{"schema_version":"2","scorer_version":"0.1.0","scoring_version":"prov-4+qual-2+sec-2","generated_at":"2026-11-14T00:01:32.829949Z","repo":{"ref":{"host":"github.com","owner":"amontlabs","name":"lcu"},"default_branch":"main","clone_url":"https://github.com/amontlabs/lcu.git","html_url":"https://github.com/amontlabs/lcu","description":"Codex computer use, decoupled from the app, for usage inside any harness.","stars":2422,"forks":165,"is_fork":false,"is_archived":false,"is_private":false,"size_kb":13469,"primary_language":"JavaScript","license_spdx":"MIT","created_at":"2026-09-22T15:08:18Z","pushed_at":"2026-11-12T12:09:05Z","security_policy_url":null,"distribution":{"owner_created_at":"2026-10-03T14:16:32Z","owner_type":"Organization","release_assets":[{"name":"lcu-0.13.6-darwin-arm64.tar.gz","size":5967501,"download_count":207,"release_tag":"v0.13.6","url":"https://github.com/amontlabs/lcu/releases/download/v0.13.6/lcu-0.13.6-darwin-arm64.tar.gz"},{"name":"lcu-0.13.6-darwin-arm64.tar.gz.sha256","size":97,"download_count":192,"release_tag":"v0.13.6","url":"https://github.com/amontlabs/lcu/releases/download/v0.13.6/lcu-0.13.6-darwin-arm64.tar.gz.sha256"},{"name":"lcu-0.13.6-linux-arm64.tar.gz","size":5944517,"download_count":4,"release_tag":"v0.13.6","url":"https://github.com/amontlabs/lcu/releases/download/v0.13.6/lcu-0.13.6-linux-arm64.tar.gz"},{"name":"lcu-0.13.6-linux-arm64.tar.gz.sha256","size":96,"download_count":3,"release_tag":"v0.13.6","url":"https://github.com/amontlabs/lcu/releases/download/v0.13.6/lcu-0.13.6-linux-arm64.tar.gz.sha256"},{"name":"lcu-0.13.6-linux-x64.tar.gz","size":5942601,"download_count":10,"release_tag":"v0.13.6","url":"https://github.com/amontlabs/lcu/releases/download/v0.13.6/lcu-0.13.6-linux-x64.tar.gz"},{"name":"lcu-0.13.6-linux-x64.tar.gz.sha256","size":94,"download_count":10,"release_tag":"v0.13.6","url":"https://github.com/amontlabs/lcu/releases/download/v0.13.6/lcu-0.13.6-linux-x64.tar.gz.sha256"},{"name":"lcu-0.13.5-darwin-arm64.tar.gz","size":5968556,"download_count":562,"release_tag":"v0.13.5","url":"https://github.com/amontlabs/lcu/releases/download/v0.13.5/lcu-0.13.5-darwin-arm64.tar.gz"},{"name":"lcu-0.13.5-darwin-arm64.tar.gz.sha256","size":97,"download_count":505,"release_tag":"v0.13.5","url":"https://github.com/amontlabs/lcu/releases/download/v0.13.5/lcu-0.13.5-darwin-arm64.tar.gz.sha256"},{"name":"lcu-0.13.5-linux-arm64.tar.gz","size":5947909,"download_count":4,"release_tag":"v0.13.5","url":"https://github.com/amontlabs/lcu/releases/download/v0.13.5/lcu-0.13.5-linux-arm64.tar.gz"},{"name":"lcu-0.13.5-linux-arm64.tar.gz.sha256","size":96,"download_count":3,"release_tag":"v0.13.5","url":"https://github.com/amontlabs/lcu/releases/download/v0.13.5/lcu-0.13.5-linux-arm64.tar.gz.sha256"},{"name":"lcu-0.13.5-linux-x64.tar.gz","size":5948440,"download_count":33,"release_tag":"v0.13.5","url":"https://github.com/amontlabs/lcu/releases/download/v0.13.5/lcu-0.13.5-linux-x64.tar.gz"},{"name":"lcu-0.13.5-linux-x64.tar.gz.sha256","size":94,"download_count":21,"release_tag":"v0.13.5","url":"https://github.com/amontlabs/lcu/releases/download/v0.13.5/lcu-0.13.5-linux-x64.tar.gz.sha256"},{"name":"lcu-0.13.4-darwin-arm64.tar.gz","size":5966151,"download_count":313,"release_tag":"v0.13.4","url":"https://github.com/amontlabs/lcu/releases/download/v0.13.4/lcu-0.13.4-darwin-arm64.tar.gz"},{"name":"lcu-0.13.4-darwin-arm64.tar.gz.sha256","size":97,"download_count":291,"release_tag":"v0.13.4","url":"https://github.com/amontlabs/lcu/releases/download/v0.13.4/lcu-0.13.4-darwin-arm64.tar.gz.sha256"},{"name":"lcu-0.13.4-linux-arm64.tar.gz","size":5935566,"download_count":2,"release_tag":"v0.13.4","url":"https://github.com/amontlabs/lcu/releases/download/v0.13.4/lcu-0.13.4-linux-arm64.tar.gz"},{"name":"lcu-0.13.4-linux-arm64.tar.gz.sha256","size":96,"download_count":2,"release