{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-0c66dcb5f56a69ed", "name": "`truncate` class without `title=` for hover reveal \u2014 client/src/App.jsx:192", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 client/src/App.jsx:192"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-847386fa40ea9048", "name": "Stray `console.log` in TS/JS \u2014 client/src/App.jsx:2800", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 client/src/App.jsx:2800"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f2b9cedbeb7e0505", "name": "`truncate` class without `title=` for hover reveal \u2014 client/src/components/ProcessPanel.jsx:96", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 client/src/components/ProcessPanel.jsx:96"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-29d3265a839fcd06", "name": "`truncate` class without `title=` for hover reveal \u2014 client/src/components/FileExplorerPanel.jsx:193", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 client/src/components/FileExplorerPanel.jsx:193"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-db71384d323e9aa4", "name": "`truncate` class without `title=` for hover reveal \u2014 client/src/components/FileChangesPanel.jsx:115", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 client/src/components/FileChangesPanel.jsx:115"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-e68309f08fe142d6", "name": "`truncate` class without `title=` for hover reveal \u2014 client/src/components/PermissionPrompt.jsx:362", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 client/src/components/PermissionPrompt.jsx:362"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-aa62ce5b8e20ce10", "name": "`truncate` class without `title=` for hover reveal \u2014 client/src/components/AgentsPanel.jsx:98", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 client/src/components/AgentsPanel.jsx:98"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-f5912d52746cb406", "name": "`truncate` class without `title=` for hover reveal \u2014 client/src/components/SubagentView.jsx:55", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 client/src/components/SubagentView.jsx:55"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-55eaaa9d635be1f8", "name": "`truncate` class without `title=` for hover reveal \u2014 client/src/components/MCPPanel.jsx:256", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 client/src/components/MCPPanel.jsx:256"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-202be477f1765614", "name": "`truncate` class without `title=` for hover reveal \u2014 client/src/components/MessageBubble.jsx:339", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 client/src/components/MessageBubble.jsx:339"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-48c49ebad4967342", "name": "`truncate` class without `title=` for hover reveal \u2014 client/src/components/ChatInput.jsx:590", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 client/src/components/ChatInput.jsx:590"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-9e9af8ac9c06ee7e", "name": "`truncate` class without `title=` for hover reveal \u2014 client/src/components/ToolCallCard.jsx:79", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 client/src/components/ToolCallCard.jsx:79"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-0220d2cbc9c5d3fc", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 client/src/components/ArtifactPreview.jsx:82", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 client/src/components/ArtifactPreview.jsx:82"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-530e23d05ca422ab", "name": "`truncate` class without `title=` for hover reveal \u2014 client/src/components/AgentMonitorPanel.jsx:24", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 client/src/components/AgentMonitorPanel.jsx:24"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-d9677ad290f03c0b", "name": "`truncate` class without `title=` for hover reveal \u2014 client/src/components/TurnBubble.jsx:204", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 client/src/components/TurnBubble.jsx:204"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-7457899861013618", "name": "`truncate` class without `title=` for hover reveal \u2014 client/src/components/SettingsPanel.jsx:336", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 client/src/components/SettingsPanel.jsx:336"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-a01839c019c894ff", "name": "`truncate` class without `title=` for hover reveal \u2014 client/src/components/ModelBadge.jsx:162", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 client/src/components/ModelBadge.jsx:162"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-efcd78cd778072eb", "name": "`truncate` class without `title=` for hover reveal \u2014 client/src/components/tools/EditDiffCard.jsx:57", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 client/src/components/tools/EditDiffCard.jsx:57"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-083c070252d7c81f", "name": "`truncate` class without `title=` for hover reveal \u2014 client/src/components/tools/GrepGlobCard.jsx:34", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 client/src/components/tools/GrepGlobCard.jsx:34"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-2069c71704c9847c", "name": "`truncate` class without `title=` for hover reveal \u2014 client/src/components/tools/TaskCard.jsx:77", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 client/src/components/tools/TaskCard.jsx:77"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-85bd0313b99958cb", "name": "`truncate` class without `title=` for hover reveal \u2014 client/src/components/tools/BashCard.jsx:25", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 client/src/components/tools/BashCard.jsx:25"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-16e32f4073b09103", "name": "`truncate` class without `title=` for hover reveal \u2014 client/src/components/tools/SkillCard.jsx:30", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 client/src/components/tools/SkillCard.jsx:30"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-a0da838f97d21846", "name": "`truncate` class without `title=` for hover reveal \u2014 client/src/components/tools/ReadCard.jsx:38", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 client/src/components/tools/ReadCard.jsx:38"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-ba4502cda0955171", "name": "Stray `console.log` in TS/JS \u2014 client/src/hooks/useWebSocket.js:76", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 client/src/hooks/useWebSocket.js:76"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-07601ef64e31ba49", "name": "Stray `console.log` in TS/JS \u2014 server/index.js:93", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 server/index.js:93"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c6cf50ea80b7b673", "name": "Stray `console.log` in TS/JS \u2014 server/routes/chat.js:374", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 server/routes/chat.js:374"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ed4d467279a8ae31", "name": "Insecure pattern 'dangerous_innerhtml' in client/src/components/ArtifactPreview.jsx:82", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in client/src/components/ArtifactPreview.jsx:82"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9dff8f023db6d18b", "name": "Insecure pattern 'node_child_process' in scripts/public-build.cjs:2", "shortDescription": {"text": "Insecure pattern 'node_child_process' in scripts/public-build.cjs:2"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e5e168600d6108af", "name": "Insecure pattern 'node_child_process' in scripts/check-http-smoke.cjs:3", "shortDescription": {"text": "Insecure pattern 'node_child_process' in scripts/check-http-smoke.cjs:3"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-99dac509ccba2dca", "name": "Insecure pattern 'node_child_process' in scripts/audit-public.cjs:2", "shortDescription": {"text": "Insecure pattern 'node_child_process' in scripts/audit-public.cjs:2"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8fc1478588cd083f", "name": "Insecure pattern 'node_child_process' in server/index.js:3", "shortDescription": {"text": "Insecure pattern 'node_child_process' in server/index.js:3"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-84916f7e666fbc0f", "name": "Insecure