages/hooks/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/hooks/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ba72c867a428389e", "name": "Node manifest has dependencies but no lockfile: packages/permissions/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/permissions/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8b0073cb8f0ba27a", "name": "Node manifest has dependencies but no lockfile: packages/output-styles/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/output-styles/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a5d46994f67835d9", "name": "Node manifest has dependencies but no lockfile: packages/services/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/services/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b45b624f1b2e1cec", "name": "Node manifest has dependencies but no lockfile: packages/tools/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/tools/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-118742982f367f35", "name": "Node manifest has dependencies but no lockfile: packages/channels/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/channels/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-28e92806c0db3cd2", "name": "Node manifest has dependencies but no lockfile: packages/core/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/core/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c034792686b5ac55", "name": "Node manifest has dependencies but no lockfile: packages/prompts/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/prompts/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5903b0801432e4f9", "name": "Node manifest has dependencies but no lockfile: packages/vim/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/vim/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ec1830d7b7399060", "name": "Node manifest has dependencies but no lockfile: packages/skills/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/skills/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-09729872b0767539", "name": "Node manifest has dependencies but no lockfile: packages/bridge/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/bridge/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1e41b1c1df48e119", "name": "Node manifest has dependencies but no lockfile: packages/plugins/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/plugins/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 103 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 14 placeholder/mock markers across 8 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b9088664ace7f748", "name": "Composite production-readiness gap", "shortDescription": {"text": "Composite production-readiness gap"}, "fullDescription": {"text": "Multiple low-cost hardening controls are missing together: license, lockfile. Opus verification showed these co-occurring gaps are a better readiness signal than reading each flag in isolation."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-a0cf3afe987446c1", "name": "Legacy-named symbol `rft_old` in packages/auth/src/index.test.ts:73", "shortDescription": {"text": "Legacy-named symbol `rft_old` in packages/auth/src/index.test.ts:73"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5c6458aa6833be9f", "name": "`fetch()` without try/.catch or AbortSignal \u2014 packages/auth/src/index.ts:47", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/auth/src/index.ts:47"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8f2ee279c7b8665a", "name": "Legacy-named symbol `hydrateLegacy` in packages/memory/src/index.ts:552", "shortDescription": {"text": "Legacy-named symbol `hydrateLegacy` in packages/memory/src/index.ts:552"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1e9eddacfc01b554", "name": "Commented-code block (6 lines) in packages/memory/src/index.ts:620", "shortDescription": {"text": "Commented-code block (6 lines) in packages/memory/src/index.ts:620"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-06816d23c141592d", "name": "Commented-code block (5 lines) in packages/services/src/tasks/index.ts:480", "shortDescription": {"text": "Commented-code block (5 lines) in packages/services/src/tasks/index.ts:480"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-3151d9e313ab65e9", "name": "Legacy-named symbol `receive_v1` in packages/channels/src/impl/feishu.ts:66", "shortDescription": {"text": "Legacy-named symbol `receive_v1` in packages/channels/src/impl/feishu.ts:66"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-52e7e3582bf4f689", "name": "`fetch()` without try/.catch or AbortSignal \u2014 packages/channels/src/impl/http.ts:18", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/channels/src/impl/http.ts:18"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/18681"}, "properties": {"repository": "rzx007/openharness-ts", "repoUrl": "https://github.com/rzx007/openharness-ts", "branch": "main"}, "results": [{"ruleId": "scanner-331cfee214dd792d", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 apps/frontend/build.ts:33"}, "properties": {"repobilityId": "566cdacbad261960", "scanner": "scanner-primary", "fingerprint": "331cfee214dd792d", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-bf471cb9dd387449", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 apps/cli/build.ts:33"}, "properties": {"repobilityId": "a7cdffe644a81d64", "scanner": "scanner-primary", "fingerprint": "bf471cb9dd387449", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-0d188ede6e1ca99e", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 