_tag":"v0.13.4","url":"https://github.com/amontlabs/lcu/releases/download/v0.13.4/lcu-0.13.4-linux-arm64.tar.gz.sha256"},{"name":"lcu-0.13.4-linux-x64.tar.gz","size":5933857,"download_count":9,"release_tag":"v0.13.4","url":"https://github.com/amontlabs/lcu/releases/download/v0.13.4/lcu-0.13.4-linux-x64.tar.gz"},{"name":"lcu-0.13.4-linux-x64.tar.gz.sha256","size":94,"download_count":9,"release_tag":"v0.13.4","url":"https://github.com/amontlabs/lcu/releases/download/v0.13.4/lcu-0.13.4-linux-x64.tar.gz.sha256"},{"name":"lcu-0.13.3-darwin-arm64.tar.gz","size":5965294,"download_count":97,"release_tag":"v0.13.3","url":"https://github.com/amontlabs/lcu/releases/download/v0.13.3/lcu-0.13.3-darwin-arm64.tar.gz"},{"name":"lcu-0.13.3-darwin-arm64.tar.gz.sha256","size":97,"download_count":93,"release_tag":"v0.13.3","url":"https://github.com/amontlabs/lcu/releases/download/v0.13.3/lcu-0.13.3-darwin-arm64.tar.gz.sha256"},{"name":"lcu-0.13.3-linux-arm64.tar.gz","size":5944024,"download_count":2,"release_tag":"v0.13.3","url":"https://github.com/amontlabs/lcu/releases/download/v0.13.3/lcu-0.13.3-linux-arm64.tar.gz"},{"name":"lcu-0.13.3-linux-arm64.tar.gz.sha256","size":96,"download_count":1,"release_tag":"v0.13.3","url":"https://github.com/amontlabs/lcu/releases/download/v0.13.3/lcu-0.13.3-linux-arm64.tar.gz.sha256"},{"name":"lcu-0.13.3-linux-x64.tar.gz","size":5943409,"download_count":4,"release_tag":"v0.13.3","url":"https://github.com/amontlabs/lcu/releases/download/v0.13.3/lcu-0.13.3-linux-x64.tar.gz"},{"name":"lcu-0.13.3-linux-x64.tar.gz.sha256","size":94,"download_count":3,"release_tag":"v0.13.3","url":"https://github.com/amontlabs/lcu/releases/download/v0.13.3/lcu-0.13.3-linux-x64.tar.gz.sha256"},{"name":"lcu-0.13.2-darwin-arm64.tar.gz","size":5965100,"download_count":85,"release_tag":"v0.13.2","url":"https://github.com/amontlabs/lcu/releases/download/v0.13.2/lcu-0.13.2-darwin-arm64.tar.gz"},{"name":"lcu-0.13.2-darwin-arm64.tar.gz.sha256","size":97,"download_count":76,"release_tag":"v0.13.2","url":"https://github.com/amontlabs/lcu/releases/download/v0.13.2/lcu-0.13.2-darwin-arm64.tar.gz.sha256"},{"name":"lcu-0.13.2-linux-arm64.tar.gz","size":5937648,"download_count":2,"release_tag":"v0.13.2","url":"https://github.com/amontlabs/lcu/releases/download/v0.13.2/lcu-0.13.2-linux-arm64.tar.gz"},{"name":"lcu-0.13.2-linux-arm64.tar.gz.sha256","size":96,"download_count":1,"release_tag":"v0.13.2","url":"https://github.com/amontlabs/lcu/releases/download/v0.13.2/lcu-0.13.2-linux-arm64.tar.gz.sha256"},{"name":"lcu-0.13.2-linux-x64.tar.gz","size":5938174,"download_count":6,"release_tag":"v0.13.2","url":"https://github.com/amontlabs/lcu/releases/download/v0.13.2/lcu-0.13.2-linux-x64.tar.gz"},{"name":"lcu-0.13.2-linux-x64.tar.gz.sha256","size":94,"download_count":6,"release_tag":"v0.13.2","url":"https://github.com/amontlabs/lcu/releases/download/v0.13.2/lcu-0.13.2-linux-x64.tar.gz.sha256"},{"name":"lcu-0.13.1-darwin-arm64.tar.gz","size":5941961,"download_count":438,"release_tag":"v0.13.1","url":"https://github.com/amontlabs/lcu/releases/download/v0.13.1/lcu-0.13.1-darwin-arm64.tar.gz"},{"name":"lcu-0.13.1-darwin-arm64.tar.gz.sha256","size":97,"download_count":358,"release_tag":"v0.13.1","url":"https://github.com/amontlabs/lcu/releases/download/v0.13.1/lcu-0.13.1-darwin-arm64.tar.gz.sha256"},{"name":"lcu-0.13.1-linux-arm64.tar.gz","size":5920051,"download_count":3,"release_tag":"v0.13.1","url":"https://github.com/amontlabs/lcu/releases/download/v0.13.1/lcu-0.13.1-linux-arm64.tar.gz"},{"name":"lcu-0.13.1-linux-arm64.tar.gz.sha256","size":96,"download_count":2,"release_tag":"v0.13.1","url":"https://github.com/amontlabs/lcu/releases/download/v0.13.1/lcu-0.13.1-linux-arm64.tar.gz.sha256"},{"name":"lcu-0.13.1-linux-x64.tar.gz","size":5921222,"download_count":15,"release_tag":"v0.13.1","url":"https://github.com/amontlabs