pattern 'node_child_process' in server/routes/settings.js:4", "shortDescription": {"text": "Insecure pattern 'node_child_process' in server/routes/settings.js:4"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-992686f316a17f84", "name": "Insecure pattern 'node_child_process' in server/routes/permission-check.js:6", "shortDescription": {"text": "Insecure pattern 'node_child_process' in server/routes/permission-check.js:6"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7f79dc311f05a282", "name": "Insecure pattern 'node_child_process' in server/routes/cli-check.js:2", "shortDescription": {"text": "Insecure pattern 'node_child_process' in server/routes/cli-check.js:2"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-909222ff87598138", "name": "Insecure pattern 'node_child_process' in server/routes/processes.js:5", "shortDescription": {"text": "Insecure pattern 'node_child_process' in server/routes/processes.js:5"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-39b174a5fbdc403b", "name": "Insecure pattern 'node_child_process' in server/routes/git.js:2", "shortDescription": {"text": "Insecure pattern 'node_child_process' in server/routes/git.js:2"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8184d77850647dc5", "name": "Insecure pattern 'node_child_process' in server/routes/mcp.js:5", "shortDescription": {"text": "Insecure pattern 'node_child_process' in server/routes/mcp.js:5"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-13f63c1523b7daa5", "name": "Insecure pattern 'node_child_process' in server/routes/checkpoints.js:2", "shortDescription": {"text": "Insecure pattern 'node_child_process' in server/routes/checkpoints.js:2"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-981b0ee6e01c3b07", "name": "Insecure pattern 'node_child_process' in server/routes/file-changes.js:3", "shortDescription": {"text": "Insecure pattern 'node_child_process' in server/routes/file-changes.js:3"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ab1bc7d470c40e0b", "name": "Insecure pattern 'node_child_process' in server/routes/chat.js:2", "shortDescription": {"text": "Insecure pattern 'node_child_process' in server/routes/chat.js:2"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-50cff4375a995f5e", "name": "Insecure pattern 'node_child_process' in server/routes/worktree.js:2", "shortDescription": {"text": "Insecure pattern 'node_child_process' in server/routes/worktree.js:2"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a440a53731461331", "name": "Insecure pattern 'node_child_process' in server/routes/files.js:6", "shortDescription": {"text": "Insecure pattern 'node_child_process' in server/routes/files.js:6"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-65b21bf3cd7c94bc", "name": "Insecure pattern 'node_child_process' in server/routes/open-url.js:2", "shortDescription": {"text": "Insecure pattern 'node_child_process' in server/routes/open-url.js:2"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-934100170b88343b", "name": "Insecure pattern 'node_child_process' in server/routes/download-update.js:2", "shortDescription": {"text": "Insecure pattern 'node_child_process' in server/routes/download-update.js:2"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a674ba3721217198", "name": "Insecure pattern 'node_child_process' in server/routes/picker.js:2", "shortDescription": {"text": "Insecure pattern 'node_child_process' in server/routes/picker.js:2"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e7f111c9ee402ead", "name": "Insecure pattern 'node_child_process' in server/routes/agents.js:2", "shortDescription": {"text": "Insecure pattern 'node_child_process' in server/routes/agents.js:2"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-50df6a979329fe13", "name": "Insecure pattern 'node_child_process' in server/routes/version-check.js:6", "shortDescription": {"text": "Insecure pattern 'node_child_process' in server/routes/version-check.js:6"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a4abc77d530f3389", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/setup-node@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-af4aff5245cfedf4", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-cb639d9a10a47b23", "name": "package.json defines install-time lifecycle scripts", "shortDescription": {"text": "package.json defines install-time lifecycle scripts"}, "fullDescription": {"text": "preinstall/install/postinstall/prepare scripts execute during dependency installation. Review them carefully for network calls, obfuscation, shell execution, or credential access."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ad18c8209a57165b", "name": "Very large file: client/src/App.jsx (6380 lines)", "shortDescription": {"text": "Very large file: client/src/App.jsx (6380 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2ca2765983e4f0cd", "name": "Very large file: server/routes/settings.js (1096 lines)", "shortDescription": {"text": "Very large file: server/routes/settings.js (1096 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6893a6c8b0861585", "name": "Very low test-to-source ratio", "shortDescription": {"text": "Very low test-to-source ratio"}, "fullDescription": {"text": "0 test file(s) for 92 source file(s) (ratio 0.00). Consider adding integration or unit tests for critical paths."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 30 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 33 placeholder/mock markers across 8 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9d79c4077342a7d0", "name": "Runtime service client appears to use placeholder configuration", "shortDescription": {"text": "Runtime service client appears to use placeholder configuration"}, "fullDescription": {"text": "A runtime source file appears to wire Supabase/Firebase/AI/payment-style clients to placeholder URLs, keys, or fallback values. In the Fable corpus this often means the UI/API shape is present while the backend service is not actually configured."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-11825279136b53a3", "name": "CI is configured but no tests are detected", "shortDescription": {"text": "CI is configured but no tests are detected"}, "fullDescription": {"text": "A CI pipeline exists, but the scan found no test files to gate. Opus labeled this generated-code pattern as config theater: release machinery exists, but it has little behavioral signal."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-74a75763cfe39c64", "name": "Commented-code block (6 lines) in client/src/App.jsx:369", "shortDescription": {"text": "Commented-code block (6 lines) in client/src/App.jsx:369"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-1bb80aeca8167d71", "name": "`fetch()` without try/.catch or AbortSignal \u2014 client/src/App.jsx:2298", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 client/src/App.jsx:2298"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4cdc2a451d2b3529", "name": "Commented-code block (6 lines) in client/src/stores/sessionStore.js:148", "shortDescription": {"text": "Commented-code block (6 lines) in client/src/stores/sessionStore.js:148"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-eedfecfefa7f325c", "name": "Commented-code block (7 lines) in client/src/utils/pricing.js:131", "shortDescription": {"text": "Commented-code block (7 lines) in client/src/utils/pricing.js:131"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-e4afac0359136517", "name": "Commented-code block (6 lines) in client/src/utils/clipboard.js:3", "shortDescription": {"text": "Commented-code block (6 lines) in client/src/utils/clipboard.js:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-84dd297d03017ac8", "name": "Commented-code block (6 lines) in client/src/components/FileExplorerPanel.jsx:408", "shortDescription": {"text": "Commented-code block (6 lines) in client/src/components/FileExplorerPanel.jsx:408"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-e49cd530746c6cb0", "name": "Commented-code block (8 lines) in client/src/components/PermissionPrompt.jsx:59", "shortDescription": {"text": "Commented-code block (8 lines) in client/src/components/PermissionPrompt.jsx:59"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-101f38bffc2ee034", "name": "Commented-code block (5 lines) in client/src/components/MessageBubble.jsx:93", "shortDescription": {"text": "Commented-code block (5 