apps/cli/src/index.ts:68"}, "properties": {"repobilityId": "a088766160455c10", "scanner": "scanner-primary", "fingerprint": "0d188ede6e1ca99e", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-6eb21d589897643b", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 apps/cli/src/dry-run.ts:185"}, "properties": {"repobilityId": "21a3e82af63dbf0f", "scanner": "scanner-primary", "fingerprint": "6eb21d589897643b", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-fb3bb088728eb6ec", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 apps/cli/src/commands/auth.ts:15"}, "properties": {"repobilityId": "9cee89564e30d606", "scanner": "scanner-primary", "fingerprint": "fb3bb088728eb6ec", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-9364bfe25e90da54", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 apps/cli/src/commands/provider.ts:95"}, "properties": {"repobilityId": "53cd74d107debdba", "scanner": "scanner-primary", "fingerprint": "9364bfe25e90da54", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-b46be2d3cdc24919", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 apps/cli/src/commands/plugin.ts:13"}, "properties": {"repobilityId": "750a73c24934215d", "scanner": "scanner-primary", "fingerprint": "b46be2d3cdc24919", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-318d15ab402dd467", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 apps/cli/src/commands/mcp.ts:15"}, "properties": {"repobilityId": "ee881b2c5f70ffcb", "scanner": "scanner-primary", "fingerprint": "318d15ab402dd467", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-a46f29722d37d45a", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 apps/cli/src/commands/main.ts:145"}, "properties": {"repobilityId": "410cdd0f9f43488d", "scanner": "scanner-primary", "fingerprint": "a46f29722d37d45a", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-323e6a718115f4e5", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 apps/cli/src/commands/cron.ts:20"}, "properties": {"repobilityId": "afbcb295c969ed83", "scanner": "scanner-primary", "fingerprint": "323e6a718115f4e5", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-a6a1672c8edf1346", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 apps/cli/src/commands/setup.ts:79"}, "properties": {"repobilityId": "40b834f0774cdf8c", "scanner": "scanner-primary", "fingerprint": "a6a1672c8edf1346", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-24526fefa05edbbb", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 apps/cli/src/commands/channels.ts:107"}, "properties": {"repobilityId": "3d12036094a1750f", "scanner": "scanner-primary", "fingerprint": "24526fefa05edbbb", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-29657140ef0e625e", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 packages/swarm/src/worktree.ts:150"}, "properties": {"repobilityId": "21c4f9f9ea5c8134", "scanner": "scanner-primary", "fingerprint": "29657140ef0e625e", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.todo-marker"]}}, {"ruleId": "scanner-f5a545835736366b", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/auth/src/index.ts:65"}, "properties": {"repobilityId": "df16047dc835c44b", "scanner": "scanner-primary", "fingerprint": "f5a545835736366b", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-8fe37b5c6cb427a5", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in apps/frontend/src/hooks/useBackendSession.ts:2"}, "properties": {"repobilityId": "e122616623a7f155", "scanner": "scanner-primary", "fingerprint": "8fe37b5c6cb427a5", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/frontend/src/hooks/useBackendSession.ts"}, "region": {"startLine": 2}}}]}, {"ruleId": "scanner-6ae9451c7ef9cf45", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in apps/cli/src/runtime.ts:1"}, "properties": {"repobilityId": "ae7aa323cc421ce7", "scanner": "scanner-primary", "fingerprint": "6ae9451c7ef9cf45", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/cli/src/runtime.ts"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-bab7c492dfeb71b3", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in apps/cli/src/commands/resolveBun.test.ts:2"}, "properties": {"repobilityId": "ff4ea85dc1d86bcc", "scanner": "scanner-primary", "fingerprint": "bab7c492dfeb71b3", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/cli/src/commands/resolveBun.test.ts"}, "region": {"startLine": 2}}}]}, {"ruleId": "scanner-de629a717832b13f", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in apps/cli/src/commands/resolveBun.ts:1"}, "properties": {"repobilityId": "bdd22d60b340697a", "scanner": "scanner-primary", "fingerprint": "de629a717832b13f", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/cli/src/commands/resolveBun.ts"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7bb96b0b38fcb6ff", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in packages/swarm/src/worktree.test.ts:2"}, "properties": {"repobilityId": "3d8e83e24190533e", "scanner": "scanner-primary", "fingerprint": "7bb96b0b38fcb6ff", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/swarm/src/worktree.test.ts"}, "region": {"startLine": 2}}}]}, {"ruleId": "scanner-5c6cec1ca45e2bd4", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in