/lcu/releases/download/v0.13.1/lcu-0.13.1-linux-x64.tar.gz"},{"name":"lcu-0.13.1-linux-x64.tar.gz.sha256","size":94,"download_count":10,"release_tag":"v0.13.1","url":"https://github.com/amontlabs/lcu/releases/download/v0.13.1/lcu-0.13.1-linux-x64.tar.gz.sha256"},{"name":"lcu-0.13.0-darwin-arm64.tar.gz","size":5945698,"download_count":44,"release_tag":"v0.13.0","url":"https://github.com/amontlabs/lcu/releases/download/v0.13.0/lcu-0.13.0-darwin-arm64.tar.gz"},{"name":"lcu-0.13.0-darwin-arm64.tar.gz.sha256","size":97,"download_count":41,"release_tag":"v0.13.0","url":"https://github.com/amontlabs/lcu/releases/download/v0.13.0/lcu-0.13.0-darwin-arm64.tar.gz.sha256"},{"name":"lcu-0.13.0-linux-arm64.tar.gz","size":5919656,"download_count":2,"release_tag":"v0.13.0","url":"https://github.com/amontlabs/lcu/releases/download/v0.13.0/lcu-0.13.0-linux-arm64.tar.gz"},{"name":"lcu-0.13.0-linux-arm64.tar.gz.sha256","size":96,"download_count":2,"release_tag":"v0.13.0","url":"https://github.com/amontlabs/lcu/releases/download/v0.13.0/lcu-0.13.0-linux-arm64.tar.gz.sha256"},{"name":"lcu-0.13.0-linux-x64.tar.gz","size":5916431,"download_count":5,"release_tag":"v0.13.0","url":"https://github.com/amontlabs/lcu/releases/download/v0.13.0/lcu-0.13.0-linux-x64.tar.gz"},{"name":"lcu-0.13.0-linux-x64.tar.gz.sha256","size":94,"download_count":4,"release_tag":"v0.13.0","url":"https://github.com/amontlabs/lcu/releases/download/v0.13.0/lcu-0.13.0-linux-x64.tar.gz.sha256"},{"name":"lcu-0.12.1-darwin-arm64.tar.gz","size":5925719,"download_count":372,"release_tag":"v0.12.1","url":"https://github.com/amontlabs/lcu/releases/download/v0.12.1/lcu-0.12.1-darwin-arm64.tar.gz"},{"name":"lcu-0.12.1-darwin-arm64.tar.gz.sha256","size":97,"download_count":349,"release_tag":"v0.12.1","url":"https://github.com/amontlabs/lcu/releases/download/v0.12.1/lcu-0.12.1-darwin-arm64.tar.gz.sha256"},{"name":"lcu-0.12.1-linux-arm64.tar.gz","size":5902072,"download_count":1,"release_tag":"v0.12.1","url":"https://github.com/amontlabs/lcu/releases/download/v0.12.1/lcu-0.12.1-linux-arm64.tar.gz"},{"name":"lcu-0.12.1-linux-arm64.tar.gz.sha256","size":96,"download_count":1,"release_tag":"v0.12.1","url":"https://github.com/amontlabs/lcu/releases/download/v0.12.1/lcu-0.12.1-linux-arm64.tar.gz.sha256"},{"name":"lcu-0.12.1-linux-x64.tar.gz","size":5902219,"download_count":17,"release_tag":"v0.12.1","url":"https://github.com/amontlabs/lcu/releases/download/v0.12.1/lcu-0.12.1-linux-x64.tar.gz"},{"name":"lcu-0.12.1-linux-x64.tar.gz.sha256","size":94,"download_count":14,"release_tag":"v0.12.1","url":"https://github.com/amontlabs/lcu/releases/download/v0.12.1/lcu-0.12.1-linux-x64.tar.gz.sha256"},{"name":"lcu-0.12.0-darwin-arm64.tar.gz","size":5925237,"download_count":401,"release_tag":"v0.12.0","url":"https://github.com/amontlabs/lcu/releases/download/v0.12.0/lcu-0.12.0-darwin-arm64.tar.gz"},{"name":"lcu-0.12.0-darwin-arm64.tar.gz.sha256","size":97,"download_count":381,"release_tag":"v0.12.0","url":"https://github.com/amontlabs/lcu/releases/download/v0.12.0/lcu-0.12.0-darwin-arm64.tar.gz.sha256"},{"name":"lcu-0.12.0-linux-arm64.tar.gz","size":5898295,"download_count":6,"release_tag":"v0.12.0","url":"https://github.com/amontlabs/lcu/releases/download/v0.12.0/lcu-0.12.0-linux-arm64.tar.gz"},{"name":"lcu-0.12.0-linux-arm64.tar.gz.sha256","size":96,"download_count":5,"release_tag":"v0.12.0","url":"https://github.com/amontlabs/lcu/releases/download/v0.12.0/lcu-0.12.0-linux-arm64.tar.gz.sha256"},{"name":"lcu-0.12.0-linux-x64.tar.gz","size":5895536,"download_count":21,"release_tag":"v0.12.0","url":"https://github.com/amontlabs/lcu/releases/download/v0.12.0/lcu-0.12.0-linux-x64.tar.gz"},{"name":"lcu-0.12.0-linux-x64.tar.gz.sha256","size":94,"download_count":19,"release_tag":"v0.12.0","url":"https://github.com/amontlabs/lcu/releases/download/v0.12.0/lcu-0.12.0-linux-x64.tar