lines) in client/src/components/MessageBubble.jsx:93"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-d619ee1759739c00", "name": "Commented-code block (5 lines) in client/src/components/McpForm.jsx:4", "shortDescription": {"text": "Commented-code block (5 lines) in client/src/components/McpForm.jsx:4"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-244062b8d33895b4", "name": "`fetch()` without try/.catch or AbortSignal \u2014 client/src/components/McpForm.jsx:93", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 client/src/components/McpForm.jsx:93"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-05946fde93a1ad61", "name": "Commented-code block (5 lines) in client/src/components/UsagePanel.jsx:6", "shortDescription": {"text": "Commented-code block (5 lines) in client/src/components/UsagePanel.jsx:6"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-7ce782065f73782b", "name": "Commented-code block (6 lines) in client/src/components/ChatInput.jsx:218", "shortDescription": {"text": "Commented-code block (6 lines) in client/src/components/ChatInput.jsx:218"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-1e7d9fd652358a8f", "name": "Commented-code block (5 lines) in client/src/components/AgentMonitorPanel.jsx:227", "shortDescription": {"text": "Commented-code block (5 lines) in client/src/components/AgentMonitorPanel.jsx:227"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-9a5958b2d13daccb", "name": "Commented-code block (7 lines) in client/src/components/TurnBubble.jsx:449", "shortDescription": {"text": "Commented-code block (7 lines) in client/src/components/TurnBubble.jsx:449"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-5a4cf1d5543b4f4c", "name": "Commented-code block (5 lines) in client/src/components/ModelBadge.jsx:70", "shortDescription": {"text": "Commented-code block (5 lines) in client/src/components/ModelBadge.jsx:70"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-b3fe30625fd14dfc", "name": "Commented-code block (5 lines) in client/src/components/tools/GrepGlobCard.jsx:4", "shortDescription": {"text": "Commented-code block (5 lines) in client/src/components/tools/GrepGlobCard.jsx:4"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-9a2ac1b9a59ac2a4", "name": "Commented-code block (6 lines) in client/src/hooks/useWebSocket.js:41", "shortDescription": {"text": "Commented-code block (6 lines) in client/src/hooks/useWebSocket.js:41"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-c4131bcf54f5ca0d", "name": "Commented-code block (5 lines) in scripts/check-node.cjs:4", "shortDescription": {"text": "Commented-code block (5 lines) in scripts/check-node.cjs:4"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-ca2c5414cc2c0d73", "name": "Commented-code block (5 lines) in server/index.js:48", "shortDescription": {"text": "Commented-code block (5 lines) in server/index.js:48"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-48aaa526dbc077f0", "name": "`fetch()` without try/.catch or AbortSignal \u2014 server/index.js:190", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 server/index.js:190"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-773bfa5d6e4348c3", "name": "Commented-code block (5 lines) in server/routes/settings.js:18", "shortDescription": {"text": "Commented-code block (5 lines) in server/routes/settings.js:18"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-2a5b74f4ef94c4ca", "name": "Commented-code block (5 lines) in server/routes/git.js:77", "shortDescription": {"text": "Commented-code block (5 lines) in server/routes/git.js:77"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-64e73e99dbb88010", "name": "Commented-code block (5 lines) in server/routes/memory.js:1", "shortDescription": {"text": "Commented-code block (5 lines) in server/routes/memory.js:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-7cd7d86589941bcd", "name": "Commented-code block (5 lines) in server/routes/mcp.js:200", "shortDescription": {"text": "Commented-code block (5 lines) in server/routes/mcp.js:200"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-0c7d80772434d781", "name": "Commented-code block (5 lines) in server/routes/chat.js:48", "shortDescription": {"text": "Commented-code block (5 lines) in server/routes/chat.js:48"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-43a72e12a9aa806f", "name": "Commented-code block (6 lines) in server/routes/prefs.js:7", "shortDescription": {"text": "Commented-code block (6 lines) in server/routes/prefs.js:7"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-67c56776508b60a4", "name": "Commented-code block (7 lines) in server/routes/subscription-usage.js:9", "shortDescription": {"text": "Commented-code block (7 lines) in server/routes/subscription-usage.js:9"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-c304aaf46ff5ea63", "name": "Commented-code block (5 lines) in server/routes/sessions.js:6", "shortDescription": {"text": "Commented-code block (5 lines) in server/routes/sessions.js:6"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-a381d99721357bf8", "name": "Commented-code block (6 lines) in server/routes/picker.js:62", "shortDescription": {"text": "Commented-code block (6 lines) in server/routes/picker.js:62"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-7a68edbb78f718e5", "name": "Commented-code block (5 lines) in server/routes/remote-control.js:66", "shortDescription": {"text": "Commented-code block (5 lines) in server/routes/remote-control.js:66"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-5e2a9a562c56ef7c", "name": "Commented-code block (6 lines) in server/routes/version-check.js:153", "shortDescription": {"text": "Commented-code block (6 lines) in server/routes/version-check.js:153"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-5c7eeb2ab14ef73c", "name": "`fetch()` without try/.catch or AbortSignal \u2014 server/routes/version-check.js:62", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 server/routes/version-check.js:62"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f45d73681cc8f4d5", "name": "Commented-code block (7 lines) in server/hooks/permission-bridge.js:29", "shortDescription": {"text": "Commented-code block (7 lines) in server/hooks/permission-bridge.js:29"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-365347f06c168f8f", "name": "Commented-code block (6 lines) in server/services/session-reader.js:145", "shortDescription": {"text": "Commented-code block (6 lines) in server/services/session-reader.js:145"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-d97952076cb96475", "name": "Commented-code block (5 lines) in server/services/usage-stats.js:8", "shortDescription": {"text": "Commented-code block (5 lines) in server/services/usage-stats.js:8"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-340f4bfb13f981d7", "name": "Commented-code block (5 lines) in server/services/file-watcher.js:16", "shortDescription": {"text": "Commented-code block (5 lines) in server/services/file-watcher.js:16"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-98179f1cc61d5a04", "name": "Commented-code block (7 lines) in server/services/anthropic-proxy.js:3", "shortDescription": {"text": "Commented-code block (7 lines) in server/services/anthropic-proxy.js:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-a7a6fb5518f8ea47", "name": "Commented-code block (6 lines) in server/services/openai-proxy.js:3", "shortDescription": {"text": "Commented-code block (6 lines) in server/services/openai-proxy.js:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-3adb3cd4bca85bd3", "name": "Commented-code block (7 lines) in server/services/model-resolver.js:58", "shortDescription": {"text": "Commented-code block (7 lines) in server/services/model-resolver.js:58"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-276fa3b80b2a9639", "name": "Dangling fetch: GET https://api.github.com/repos/wsxwj123/claude-gui/releases/latest (server/routes/version-check.js:62)", "shortDescription": {"text": "Dangling fetch: GET https://api.github.com/repos/wsxwj123/claude-gui/releases/latest (server/routes/version-check.js:62)"}, "fullDescription": {"text": "`server/routes/version-check.js:62` calls `GET https://api.github.com/repos/wsxwj123/claude-gui/releases/latest` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/https:/api.github.com/repos/wsxwj123/claude-gui/releases/latest`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-8d3c865686eb744e", "name": "Dangling