packages/swarm/src/team-lifecycle.ts:12"}, "properties": {"repobilityId": "4ada5ac56c82dbe4", "scanner": "scanner-primary", "fingerprint": "5c6cec1ca45e2bd4", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/swarm/src/team-lifecycle.ts"}, "region": {"startLine": 12}}}]}, {"ruleId": "scanner-be928cc6f374e483", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in packages/hooks/src/index.ts:1"}, "properties": {"repobilityId": "63493edd8cceb5af", "scanner": "scanner-primary", "fingerprint": "be928cc6f374e483", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/hooks/src/index.ts"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d8b59ccd0751c84b", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in packages/services/src/tasks/index.ts:1"}, "properties": {"repobilityId": "2c864dd02f5f09de", "scanner": "scanner-primary", "fingerprint": "d8b59ccd0751c84b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/services/src/tasks/index.ts"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-cc07b791e6bdddcc", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in packages/services/src/lsp/index.ts:1"}, "properties": {"repobilityId": "c925032bb5714987", "scanner": "scanner-primary", "fingerprint": "cc07b791e6bdddcc", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/services/src/lsp/index.ts"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5773b37615c44495", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in packages/tools/src/search/grep.ts:4"}, "properties": {"repobilityId": "447617f5c1dfde53", "scanner": "scanner-primary", "fingerprint": "5773b37615c44495", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/tools/src/search/grep.ts"}, "region": {"startLine": 4}}}]}, {"ruleId": "scanner-60b134625d3a83ac", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in packages/tools/src/file/glob.test.ts:5"}, "properties": {"repobilityId": "af21331b9635aba1", "scanner": "scanner-primary", "fingerprint": "60b134625d3a83ac", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/tools/src/file/glob.test.ts"}, "region": {"startLine": 5}}}]}, {"ruleId": "scanner-2bb787a48a4ce259", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in packages/tools/src/file/glob.ts:3"}, "properties": {"repobilityId": "6338a3ac014c3aaa", "scanner": "scanner-primary", "fingerprint": "2bb787a48a4ce259", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/tools/src/file/glob.ts"}, "region": {"startLine": 3}}}]}, {"ruleId": "scanner-04983bd78be130c9", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in packages/tools/src/shell/bash.ts:1"}, "properties": {"repobilityId": "8572f8e720e7d82e", "scanner": "scanner-primary", "fingerprint": "04983bd78be130c9", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/tools/src/shell/bash.ts"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-14ff6359d30a1af4", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in packages/prompts/src/index.ts:3"}, "properties": {"repobilityId": "ec350a23ffea5971", "scanner": "scanner-primary", "fingerprint": "14ff6359d30a1af4", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/prompts/src/index.ts"}, "region": {"startLine": 3}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "54597edb7f5bad38", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 16}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "989a74409a402368", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 19}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "dcb6504096fc20e7", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 25}}}]}, {"ruleId": "scanner-cb639d9a10a47b23", "level": "note", "message": {"text": "package.json defines install-time lifecycle scripts"}, "properties": {"repobilityId": "b86179956da3a4a8", "scanner": "scanner-primary", "fingerprint": "cb639d9a10a47b23", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "npm", "install-scripts"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-604853734c7ef671", "level": "note", "message": {"text": "Very large file: apps/cli/src/commands/slash-commands.ts (1550 lines)"}, "properties": {"repobilityId": "e7438bae5976ed5a", "scanner": "scanner-primary", "fingerprint": "604853734c7ef671", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-ef1daef415e49dc9", "level": "note", "message": {"text": "Very large file: apps/cli/src/commands/main.ts (1558 lines)"}, "properties": {"repobilityId": "b6828c098d68877a", "scanner": "scanner-primary", "fingerprint": "ef1daef415e49dc9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-141b30a41e03817b", "level": "note", "message": {"text": "No license file detected"}, "properties": {"repobilityId": "e75d7111533fd84d", "scanner": "scanner-primary", "fingerprint": "141b30a41e03817b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["license", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-3f02143ce17b7bf9", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: apps/frontend/package.json"}, "properties": {"repobilityId": "8293ac8b769dc370", "scanner": "scanner-primary", "fingerprint": "3f02143ce17b7bf9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/frontend/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a0165ea166579aa4", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: apps/cli/package.json"}, "properties": {"repobilityId": "027862884b842339", "scanner": "scanner-primary", "fingerprint": "a0165ea166579aa4", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/cli/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-88d18560752fdc03", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/swarm/package.json"}, "properties": {"repobilityId": "640298015fc4794d", "scanner": "scanner-primary", "fingerprint": "88d18560752fdc03", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/swarm/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-41b225e183229484", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/auth/package.json"}, "properties": {"repobilityId": "c022328d0892fb4d", "scanner": "scanner-primary", "fingerprint": "41b225e183229484", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/auth/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0a0634ffe3eb1107", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/api/package.json"}, "properties": {"repobilityId": "61aa8b13d545e157", "scanner": "scanner-primary", "fingerprint": "0a0634ffe3eb1107", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/api/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-01fd113542f7748c", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/coordinator/package.json"}, "properties": {"repobilityId": "4459b301bb237c96", "scanner": "scanner-primary", "fingerprint": "01fd113542f7748c", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/coordinator/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b9c03e4b51641936", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/mcp/package.json"}, "properties": {"repobilityId": "7b57a55f1ea73746", "scanner": "scanner-primary", "fingerprint": "b9c03e4b51641936", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/mcp/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2d405bd46bd998cb", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/commands/package.json"}, "properties": {"repobilityId": "422297261dd0f7ae", "scanner": "scanner-primary", "fingerprint": "2d405bd46bd998cb", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/commands/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-fe4628fb72418d63", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/personalization/package.json"}, "properties": {"repobilityId": "dac926bbf51fd5f0", "scanner": "scanner-primary", "fingerprint": "fe4628fb72418d63", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/personalization/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-47edb5907af5997f", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/utils/package.json"}, "properties": {"repobilityId": "64857de4b757dead", "scanner": "scanner-primary", "fingerprint": "47edb5907af5997f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/utils/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-901ddb4831c99b06", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/keybindings/package.json"}, "properties": {"repobilityId": "4a1fcd5768fa20d6", "scanner": "scanner-primary", "fingerprint": "901ddb4831c99b06", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/keybindings/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e926db3ae2513f47", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/themes/package.json"}, "properties": {"repobilityId": "b35a891ef2ada5e2", "scanner": "scanner-primary", "fingerprint": "e926db3ae2513f47", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/themes/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9d2c9328e507f1c5", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/voice/package.json"}, "properties": {"repobilityId": "d2fb544751e263fa", "scanner": "scanner-primary", "fingerprint": "9d2c9328e507f1c5", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/voice/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8cad527fa7b2fdd7", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/sandbox/package.json"}, "properties": {"repobilityId": "ef462da675e271cd", "scanner": "scanner-primary", "fingerprint": "8cad527fa7b2fdd7", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/sandbox/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6980af6f44bc070f", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/memory/package.json"}, "properties": {"repobilityId": "56d5fdf0e2264af4", "scanner": "scanner-primary", "fingerprint": "6980af6f44bc070f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/memory/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-002002f2508ee68a", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/hooks/package.json"}, "properties": {"repobilityId": "59f800ce16e63eef", "scanner": "scanner-primary", "fingerprint": "002002f2508ee68a", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/hooks/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ba72c867a428389e", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/permissions/package.json"}, "properties": {"repobilityId": "b966f62627235100", "scanner": "scanner-primary", "fingerprint": "ba72c867a428389e", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/permissions/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8b0073cb8f0ba27a", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/output-styles/package.json"}, "properties": {"repobilityId": "dfe283de8bfa4fa5", "scanner": "scanner-primary", "fingerprint": "8b0073cb8f0ba27a", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/output-styles/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a5d46994f67835d9", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/services/package.json"}, "properties": {"repobilityId": "5544cf3ede5c1b69", "scanner": "scanner-primary", "fingerprint": "a5d46994f67835d9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