.gz.sha256"},{"name":"lcu-0.11.8-darwin-arm64.tar.gz","size":5906472,"download_count":46,"release_tag":"v0.11.8","url":"https://github.com/amontlabs/lcu/releases/download/v0.11.8/lcu-0.11.8-darwin-arm64.tar.gz"},{"name":"lcu-0.11.8-darwin-arm64.tar.gz.sha256","size":97,"download_count":47,"release_tag":"v0.11.8","url":"https://github.com/amontlabs/lcu/releases/download/v0.11.8/lcu-0.11.8-darwin-arm64.tar.gz.sha256"},{"name":"lcu-0.11.8-linux-arm64.tar.gz","size":5881962,"download_count":2,"release_tag":"v0.11.8","url":"https://github.com/amontlabs/lcu/releases/download/v0.11.8/lcu-0.11.8-linux-arm64.tar.gz"},{"name":"lcu-0.11.8-linux-arm64.tar.gz.sha256","size":96,"download_count":2,"release_tag":"v0.11.8","url":"https://github.com/amontlabs/lcu/releases/download/v0.11.8/lcu-0.11.8-linux-arm64.tar.gz.sha256"},{"name":"lcu-0.11.8-linux-x64.tar.gz","size":5881241,"download_count":6,"release_tag":"v0.11.8","url":"https://github.com/amontlabs/lcu/releases/download/v0.11.8/lcu-0.11.8-linux-x64.tar.gz"},{"name":"lcu-0.11.8-linux-x64.tar.gz.sha256","size":94,"download_count":5,"release_tag":"v0.11.8","url":"https://github.com/amontlabs/lcu/releases/download/v0.11.8/lcu-0.11.8-linux-x64.tar.gz.sha256"}]}},"commit_sha":"c8e5693d7141c60ef42294c03b2eee2d88557a49","profile":{"lines_by_language":{"JavaScript":37276,"Python":13739,"TypeScript":2419,"Shell":995,"Swift":103,"PowerShell":61},"files_by_category":{"test":169,"docs":152,"source":78,"config":32,"other":11,"binary":10,"generated":2,"oversized":2,"vendored":2},"source_lines":20200,"test_lines":34393},"pillars":{"ai_provenance":{"score":32.5,"confidence":0.95,"coverage":1.0,"label":"explicit","breakdown":{"attributed_share":0.3255,"suspected_share":0.272,"estimated_share":0.3255,"ai_artifacts":4.0,"flagged_work_units":7.0,"flagged_releases":2.0},"summary":"Explicit AI attribution on 33% of first-party code added; an estimated 33% including velocity signals."},"quality":{"score":72.7,"confidence":0.9,"coverage":1.0,"label":"adequate","breakdown":{"complexity":49.2,"duplication":94.6,"lint":66.2,"testing":100.0,"docs":65.0,"type_safety":0.0,"process":null},"summary":"Code quality is adequate: test-to-source ratio 1.70, CI runs tests; 24% of function code in complex or long functions; 1% duplicated lines. Weakest area: type safety."},"security":{"score":58.6,"confidence":0.85,"coverage":1.0,"label":"weak","breakdown":{"secrets":93.6,"sast":83.1,"dependencies":52.2,"ci_actions":1.7,"posture":20.0,"scorecard":null},"summary":"Security posture is weak: 23 known vulnerabilities in 8 dependencies; 8 high-severity SAST findings; 20 high-severity workflow issues. Weakest area: ci actions."}},"analyzer_results":[{"analyzer":"sec-scorecard","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no published OpenSSF Scorecard result for this repo"},{"analyzer":"sec-registry","pillar":"security","status":"ok","tool_version":null,"metrics":{"declared":5.0,"checked":5.0,"missing":0.0,"recent":0.0,"lookup_errors":0.0},"findings":[],"evidence":[],"data":{"phantom":false},"error":null},{"analyzer":"ai-attribution","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"commits":513.0,"attributed_commits":69.0,"attributed_commit_share":0.13450292397660818,"effective_loc":85748.0,"attributed_loc":27909.0,"attributed_loc_share":0.3254769790549051,"tools_detected":1.0},"findings":[],"evidence":[{"kind":"attribution-summary","description":"Claude Code: 69 attributed commits, 27,909 lines added","ref":null,"url":null,"weight":1.0},{"kind":"attributed-commit","description":"Claude Code: PR description