fetch: GET https://registry.npmjs.org/@anthropic-ai/claude-code/latest (server/routes/version-check.js:145)", "shortDescription": {"text": "Dangling fetch: GET https://registry.npmjs.org/@anthropic-ai/claude-code/latest (server/routes/version-check.js:145)"}, "fullDescription": {"text": "`server/routes/version-check.js:145` calls `GET https://registry.npmjs.org/@anthropic-ai/claude-code/latest` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/https:/registry.npmjs.org/@anthropic-ai/claude-code/latest`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-dde3adb27bf7eebe", "name": "Unused endpoint: USE /api", "shortDescription": {"text": "Unused endpoint: USE /api"}, "fullDescription": {"text": "`server/index.js` declares `USE /api` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a9a63d0d8194babf", "name": "Unused endpoint: POST /api/network/password", "shortDescription": {"text": "Unused endpoint: POST /api/network/password"}, "fullDescription": {"text": "`server/index.js` declares `POST /api/network/password` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-eb341da4b070eaba", "name": "Unused endpoint: GET /{*splat}", "shortDescription": {"text": "Unused endpoint: GET /{*splat}"}, "fullDescription": {"text": "`server/index.js` declares `GET /{*splat}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ae6609eebd73dff8", "name": "Unused endpoint: GET /custom-providers", "shortDescription": {"text": "Unused endpoint: GET /custom-providers"}, "fullDescription": {"text": "`server/routes/settings.js` declares `GET /custom-providers` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ea5c834686342c67", "name": "Unused endpoint: POST /custom-providers", "shortDescription": {"text": "Unused endpoint: POST /custom-providers"}, "fullDescription": {"text": "`server/routes/settings.js` declares `POST /custom-providers` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a6094b1bb86432fc", "name": "Unused endpoint: PUT /custom-providers/:id", "shortDescription": {"text": "Unused endpoint: PUT /custom-providers/:id"}, "fullDescription": {"text": "`server/routes/settings.js` declares `PUT /custom-providers/:id` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5e5597f4325f3368", "name": "Unused endpoint: GET /provider-models", "shortDescription": {"text": "Unused endpoint: GET /provider-models"}, "fullDescription": {"text": "`server/routes/settings.js` declares `GET /provider-models` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7df0c17d0ab96f68", "name": "Unused endpoint: POST /system/permission-guide-reset", "shortDescription": {"text": "Unused endpoint: POST /system/permission-guide-reset"}, "fullDescription": {"text": "`server/routes/permission-check.js` declares `POST /system/permission-guide-reset` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-96702eb8f5445baa", "name": "Unused endpoint: PUT /mcp/:name/enable", "shortDescription": {"text": "Unused endpoint: PUT /mcp/:name/enable"}, "fullDescription": {"text": "`server/routes/mcp.js` declares `PUT /mcp/:name/enable` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6e2b7a927d937438", "name": "Unused endpoint: PUT /mcp/:name/disable", "shortDescription": {"text": "Unused endpoint: PUT /mcp/:name/disable"}, "fullDescription": {"text": "`server/routes/mcp.js` declares `PUT /mcp/:name/disable` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-845f1c9a250f1e12", "name": "Unused endpoint: PUT /mcp/:name/autoapprove", "shortDescription": {"text": "Unused endpoint: PUT /mcp/:name/autoapprove"}, "fullDescription": {"text": "`server/routes/mcp.js` declares `PUT /mcp/:name/autoapprove` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-81f9519a9923fd0b", "name": "Unused endpoint: PUT /plugins/:name/enable", "shortDescription": {"text": "Unused endpoint: PUT /plugins/:name/enable"}, "fullDescription": {"text": "`server/routes/mcp.js` declares `PUT /plugins/:name/enable` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3a6ea51d99662ba9", "name": "Unused endpoint: PUT /plugins/:name/disable", "shortDescription": {"text": "Unused endpoint: PUT /plugins/:name/disable"}, "fullDescription": {"text": "`server/routes/mcp.js` declares `PUT /plugins/:name/disable` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c21347d7cc8b0c8f", "name": "Unused endpoint: POST /permissions/request", "shortDescription": {"text": "Unused endpoint: POST /permissions/request"}, "fullDescription": {"text": "`server/routes/permissions.js` declares `POST /permissions/request` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-52ad904ee2a2d4d1", "name": "Unused endpoint: GET /sessions/:sessionId/file-changes", "shortDescription": {"text": "Unused endpoint: GET /sessions/:sessionId/file-changes"}, "fullDescription": {"text": "`server/routes/file-changes.js` declares `GET /sessions/:sessionId/file-changes` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1a85bbaf090b1118", "name": "Unused endpoint: GET /sessions/:sessionId", "shortDescription": {"text": "Unused endpoint: GET /sessions/:sessionId"}, "fullDescription": {"text": "`server/routes/sessions.js` declares `GET /sessions/:sessionId` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9d237b3301a6efe3", "name": "Unused endpoint: GET /recent-session", "shortDescription": {"text": "Unused endpoint: GET /recent-session"}, "fullDescription": {"text": "`server/routes/sessions.js` declares `GET /recent-session` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a41ef8df3bc25d4c", "name": "Unused endpoint: GET /active-sessions", "shortDescription": {"text": "Unused endpoint: GET /active-sessions"}, "fullDescription": {"text": "`server/routes/sessions.js` declares `GET /active-sessions` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/22886"}, "properties": {"repository": "wsxwj123/claude-gui", "repoUrl": "https://github.com/wsxwj123/claude-gui", "branch": "main"}, "results": [{"ruleId": "scanner-0c66dcb5f56a69ed", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 client/src/App.jsx:192"}, "properties": {"repobilityId": "9776a8ddec81adf3", "scanner": "scanner-primary", "fingerprint": "0c66dcb5f56a69ed", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-847386fa40ea9048", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 client/src/App.jsx:2800"}, "properties": {"repobilityId": "d5833873736093f0", "scanner": "scanner-primary", "fingerprint": "847386fa40ea9048", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-f2b9cedbeb7e0505", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 client/src/components/ProcessPanel.jsx:96"}, "properties": {"repobilityId": "4847e5a9e25f5a3c", "scanner": "scanner-primary", "fingerprint": "f2b9cedbeb7e0505", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-29d3265a839fcd06", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 client/src/components/FileExplorerPanel.jsx:193"}, "properties": {"repobilityId": "5b8b4a8a945b53ed", "scanner": "scanner-primary", "fingerprint": "29d3265a839fcd06", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-db71384d323e9aa4", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 client/src/components/FileChangesPanel.jsx:115"}, "properties": {"repobilityId": "3bff49c51d24d4ba", "scanner": "scanner-primary", "fingerprint": "db71384d323e9aa4", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-e68309f08fe142d6", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 client/src/components/PermissionPrompt.jsx:362"}, "properties": {"repobilityId": "4b1d0907c8b7715b", "scanner": "scanner-primary", "fingerprint": "e68309f08fe142d6", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-aa62ce5b8e20ce10", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 client/src/components/AgentsPanel.jsx:98"}, "properties": {"repobilityId": "837e8fa29537ad3f", "scanner": "scanner-primary", "fingerprint": "aa62ce5b8e20ce10", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-f5912d52746cb406", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 client/src/components/SubagentView.jsx:55"}, "properties": {"repobilityId": "f6e745904bf25145", "scanner": "scanner-primary", "fingerprint": "f5912d52746cb406", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-55eaaa9d635be1f8", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 