/services/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b45b624f1b2e1cec", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/tools/package.json"}, "properties": {"repobilityId": "767491b0490d1f83", "scanner": "scanner-primary", "fingerprint": "b45b624f1b2e1cec", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/tools/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-118742982f367f35", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/channels/package.json"}, "properties": {"repobilityId": "230047d52ff3aa39", "scanner": "scanner-primary", "fingerprint": "118742982f367f35", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/channels/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-28e92806c0db3cd2", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/core/package.json"}, "properties": {"repobilityId": "8640e46be7e3f9b2", "scanner": "scanner-primary", "fingerprint": "28e92806c0db3cd2", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/core/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c034792686b5ac55", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/prompts/package.json"}, "properties": {"repobilityId": "c39d58a3ee1bcaad", "scanner": "scanner-primary", "fingerprint": "c034792686b5ac55", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/prompts/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5903b0801432e4f9", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/vim/package.json"}, "properties": {"repobilityId": "0fff9b2e9235c380", "scanner": "scanner-primary", "fingerprint": "5903b0801432e4f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/vim/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ec1830d7b7399060", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/skills/package.json"}, "properties": {"repobilityId": "b52f5e2f2add1668", "scanner": "scanner-primary", "fingerprint": "ec1830d7b7399060", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/skills/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-09729872b0767539", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/bridge/package.json"}, "properties": {"repobilityId": "57ef25a1586b23c8", "scanner": "scanner-primary", "fingerprint": "09729872b0767539", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/bridge/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1e41b1c1df48e119", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/plugins/package.json"}, "properties": {"repobilityId": "7b9b39bc3d490a71", "scanner": "scanner-primary", "fingerprint": "1e41b1c1df48e119", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/plugins/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "16fe6533bbf88a3e", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "6ace885ac5e85e2c", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "eb65350d9c3ce333", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-b9088664ace7f748", "level": "note", "message": {"text": "Composite production-readiness gap"}, "properties": {"repobilityId": "e48b63c0496a8a23", "scanner": "scanner-primary", "fingerprint": "b9088664ace7f748", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["production-readiness", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "3f467b3d79e38f19", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "ed190bb3325d1e00", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-a0cf3afe987446c1", "level": "note", "message": {"text": "Legacy-named symbol `rft_old` in packages/auth/src/index.test.ts:73"}, "properties": {"repobilityId": "3111b2f258b0ee88", "scanner": "scanner-primary", "fingerprint": "a0cf3afe987446c1", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-5c6458aa6833be9f", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/auth/src/index.ts:47"}, "properties": {"repobilityId": "1c23fed1fe9150e6", "scanner": "scanner-primary", "fingerprint": "5c6458aa6833be9f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-8f2ee279c7b8665a", "level": "note", "message": {"text": "Legacy-named symbol `hydrateLegacy` in packages/memory/src/index.ts:552"}, "properties": {"repobilityId": "7b12ad15936a6fb8", "scanner": "scanner-primary", "fingerprint": "8f2ee279c7b8665a", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-1e9eddacfc01b554", "level": "none", "message": {"text": "Commented-code block (6 lines) in packages/memory/src/index.ts:620"}, "properties": {"repobilityId": "90f306d55b25ff9a", "scanner": "scanner-primary", "fingerprint": "1e9eddacfc01b554", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-06816d23c141592d", "level": "none", "message": {"text": "Commented-code block (5 lines) in packages/services/src/tasks/index.ts:480"}, "properties": {"repobilityId": "c13e4c9dd38117de", "scanner": "scanner-primary", "fingerprint": "06816d23c141592d", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-3151d9e313ab65e9", "level": "note", "message": {"text": "Legacy-named symbol `receive_v1` in packages/channels/src/impl/feishu.ts:66"}, "properties": {"repobilityId": "801d2015473dbbae", "scanner": "scanner-primary", "fingerprint": "3151d9e313ab65e9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-52e7e3582bf4f689", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/channels/src/impl/http.ts:18"}, "properties": {"repobilityId": "ec4d852614feccbb", "scanner": "scanner-primary", "fingerprint": "52e7e3582bf4f689", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}]}]}