attribution","ref":"bcbceae03e70db39524c7a9eead1339945d43d42","url":"https://github.com/amontlabs/lcu/commit/bcbceae03e70db39524c7a9eead1339945d43d42","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"ed1e1cb84d1408b8320ce2b9127b6172d3285650","url":"https://github.com/amontlabs/lcu/commit/ed1e1cb84d1408b8320ce2b9127b6172d3285650","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"6257c85426bb41f205621703503e8940b2438561","url":"https://github.com/amontlabs/lcu/commit/6257c85426bb41f205621703503e8940b2438561","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"8389f8ff98a5d828a6b9102e92ace0de458bc862","url":"https://github.com/amontlabs/lcu/commit/8389f8ff98a5d828a6b9102e92ace0de458bc862","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: PR description attribution","ref":"289d3cdffe8562063281928781de6675f878e149","url":"https://github.com/amontlabs/lcu/commit/289d3cdffe8562063281928781de6675f878e149","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"3df22ffb886def8aad49cb76f2bbe92b89f237cf","url":"https://github.com/amontlabs/lcu/commit/3df22ffb886def8aad49cb76f2bbe92b89f237cf","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: PR branch 'claude/project-thread-oeuii6'","ref":"fbe4b0fdfd63557975defc38bc9c66e4a346c9fc","url":"https://github.com/amontlabs/lcu/commit/fbe4b0fdfd63557975defc38bc9c66e4a346c9fc","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: PR branch 'claude/project-thread-wp4nhn'","ref":"8d768bee5c9f126ed27d52d22805a4aa4278617a","url":"https://github.com/amontlabs/lcu/commit/8d768bee5c9f126ed27d52d22805a4aa4278617a","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: PR branch 'claude/project-thread-hk8ehz'","ref":"6fe7e941392ca5d0593e2642b87e3f54186a317b","url":"https://github.com/amontlabs/lcu/commit/6fe7e941392ca5d0593e2642b87e3f54186a317b","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"c3559c858d814c69387a7a3cbae81e21d643d6e9","url":"https://github.com/amontlabs/lcu/commit/c3559c858d814c69387a7a3cbae81e21d643d6e9","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"559fdb9234d9ee8fcb5f0ce92a7b69878b836117","url":"https://github.com/amontlabs/lcu/commit/559fdb9234d9ee8fcb5f0ce92a7b69878b836117","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: PR branch 'claude/stoic-cray-2fzmyi'","ref":"fe364a9ef47cef91bf14ea9a70083644cdcd7823","url":"https://github.com/amontlabs/lcu/commit/fe364a9ef47cef91bf14ea9a70083644cdcd7823","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: author email noreply@anthropic.com","ref":"02cc9af0ca0cff6a830aedd569d229e504e356b5","url":"https://github.com/amontlabs/lcu/commit/02cc9af0ca0cff6a830aedd569d229e504e356b5","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: PR description attribution","ref":"399ead3dca47aaa85a523a1a0485fcd10b1577d1","url":"https://github.com/amontlabs/lcu/commit/399ead3dca47aaa85a523a1a0485fcd10b1577d1","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-authored-by: Claude'","ref":"a2c48c21016589d4ff6c3bc87085a114a3967b78","url":"https://github.com/amontlabs/lcu/commit/a2c48c21016589d4ff6c3bc87085a114a3967b78","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"2172c3d74bec56f69ecaf6779d270810737af827","url":"https://github.com/amontlabs/lcu/commit/2172c3d74bec56f69ecaf6779d270810737af827","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"72a451272ff3091465a9bc42db8c1baa39db9d8a","url":"https://github.com/amontlabs/lcu/commit/72a451272ff3091465a9bc42db8c1baa39db9d8a","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"f6f11e89e459c54a34436eed6a6d58498381d9f6","url":"https://github.com/amontlabs/lcu/commit/f6f11e89e459c54a34436eed6a6d58498381d9f6","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"09739b6c05160702a1cc1cb62915180a376fb090","url":"https://github.com/amontlabs/lcu/commit/09739b6c05160702a1cc1cb62915180a376fb090","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"e3558c9e2b3aa26f680151a35bea0026d0ecc474","url":"https://github.com/amontlabs/lcu/commit/e3558c9e2b3aa26f680151a35bea0026d0ecc474","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"3b9c106819a3c8db243d7990a231a00fc62c0c45","url":"https