client/src/components/MCPPanel.jsx:256"}, "properties": {"repobilityId": "3dd5864b476a6f1c", "scanner": "scanner-primary", "fingerprint": "55eaaa9d635be1f8", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-202be477f1765614", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 client/src/components/MessageBubble.jsx:339"}, "properties": {"repobilityId": "87818c4c8fc1d212", "scanner": "scanner-primary", "fingerprint": "202be477f1765614", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-48c49ebad4967342", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 client/src/components/ChatInput.jsx:590"}, "properties": {"repobilityId": "302d2d486ed43dd2", "scanner": "scanner-primary", "fingerprint": "48c49ebad4967342", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-9e9af8ac9c06ee7e", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 client/src/components/ToolCallCard.jsx:79"}, "properties": {"repobilityId": "1065e22335e437a7", "scanner": "scanner-primary", "fingerprint": "9e9af8ac9c06ee7e", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-0220d2cbc9c5d3fc", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 client/src/components/ArtifactPreview.jsx:82"}, "properties": {"repobilityId": "980ab607217f42c3", "scanner": "scanner-primary", "fingerprint": "0220d2cbc9c5d3fc", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-530e23d05ca422ab", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 client/src/components/AgentMonitorPanel.jsx:24"}, "properties": {"repobilityId": "642c31f65cf6eeff", "scanner": "scanner-primary", "fingerprint": "530e23d05ca422ab", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-d9677ad290f03c0b", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 client/src/components/TurnBubble.jsx:204"}, "properties": {"repobilityId": "84a51a6cfc91843b", "scanner": "scanner-primary", "fingerprint": "d9677ad290f03c0b", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-7457899861013618", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 client/src/components/SettingsPanel.jsx:336"}, "properties": {"repobilityId": "cd9891d729880039", "scanner": "scanner-primary", "fingerprint": "7457899861013618", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-a01839c019c894ff", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 client/src/components/ModelBadge.jsx:162"}, "properties": {"repobilityId": "3d8f069d627c0431", "scanner": "scanner-primary", "fingerprint": "a01839c019c894ff", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-efcd78cd778072eb", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 client/src/components/tools/EditDiffCard.jsx:57"}, "properties": {"repobilityId": "30c8a3b45fc0fc95", "scanner": "scanner-primary", "fingerprint": "efcd78cd778072eb", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-083c070252d7c81f", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 client/src/components/tools/GrepGlobCard.jsx:34"}, "properties": {"repobilityId": "c5d403d7037789a9", "scanner": "scanner-primary", "fingerprint": "083c070252d7c81f", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-2069c71704c9847c", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 client/src/components/tools/TaskCard.jsx:77"}, "properties": {"repobilityId": "d6942235dd818a2e", "scanner": "scanner-primary", "fingerprint": "2069c71704c9847c", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-85bd0313b99958cb", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 client/src/components/tools/BashCard.jsx:25"}, "properties": {"repobilityId": "bb79b0965be13671", "scanner": "scanner-primary", "fingerprint": "85bd0313b99958cb", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-16e32f4073b09103", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 client/src/components/tools/SkillCard.jsx:30"}, "properties": {"repobilityId": "1b8757f2ce8247e7", "scanner": "scanner-primary", "fingerprint": "16e32f4073b09103", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-a0da838f97d21846", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 client/src/components/tools/ReadCard.jsx:38"}, "properties": {"repobilityId": "268839bc8817113f", "scanner": "scanner-primary", "fingerprint": "a0da838f97d21846", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-ba4502cda0955171", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 client/src/hooks/useWebSocket.js:76"}, "properties": {"repobilityId": "a9c8d229fa6775dc", "scanner": "scanner-primary", "fingerprint": "ba4502cda0955171", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-07601ef64e31ba49", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 server/index.js:93"}, "properties": {"repobilityId": "21e6b3de2b3dd856", "scanner": "scanner-primary", "fingerprint": "07601ef64e31ba49", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-c6cf50ea80b7b673", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 server/routes/chat.js:374"}, "properties": {"repobilityId": "682c294236f069cd", "scanner": "scanner-primary", "fingerprint": "c6cf50ea80b7b673", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-ed4d467279a8ae31", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in client/src/components/ArtifactPreview.jsx:82"}, "properties": {"repobilityId": "8d83b5e913926184", "scanner": "scanner-primary", "fingerprint": "ed4d467279a8ae31", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "client/src/components/ArtifactPreview.jsx"}, "region": {"startLine": 82}}}]}, {"ruleId": "scanner-9dff8f023db6d18b", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in scripts/public-build.cjs:2"}, "properties": {"repobilityId": "f3ea012ee9ca1835", "scanner": "scanner-primary", "fingerprint": "9dff8f023db6d18b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/public-build.cjs"}, "region": {"startLine": 2}}}]}, {"ruleId": "scanner-e5e168600d6108af", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in scripts/check-http-smoke.cjs:3"}, "properties": {"repobilityId": "4c4f564d72b3398b", "scanner": "scanner-primary", "fingerprint": "e5e168600d6108af", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/check-http-smoke.cjs"}, "region": {"startLine": 3}}}]}, {"ruleId": "scanner-99dac509ccba2dca", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in scripts/audit-public.cjs:2"}, "properties": {"repobilityId": "e349145aff59a7cf", "scanner": "scanner-primary", "fingerprint": "99dac509ccba2dca", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/audit-public.cjs"}, "region": {"startLine": 2}}}]}, {"ruleId": "scanner-8fc1478588cd083f", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in server/index.js:3"}, "properties": {"repobilityId": "52d97e67169cf06a", "scanner": "scanner-primary", "fingerprint": "8fc1478588cd083f", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/index.js"}, "region": {"startLine": 3}}}]}, {"ruleId": "scanner-84916f7e666fbc0f", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in server/routes/settings.js:4"}, "properties": {"repobilityId": "8c105faf26bfd4fa", "scanner": "scanner-primary", "fingerprint": "84916f7e666fbc0f", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/routes/settings.js"}, "region": {"startLine": 4}}}]}, {"ruleId": "scanner-992686f316a17f84", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in server/routes/permission-check.js:6"}, "properties": {"repobilityId": "31e100db626c959e", "scanner": "scanner-primary", "fingerprint": "992686f316a17f84", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/routes/permission-check.js"}, "region": {"startLine": 6}}}]}, {"ruleId": "scanner-7f79dc311f05a282", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in server/routes/cli-check.js:2"}, "properties": {"repobilityId": "e2ce3b3602367251", "scanner": "scanner-primary", "fingerprint": "7f79dc311f05a282", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/routes/cli-check.js"}, "region": {"startLine": 2}}}]}, {"ruleId": "scanner-909222ff87598138", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in server/routes/processes.js:5"}, "properties": {"repobilityId": "5ed3eaeecab71112", "scanner": "scanner-primary", "fingerprint": "909222ff87598138", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/routes/processes.js"}, "region": {"startLine": 5}}}]}, {"ruleId": "scanner-39b174a5fbdc403b", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in server/routes/git.js:2"}, "properties": {"repobilityId": "d5a81de56d906dbe", "scanner": "scanner-primary", "fingerprint": "39b174a5fbdc403b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/routes/git.js"}, "region": {"startLine": 2}}}]}, {"ruleId": "scanner-8184d77850647dc5", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in server/routes/mcp.js:5"}, "properties": {"repobilityId": "18ed9b8d1f6acd2e", "scanner": "scanner-primary", "fingerprint": "8184d77850647dc5", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/routes/mcp.js"}, "region": {"startLine": 5}}}]}, {"ruleId": "scanner-13f63c1523b7daa5", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in server/routes/checkpoints.js:2"}, "properties": {"repobilityId": "14d3aa3772403e1f", "scanner": "scanner-primary", "fingerprint": "13f63c1523b7daa5", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/routes/checkpoints.js"}, "region": {"startLine": 2}}}]}, {"ruleId": "scanner-981b0ee6e01c3b07", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in server/routes/file-changes.js:3"}, "properties": {"repobilityId": "86d545ffec608e66", "scanner": "scanner-primary", "fingerprint": "981b0ee6e01c3b07", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/routes/file-changes.js"}, "region": {"startLine": 3}}}]}, {"ruleId": "scanner-ab1bc7d470c40e0b", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in server/routes/chat.js:2"}, "properties": {"repobilityId": "818dc92bb0af275f", "scanner": "scanner-primary", "fingerprint": "ab1bc7d470c40e0b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/routes/chat.js"}, "region": {"startLine": 2}}}]}, {"ruleId": "scanner-50cff4375a995f5e", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in server/routes/worktree.js:2"}, "properties": {"repobilityId": "ec6be5d1de60bbdb", "scanner": "scanner-primary", "fingerprint": "50cff4375a995f5e", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/routes/worktree.js"}, "region": {"startLine": 2}}}]}, {"ruleId": "scanner-a440a53731461331", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in server/routes/files.js:6"}, "properties": {"repobilityId": "1b8a790d8640e82f", "scanner": "scanner-primary", "fingerprint": "a440a53731461331", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/routes/files.js"}, "region": {"startLine": 6}}}]}, {"ruleId": "scanner-65b21bf3cd7c94bc", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in server/routes/open-url.js:2"}, "properties": {"repobilityId": "247dca80a617352c", "scanner": "scanner-primary", "fingerprint": "65b21bf3cd7c94bc", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/routes/open-url.js"}, "region": {"startLine": 2}}}]}, {"ruleId": "scanner-934100170b88343b", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in server/routes/download-update.js:2"}, "properties": {"repobilityId": "13a86210a8b67936", "scanner": "scanner-primary", "fingerprint": "934100170b88343b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/routes/download-update.js"}, "region": {"startLine": 2}}}]}, {"ruleId": "scanner-a674ba3721217198", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in server/routes/picker.js:2"}, "properties": {"repobilityId": "ed60f92da7f0735f", "scanner": "scanner-primary", "fingerprint": "a674ba3721217198", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/routes/picker.js"}, "region": {"startLine": 2}}}]}, {"ruleId": "scanner-e7f111c9ee402ead", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in server/routes/agents.js:2"}, "properties": {"repobilityId": "b128b8096f532e20", "scanner": "scanner-primary", "fingerprint": "e7f111c9ee402ead", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/routes/agents.js"}, "region": {"startLine": 2}}}]}, {"ruleId": "scanner-50df6a979329fe13", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in server/routes/version-check.js:6"}, "properties": {"repobilityId": "52cfc8fa7aa02b89", "scanner": "scanner-primary", "fingerprint": "50df6a979329fe13", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/routes/version-check.js"}, "region": {"startLine": 6}}}]}, {"ruleId": "scanner-a4abc77d530f3389", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "a8d2ceb02066e141", "scanner": "scanner-primary", "fingerprint": "a4abc77d530f3389", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/tauri.yml"}, "region": {"startLine": 29}}}]}, {"ruleId": "scanner-a4abc77d530f3389", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "82e5f9438726ab85", "scanner": "scanner-primary", "fingerprint": "a4abc77d530f3389", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/tauri.yml"}, "region": {"startLine": 34}}}]}, {"ruleId": "scanner-a4abc77d530f3389", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "9b25474bf83c9796", "scanner": "scanner-primary", "fingerprint": "a4abc77d530f3389", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/tauri.yml"}, "region": {"startLine": 37}}}]}, {"ruleId": "scanner-a4abc77d530f3389", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "20922e40a4bffbe0", "scanner": "scanner-primary", "fingerprint": "a4abc77d530f3389", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/tauri.yml"}, "region": {"startLine": 53}}}]}, {"ruleId": "scanner-a4abc77d530f3389", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "8a59a00bee4d360b", "scanner": "scanner-primary", "fingerprint": "a4abc77d530f3389", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/tauri.yml"}, "region": {"startLine": 81}}}]}, {"ruleId": "scanner-a4abc77d530f3389", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "ad8209417bdca01c", "scanner": "scanner-primary", "fingerprint": "a4abc77d530f3389", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/tauri.yml"}, "region": {"startLine": 100}}}]}, {"ruleId": "scanner-af4aff5245cfedf4", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "c016503fae5933af", "scanner": "scanner-primary", "fingerprint": "af4aff5245cfedf4", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/tauri.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-cb639d9a10a47b23", "level": "note", "message": {"text": "package.json defines install-time lifecycle scripts"}, "properties": {"repobilityId": "edeab51902066991", "scanner": "scanner-primary", "fingerprint": "cb639d9a10a47b23", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "npm", "install-scripts"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ad18c8209a57165b", "level": "note", "message": {"text": "Very large file: client/src/App.jsx (6380 lines)"}, "properties": {"repobilityId": "10afb8a31b6378eb", "scanner": "scanner-primary", "fingerprint": "ad18c8209a57165b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-2ca2765983e4f0cd", "level": "note", "message": {"text": "Very large file: server/routes/settings.js (1096 lines)"}, "properties": {"repobilityId": "27dec8187faa84c9", "scanner": "scanner-primary", "fingerprint": "2ca2765983e4f0cd", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-6893a6c8b0861585", "level": "warning", "message": {"text": "Very low test-to-source ratio"}, "properties": {"repobilityId": "54a7de3f06314bf0", "scanner": "scanner-primary", "fingerprint": "6893a6c8b0861585", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["tests", "coverage"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "7461f784a07efabf", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "46521cf27ebc848a", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-9d79c4077342a7d0", "level": "warning", "message": {"text": "Runtime service client appears to use placeholder configuration"}, "properties": {"repobilityId": "4f17a08ff470b0ce", "scanner": "scanner-primary", "fingerprint": "9d79c4077342a7d0", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "runtime-config", "service-client", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "d3d43865c07f166a", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-11825279136b53a3", "level": "warning", "message": {"text": "CI is configured but no tests are detected"}, "properties": {"repobilityId": "41ba014174bbfed5", "scanner": "scanner-primary", "fingerprint": "11825279136b53a3", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["tests", "ci", "config-theater", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "e0aec89c6add7020", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "666a96989815c6c3", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-74a75763cfe39c64", "level": "none", "message": {"text": "Commented-code block (6 lines) in client/src/App.jsx:369"}, "properties": {"repobilityId": "399ea587f11162fd", "scanner": "scanner-primary", "fingerprint": "74a75763cfe39c64", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-1bb80aeca8167d71", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 