://github.com/amontlabs/lcu/commit/3b9c106819a3c8db243d7990a231a00fc62c0c45","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"efd315e0c5002247823379691a1974eaaca05002","url":"https://github.com/amontlabs/lcu/commit/efd315e0c5002247823379691a1974eaaca05002","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"4e63cb353859760beea94e82c904132e570b5b2d","url":"https://github.com/amontlabs/lcu/commit/4e63cb353859760beea94e82c904132e570b5b2d","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"71aaf1c1dfb905baf997034081afacc5dac467c2","url":"https://github.com/amontlabs/lcu/commit/71aaf1c1dfb905baf997034081afacc5dac467c2","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"e9acaac90e7eaade7de553269a6608e70ac8df0b","url":"https://github.com/amontlabs/lcu/commit/e9acaac90e7eaade7de553269a6608e70ac8df0b","weight":0.9}],"data":{"attributed_loc_by_commit":{"f1ebf41114f30326f33297de86014378e5baaf8a":119,"5a856e6b13b05ddf28319d2821660c31d17834e4":0,"5d69ee11909c7703ad3cc613fc25ebc7fd3a6558":2,"3dbc3720371923418c8aa61f636f1fe2ec3dd1b6":0,"3337f73907afff15a4c334821f40cbc9c9e7f4b1":25,"5b23d2930b76f1f662a428138d1e216b856aa23e":9,"34af9ac203c8f8377100f47665998e6d26729642":63,"4d4cb3ff5e1fcc00e9d8f24ae26930426a177593":0,"79e75733b7626064db0a87b7d959edacda5a7e07":0,"628b4d2215132d155e2f3ea40b468320f2dafd40":0,"4251a75b91f91ab219b822b57c25ea5896c7c002":0,"2cafd59f2941bc04ef1a88927dd0f6b8d8b9f6c6":25,"4d43324b3b6cf8374d0e471c5db1544e270e63a4":0,"6d5a40339a13a322590b0e135e6e0d1dc4b3f1c7":98,"8e53b8b91e23d6a13bbe6fbc8de66f0cbc173f9c":0,"feeeb6597c93e68687b4016ea4939c6c19dd7804":0,"1342a9b5cff2f421664332efe01ec59f78562639":0,"d7b9062f1970996c94779947ddb4f4ac7ab0b36b":0,"51a0a148607db978567264462767cbccf4113772":248,"51d50fc142b54c94b570c0a9074fb9f561a450cd":0,"2122f60941a8e40947c942137819285edb50f48d":50,"8fa6f82b89bd281df079abdbabe5985910fa98f5":11,"f4690fa5e1ba7ee2a553a23bc4cffcf0a76618de":5,"c4e2e564869435f6167de4ba325139f21f292051":47,"fb5fb7c7e8a96bee048f3606b04b02ff7291f103":76,"ba5090b3965a03073506d4d1d3cef50246d255e5":323,"efdc60adad18c85eef945d995b11eb073494009c":4,"c85cb7bcf5b5a97f4dc5eef698a2c36ddfb3b8fe":28,"b54ff79f2c3a0367900fc8512beb6b4ec7f8034a":0,"36ad6006ca9c2dcc81c3157e6a6c6dca815daaf1":1,"d13c7f335884f694299f52533e5aab8e343f88ce":31,"7ccf7301e5298272e1fccc0498ea97ae3bfc37b9":1,"4aa00ca46f22c83dda42a05e551f87dc711aed71":7,"c36f2d57154181d03557aec757bc45f339c29f26":0,"feb9bb9fd1f72cabb22e8c51160ab530f7086b4a":1,"88645c2424853d46af7c65e705a7175cb1969cc2":230,"85e5ed32c9a3120fef2184653279d6dfb6b55c47":18,"2b231066ddf755f22c16540091a7b3b084a33dbb":0,"825ca911f53fa7447ffa505d1b18441b7e8b9ebb":359,"82d1b669077b9dd733ce33c389fe78c0a20edd4c":757,"6e5b40da9c22d5a86605dc6adfb96e7572a626f8":1,"cb2ae78b30beb40ac10a666861bac75cc629c8a2":0,"d19be7474a0e2f269aedf4b57e79098dcf6ab0e3":260,"f9dc9ee39d3559dd3a613efbbad316570ce13359":237,"e9acaac90e7eaade7de553269a6608e70ac8df0b":302,"71aaf1c1dfb905baf997034081afacc5dac467c2":0,"4e63cb353859760beea94e82c904132e570b5b2d":1,"efd315e0c5002247823379691a1974eaaca05002":0,"e3558c9e2b3aa26f680151a35bea0026d0ecc474":529,"3b9c106819a3c8db243d7990a231a00fc62c0c45":84,"09739b6c05160702a1cc1cb62915180a376fb090":1,"f6f11e89e459c54a34436eed6a6d58498381d9f6":19,"72a451272ff3091465a9bc42db8c1baa39db9d8a":0,"2172c3d74bec56f69ecaf6779d270810737af827":15,"a2c48c21016589d4ff6c3bc87085a114a3967b78":12,"399ead3dca47aaa85a523a1a0485fcd10b1577d1":2282,"02cc9af0ca0cff6a830aedd569d229e504e356b5":1,"fe364a9ef47cef91bf14ea9a70083644cdcd7823":19024,"c3559c858d814c69387a7a3cbae81e21d643d6e9":0,"559fdb9234d9ee8fcb5f0ce92a7b69878b836117":1030,"6fe7e941392ca5d0593e2642b87e3f54186a317b":77,"8d768bee5c9f126ed27d52d22805a4aa4278617a":64,"fbe4b0fdfd63557975defc38bc9c66e4a346c9fc":942,"3df22ffb886def8aad49cb76f2bbe92b89f237cf":109,"289d3cdffe8562063281928781de6675f878e149":214,"8389f8ff98a5d828a6b9102e92ace0de458bc862":20,"6257c85426bb41f205621703503e8940b2438561":0,"ed1e1cb84d1408b8320ce2b9127b6172d3285650":49,"bcbceae03e70db39524c7a9eead1339945d43d42":98},"tools":{"claude-code":{"name":"Claude