client/src/App.jsx:2298"}, "properties": {"repobilityId": "de0b18a5650eb568", "scanner": "scanner-primary", "fingerprint": "1bb80aeca8167d71", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-4cdc2a451d2b3529", "level": "none", "message": {"text": "Commented-code block (6 lines) in client/src/stores/sessionStore.js:148"}, "properties": {"repobilityId": "60153eb96b076a20", "scanner": "scanner-primary", "fingerprint": "4cdc2a451d2b3529", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-eedfecfefa7f325c", "level": "none", "message": {"text": "Commented-code block (7 lines) in client/src/utils/pricing.js:131"}, "properties": {"repobilityId": "f05a4e31ef2723e4", "scanner": "scanner-primary", "fingerprint": "eedfecfefa7f325c", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-e4afac0359136517", "level": "none", "message": {"text": "Commented-code block (6 lines) in client/src/utils/clipboard.js:3"}, "properties": {"repobilityId": "3f1f359706f33a03", "scanner": "scanner-primary", "fingerprint": "e4afac0359136517", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-84dd297d03017ac8", "level": "none", "message": {"text": "Commented-code block (6 lines) in client/src/components/FileExplorerPanel.jsx:408"}, "properties": {"repobilityId": "82088fc300db79ad", "scanner": "scanner-primary", "fingerprint": "84dd297d03017ac8", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-e49cd530746c6cb0", "level": "none", "message": {"text": "Commented-code block (8 lines) in client/src/components/PermissionPrompt.jsx:59"}, "properties": {"repobilityId": "151472161eef3cfb", "scanner": "scanner-primary", "fingerprint": "e49cd530746c6cb0", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-101f38bffc2ee034", "level": "none", "message": {"text": "Commented-code block (5 lines) in client/src/components/MessageBubble.jsx:93"}, "properties": {"repobilityId": "e22ff66f480a18e9", "scanner": "scanner-primary", "fingerprint": "101f38bffc2ee034", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-d619ee1759739c00", "level": "none", "message": {"text": "Commented-code block (5 lines) in client/src/components/McpForm.jsx:4"}, "properties": {"repobilityId": "431927018aec49c6", "scanner": "scanner-primary", "fingerprint": "d619ee1759739c00", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-244062b8d33895b4", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 client/src/components/McpForm.jsx:93"}, "properties": {"repobilityId": "cf2131baaee50f76", "scanner": "scanner-primary", "fingerprint": "244062b8d33895b4", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-05946fde93a1ad61", "level": "none", "message": {"text": "Commented-code block (5 lines) in client/src/components/UsagePanel.jsx:6"}, "properties": {"repobilityId": "28aee513a815432b", "scanner": "scanner-primary", "fingerprint": "05946fde93a1ad61", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-7ce782065f73782b", "level": "none", "message": {"text": "Commented-code block (6 lines) in client/src/components/ChatInput.jsx:218"}, "properties": {"repobilityId": "8ad4b4fceb722b34", "scanner": "scanner-primary", "fingerprint": "7ce782065f73782b", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-1e7d9fd652358a8f", "level": "none", "message": {"text": "Commented-code block (5 lines) in client/src/components/AgentMonitorPanel.jsx:227"}, "properties": {"repobilityId": "9d5eb7480dce7d30", "scanner": "scanner-primary", "fingerprint": "1e7d9fd652358a8f", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-9a5958b2d13daccb", "level": "none", "message": {"text": "Commented-code block (7 lines) in client/src/components/TurnBubble.jsx:449"}, "properties": {"repobilityId": "0642342fc45ee0f1", "scanner": "scanner-primary", "fingerprint": "9a5958b2d13daccb", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-5a4cf1d5543b4f4c", "level": "none", "message": {"text": "Commented-code block (5 lines) in client/src/components/ModelBadge.jsx:70"}, "properties": {"repobilityId": "4e5e4e91f7c668fa", "scanner": "scanner-primary", "fingerprint": "5a4cf1d5543b4f4c", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-b3fe30625fd14dfc", "level": "none", "message": {"text": "Commented-code block (5 lines) in client/src/components/tools/GrepGlobCard.jsx:4"}, "properties": {"repobilityId": "51ecd8cd64650de8", "scanner": "scanner-primary", "fingerprint": "b3fe30625fd14dfc", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-9a2ac1b9a59ac2a4", "level": "none", "message": {"text": "Commented-code block (6 lines) in client/src/hooks/useWebSocket.js:41"}, "properties": {"repobilityId": "c48ac3e067bd7a96", "scanner": "scanner-primary", "fingerprint": "9a2ac1b9a59ac2a4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-c4131bcf54f5ca0d", "level": "none", "message": {"text": "Commented-code block (5 lines) in scripts/check-node.cjs:4"}, "properties": {"repobilityId": "fc165a52af6f1974", "scanner": "scanner-primary", "fingerprint": "c4131bcf54f5ca0d", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-ca2c5414cc2c0d73", "level": "none", "message": {"text": "Commented-code block (5 lines) in server/index.js:48"}, "properties": {"repobilityId": "84287f73f31efd0b", "scanner": "scanner-primary", "fingerprint": "ca2c5414cc2c0d73", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-48aaa526dbc077f0", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 server/index.js:190"}, "properties": {"repobilityId": "51cabbede0556457", "scanner": "scanner-primary", "fingerprint": "48aaa526dbc077f0", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-773bfa5d6e4348c3", "level": "none", "message": {"text": "Commented-code block (5 lines) in server/routes/settings.js:18"}, "properties": {"repobilityId": "e45126c81e9bdb7c", "scanner": "scanner-primary", "fingerprint": "773bfa5d6e4348c3", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-2a5b74f4ef94c4ca", "level": "none", "message": {"text": "Commented-code block (5 lines) in server/routes/git.js:77"}, "properties": {"repobilityId": "cdaf203e5af37b6d", "scanner": "scanner-primary", "fingerprint": "2a5b74f4ef94c4ca", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-64e73e99dbb88010", "level": "none", "message": {"text": "Commented-code block (5 lines) in server/routes/memory.js:1"}, "properties": {"repobilityId": "9d47c5bc7c3294f3", "scanner": "scanner-primary", "fingerprint": "64e73e99dbb88010", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-7cd7d86589941bcd", "level": "none", "message": {"text": "Commented-code block (5 lines) in server/routes/mcp.js:200"}, "properties": {"repobilityId": "91eac77cce8ab7ca", "scanner": "scanner-primary", "fingerprint": "7cd7d86589941bcd", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-0c7d80772434d781", "level": "none", "message": {"text": "Commented-code block (5 lines) in server/routes/chat.js:48"}, "properties": {"repobilityId": "9c38c94bde6fd275", "scanner": "scanner-primary", "fingerprint": "0c7d80772434d781", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-43a72e12a9aa806f", "level": "none", "message": {"text": "Commented-code block (6 lines) in server/routes/prefs.js:7"}, "properties": {"repobilityId": "999978a552700d79", "scanner": "scanner-primary", "fingerprint": "43a72e12a9aa806f", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-67c56776508b60a4", "level": "none", "message": {"text": "Commented-code block (7 lines) in server/routes/subscription-usage.js:9"}, "properties": {"repobilityId": "b4dfdebbe18e6751", "scanner": "scanner-primary", "fingerprint": "67c56776508b60a4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-c304aaf46ff5ea63", "level": "none", "message": {"text": "Commented-code block (5 lines) in server/routes/sessions.js:6"}, "properties": {"repobilityId": "c5d136bbdbe521b5", "scanner": "scanner-primary", "fingerprint": "c304aaf46ff5ea63", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-a381d99721357bf8", "level": "none", "message": {"text": "Commented-code block (6 lines) in server/routes/picker.js:62"}, "properties": {"repobilityId": "79e7571120a793d4", "scanner": "scanner-primary", "fingerprint": "a381d99721357bf8", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-7a68edbb78f718e5", "level": "none", "message": {"text": "Commented-code block (5 lines) in