Code","commits":69,"loc":27909,"first_seen":1790549385,"last_seen":1794220413}},"monthly":{"2026-09":{"loc":31923,"attributed_loc":1173},"2026-10":{"loc":53217,"attributed_loc":26589},"2026-11":{"loc":608,"attributed_loc":147}}},"error":null},{"analyzer":"ai-artifacts","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"artifacts":3.0,"workflow_agents":1.0,"tools_configured":2.0,"earliest_adoption":1790087127.0},"findings":[],"evidence":[{"kind":"ai-artifact","description":".claude/launch.json (claude-code configuration)","ref":".claude/launch.json","url":"https://github.com/amontlabs/lcu/blob/c8e5693d7141c60ef42294c03b2eee2d88557a49/.claude/launch.json","weight":0.5},{"kind":"ai-artifact","description":".claude/settings.json (claude-code configuration)","ref":".claude/settings.json","url":"https://github.com/amontlabs/lcu/blob/c8e5693d7141c60ef42294c03b2eee2d88557a49/.claude/settings.json","weight":0.5},{"kind":"ai-artifact","description":"AGENTS.md (generic-agent configuration)","ref":"AGENTS.md","url":"https://github.com/amontlabs/lcu/blob/c8e5693d7141c60ef42294c03b2eee2d88557a49/AGENTS.md","weight":0.5},{"kind":"ai-workflow","description":".github/workflows/claude.yml runs anthropics/claude-code-action","ref":".github/workflows/claude.yml","url":"https://github.com/amontlabs/lcu/blob/c8e5693d7141c60ef42294c03b2eee2d88557a49/.github/workflows/claude.yml","weight":0.6}],"data":{"artifacts":[{"tool":"claude-code","path":".claude/launch.json","added_at":1790601695},{"tool":"claude-code","path":".claude/settings.json","added_at":1791370215},{"tool":"generic-agent","path":"AGENTS.md","added_at":1790087127}],"workflows":[{"tool":"claude-code","path":".github/workflows/claude.yml","action":"anthropics/claude-code-action"}],"tools":["claude-code","generic-agent"]},"error":null},{"analyzer":"ai-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"work_units":97.0,"flagged_units":7.0,"pre_ai_era_bursts":0.0,"pre_ai_era_measured_loc":0.0,"pre_ai_era_burst_loc":0.0,"measured_loc":62719.0,"flagged_loc":24374.0,"flagged_loc_share":0.38862226757441926,"max_loc_per_hour":2009.5003785011356,"median_loc_per_hour":211.49841277503577,"pr_timed_units":35.0,"excluded_import_loc":23029.0},"findings":[],"evidence":[{"kind":"velocity-burst","description":"5,899 lines of first-party code in ~2.9h (2,010 lines/hour, 27 commit session)","ref":"4aa00ca46f22c83dda42a05e551f87dc711aed71","url":"https://github.com/amontlabs/lcu/commit/4aa00ca46f22c83dda42a05e551f87dc711aed71","weight":0.6},{"kind":"velocity-burst","description":"7,390 lines of first-party code in ~5.4h (1,367 lines/hour, 9 commit session)","ref":"31fb39893e3d99abc1e553f4ea96a50432fa7eed","url":"https://github.com/amontlabs/lcu/commit/31fb39893e3d99abc1e553f4ea96a50432fa7eed","weight":0.41004932182490755},{"kind":"velocity-burst","description":"2,437 lines of first-party code in ~2.1h (1,156 lines/hour, 9 commit session)","ref":"626d4cb67aa7eeea96fcc4063790cd8d3dd55fa8","url":"https://github.com/amontlabs/lcu/commit/626d4cb67aa7eeea96fcc4063790cd8d3dd55fa8","weight":0.3469039145907474},{"kind":"velocity-burst","description":"1,565 lines of first-party code in ~1.7h (907 lines/hour, 13 commit session)","ref":"d50f681410a11f301854113384dd99b8d943bcb2","url":"https://github.com/amontlabs/lcu/commit/d50f681410a11f301854113384dd99b8d943bcb2","weight":0.27213009177266134},{"kind":"velocity-burst","description":"1,553 lines of first-party code in ~1.8h (870 lines/hour, PR #20)","ref":"b5a1903676d28c929f4d4117f0ea9b6cecb69d6d","url":"https://github.com/amontlabs/lcu/commit/b5a1903676d28c929f4d4117f0ea9b6cecb69d6d","weight":0.260886607559496},{"kind":"velocity-burst","description":"2,733 