server/routes/remote-control.js:66"}, "properties": {"repobilityId": "df6b3c7dd66204cd", "scanner": "scanner-primary", "fingerprint": "7a68edbb78f718e5", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-5e2a9a562c56ef7c", "level": "none", "message": {"text": "Commented-code block (6 lines) in server/routes/version-check.js:153"}, "properties": {"repobilityId": "0aff2dcc98b0a68d", "scanner": "scanner-primary", "fingerprint": "5e2a9a562c56ef7c", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-5c7eeb2ab14ef73c", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 server/routes/version-check.js:62"}, "properties": {"repobilityId": "f1ef9de2dff46c83", "scanner": "scanner-primary", "fingerprint": "5c7eeb2ab14ef73c", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-f45d73681cc8f4d5", "level": "none", "message": {"text": "Commented-code block (7 lines) in server/hooks/permission-bridge.js:29"}, "properties": {"repobilityId": "a5401018ac691593", "scanner": "scanner-primary", "fingerprint": "f45d73681cc8f4d5", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-365347f06c168f8f", "level": "none", "message": {"text": "Commented-code block (6 lines) in server/services/session-reader.js:145"}, "properties": {"repobilityId": "99e9ac34c0a59692", "scanner": "scanner-primary", "fingerprint": "365347f06c168f8f", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-d97952076cb96475", "level": "none", "message": {"text": "Commented-code block (5 lines) in server/services/usage-stats.js:8"}, "properties": {"repobilityId": "6b761cbea4a66c79", "scanner": "scanner-primary", "fingerprint": "d97952076cb96475", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-340f4bfb13f981d7", "level": "none", "message": {"text": "Commented-code block (5 lines) in server/services/file-watcher.js:16"}, "properties": {"repobilityId": "fc2e7dd71e09cf57", "scanner": "scanner-primary", "fingerprint": "340f4bfb13f981d7", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-98179f1cc61d5a04", "level": "none", "message": {"text": "Commented-code block (7 lines) in server/services/anthropic-proxy.js:3"}, "properties": {"repobilityId": "5d694874fc2ab6ff", "scanner": "scanner-primary", "fingerprint": "98179f1cc61d5a04", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-a7a6fb5518f8ea47", "level": "none", "message": {"text": "Commented-code block (6 lines) in server/services/openai-proxy.js:3"}, "properties": {"repobilityId": "e991b77c7e9e4168", "scanner": "scanner-primary", "fingerprint": "a7a6fb5518f8ea47", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-3adb3cd4bca85bd3", "level": "none", "message": {"text": "Commented-code block (7 lines) in server/services/model-resolver.js:58"}, "properties": {"repobilityId": "11c1cae76b2b7be6", "scanner": "scanner-primary", "fingerprint": "3adb3cd4bca85bd3", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-276fa3b80b2a9639", "level": "error", "message": {"text": "Dangling fetch: GET https://api.github.com/repos/wsxwj123/claude-gui/releases/latest (server/routes/version-check.js:62)"}, "properties": {"repobilityId": "d5b00334c17b4350", "scanner": "scanner-primary", "fingerprint": "276fa3b80b2a9639", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-8d3c865686eb744e", "level": "error", "message": {"text": "Dangling fetch: GET https://registry.npmjs.org/@anthropic-ai/claude-code/latest (server/routes/version-check.js:145)"}, "properties": {"repobilityId": "7f27697c1b548e08", "scanner": "scanner-primary", "fingerprint": "8d3c865686eb744e", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-dde3adb27bf7eebe", "level": "note", "message": {"text": "Unused endpoint: USE /api"}, "properties": {"repobilityId": "8428537b70eeca77", "scanner": "scanner-primary", "fingerprint": "dde3adb27bf7eebe", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-a9a63d0d8194babf", "level": "note", "message": {"text": "Unused endpoint: POST /api/network/password"}, "properties": {"repobilityId": "b47b89cdd1253b1a", "scanner": "scanner-primary", "fingerprint": "a9a63d0d8194babf", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-eb341da4b070eaba", "level": "note", "message": {"text": "Unused endpoint: GET /{*splat}"}, "properties": {"repobilityId": "2d11ccaf722e67cd", "scanner": "scanner-primary", "fingerprint": "eb341da4b070eaba", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-ae6609eebd73dff8", "level": "note", "message": {"text": "Unused endpoint: GET /custom-providers"}, "properties": {"repobilityId": "079b09f627b95aea", "scanner": "scanner-primary", "fingerprint": "ae6609eebd73dff8", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-ea5c834686342c67", "level": "note", "message": {"text": "Unused endpoint: POST /custom-providers"}, "properties": {"repobilityId": "33bb25545dc029fa", "scanner": "scanner-primary", "fingerprint": "ea5c834686342c67", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-a6094b1bb86432fc", "level": "note", "message": {"text": "Unused endpoint: PUT /custom-providers/:id"}, "properties": {"repobilityId": "508c9222d6e2a47e", "scanner": "scanner-primary", "fingerprint": "a6094b1bb86432fc", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5e5597f4325f3368", "level": "note", "message": {"text": "Unused endpoint: GET /provider-models"}, "properties": {"repobilityId": "6376938a398371ae", "scanner": "scanner-primary", "fingerprint": "5e5597f4325f3368", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-7df0c17d0ab96f68", "level": "note", "message": {"text": "Unused endpoint: POST /system/permission-guide-reset"}, "properties": {"repobilityId": "143ee7a65e291875", "scanner": "scanner-primary", "fingerprint": "7df0c17d0ab96f68", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-96702eb8f5445baa", "level": "note", "message": {"text": "Unused endpoint: PUT /mcp/:name/enable"}, "properties": {"repobilityId": "e27c34672ba5e775", "scanner": "scanner-primary", "fingerprint": "96702eb8f5445baa", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-6e2b7a927d937438", "level": "note", "message": {"text": "Unused endpoint: PUT /mcp/:name/disable"}, "properties": {"repobilityId": "21269c4ef1ae76ce", "scanner": "scanner-primary", "fingerprint": "6e2b7a927d937438", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-845f1c9a250f1e12", "level": "note", "message": {"text": "Unused endpoint: PUT /mcp/:name/autoapprove"}, "properties": {"repobilityId": "6fabc9ca30512c2f", "scanner": "scanner-primary", "fingerprint": "845f1c9a250f1e12", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-81f9519a9923fd0b", "level": "note", "message": {"text": "Unused endpoint: PUT /plugins/:name/enable"}, "properties": {"repobilityId": "d6b7b9dec7824fa6", "scanner": "scanner-primary", "fingerprint": "81f9519a9923fd0b", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-3a6ea51d99662ba9", "level": "note", "message": {"text": "Unused endpoint: PUT /plugins/:name/disable"}, "properties": {"repobilityId": "3aba73f129673061", "scanner": "scanner-primary", "fingerprint": "3a6ea51d99662ba9", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c21347d7cc8b0c8f", "level": "note", "message": {"text": "Unused endpoint: POST /permissions/request"}, "properties": {"repobilityId": "b05c9e3e51608895", "scanner": "scanner-primary", "fingerprint": "c21347d7cc8b0c8f", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-52ad904ee2a2d4d1", "level": "note", "message": {"text": "Unused endpoint: GET /sessions/:sessionId/file-changes"}, "properties": {"repobilityId": "d05e7d5be49b3f9a", "scanner": "scanner-primary", "fingerprint": "52ad904ee2a2d4d1", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-1a85bbaf090b1118", "level": "note", "message": {"text": "Unused endpoint: GET /sessions/:sessionId"}, "properties": {"repobilityId": "d51310b543e443b2", "scanner": "scanner-primary", "fingerprint": "1a85bbaf090b1118", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-9d237b3301a6efe3", "level": "note", "message": {"text": "Unused endpoint: GET /recent-session"}, "properties": {"repobilityId": "2924911b513b186b", "scanner": "scanner-primary", "fingerprint": "9d237b3301a6efe3", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-a41ef8df3bc25d4c", "level": "note", "message": {"text": "Unused endpoint: GET /active-sessions"}, "properties": {"repobilityId": "c7e307b8967560a0", "scanner": "scanner-primary", "fingerprint": "a41ef8df3bc25d4c", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}]}]}