lines of first-party code in ~4.7h (585 lines/hour, 15 commit session)","ref":"d862ea71123b90010381d1434a545f2c0cbd26fc","url":"https://github.com/amontlabs/lcu/commit/d862ea71123b90010381d1434a545f2c0cbd26fc","weight":0.17564058315977388},{"kind":"velocity-burst","description":"2,797 lines of first-party code in ~5.1h (553 lines/hour, 10 commit session)","ref":"23b128b39c93f27540aa1962469d9b790257654b","url":"https://github.com/amontlabs/lcu/commit/23b128b39c93f27540aa1962469d9b790257654b","weight":0.16576633924161777}],"data":{"flagged_loc_by_commit":{"fea4690c097f1114efd134ef9d929d0ffc5d2f52":1888,"9a197460aa9f158247a364b50ded85592a8588af":216,"640b13bd12304f78a5a550a137d7854b02d7a7b4":86,"168f1c8154fffa9cde6f61c4b04c10a26e2ca204":69,"fb3eb20410cdd1126c275c390e8163349db74d9d":145,"d9961e2b816fe5876c412b5637a15e23742d62d4":154,"987beba32ed81efa23d1916ae3ebf964ec44da07":1,"f34b370cd750807a04f8590b36ad71240f9be572":15,"8cd41bb19dce51022d0d7285d5bad4f77bb36d1f":1,"a40f0cab3b15a38e82e00fc0e8672b608cb7a8ec":8,"83ba562faaf61146db3affd238544d9b62f86b85":22,"08ae16b34715319ad4f095e11c2fb538121305c4":1,"dc30bfd3163c21216f6ab6737f86e7eb257402ba":36,"0c3a2b47f8537ec95d2501d54ff9383b8a87281c":46,"d862ea71123b90010381d1434a545f2c0cbd26fc":45,"665d194d62435079d97f76a6e99fca2908119e42":289,"96705d2676f5aa74eecdc873247ed0a9714ca47f":475,"741530d88fc5e9fea03bcd9e957ced25ed3ae93f":54,"cdd307c88896b0e303d05cea666899fb2f56ea40":723,"5731e04022716e68931b0a6ec45c1b87306a8494":5,"adc308a7a5efaf6bdf776eaa8534eb9c88d7b405":143,"799953eb9c746823e302a1303c2aa7fd0bc6ee4c":13,"1192a3c1b4617ce6520e1c507a77bb75d996b1a1":45,"626d4cb67aa7eeea96fcc4063790cd8d3dd55fa8":690,"bf414cc58b0390e43d5021c2e2dd027df4274e70":3942,"c7be5853b8db2c3529213eac4b6d0cc2d9899752":1478,"3807ca8831f08cbe18a5b9603432244a3a003f32":377,"e922c11c42aa45c4d1aef2928b4e4ffc6f4de178":113,"ce7e9608c76bf653f04676ea43a6f4d23e87be23":292,"d2b92e79829b9568f07ed55f8c5b7b5c9be6da61":197,"e18ec79599546b48919e7fd8e04b7798438c3dc5":342,"56f908f70fe6982f335b9af15680b6d90decf371":403,"31fb39893e3d99abc1e553f4ea96a50432fa7eed":246,"16aeee1e7e5c6c6c2c71fa17fa8117ef8c15eab1":18,"4fe70bc5849dc6cac50493e7826791855fda5eb1":675,"47acc575c9d171dde928f29dc8373496a862b664":2,"b9d8c592fa997cbc5b79044e4ae643c029e3024f":476,"c21f175ad405fc9c8c839577d0f9714baf129db4":796,"19cd7302948869484dece4d09f90d3493280a5f0":2673,"c98cdd57f57d6c7990d6cdbc30a8b09f36ab44f2":2,"e1ae343ef69834e9d5c18605936ead891a4bd61f":37,"1663f683b5ddeda06e390bf1ce701dfe8e72f195":168,"3337f73907afff15a4c334821f40cbc9c9e7f4b1":25,"5b23d2930b76f1f662a428138d1e216b856aa23e":9,"34af9ac203c8f8377100f47665998e6d26729642":63,"2cafd59f2941bc04ef1a88927dd0f6b8d8b9f6c6":25,"6d5a40339a13a322590b0e135e6e0d1dc4b3f1c7":98,"51a0a148607db978567264462767cbccf4113772":248,"2122f60941a8e40947c942137819285edb50f48d":50,"8fa6f82b89bd281df079abdbabe5985910fa98f5":11,"f4690fa5e1ba7ee2a553a23bc4cffcf0a76618de":5,"c4e2e564869435f6167de4ba325139f21f292051":47,"fb5fb7c7e8a96bee048f3606b04b02ff7291f103":76,"ba5090b3965a03073506d4d1d3cef50246d255e5":323,"efdc60adad18c85eef945d995b11eb073494009c":4,"c85cb7bcf5b5a97f4dc5eef698a2c36ddfb3b8fe":28,"36ad6006ca9c2dcc81c3157e6a6c6dca815daaf1":1,"d13c7f335884f694299f52533e5aab8e343f88ce":31,"7ccf7301e5298272e1fccc0498ea97ae3bfc37b9":1,"4aa00ca46f22c83dda42a05e551f87dc711aed71":7,"f565e1727d8f1bd4e69c11519b004fa67dbe688d":74,"ff859f94e8abf9545e5253836f9f290bf461db67":225,"420b9eaa310815541e62757ba538b6bb073724ca":466,"e128962567520b6794f72348fe7d313ee8fbf46b":454,"039de27dadc8bae7e8ffc97fa9a2f5e8c65f5875":2,"d04e3e4420476faa12b36e9f13c6cc5cedd76468":6,"60dd54263256c160fc9294175765246fe3276f63":6,"0ed4ec686f4624d2ef6f711949a70ce942ec5cbf":140,"0f17ca767094e76b69e3ac920eab3d0a9a8fea31":30,"ecb64b4cb3f7d397eb95b34b44fb86748d122b37":49,"7bdfc6020c73e8c1469d9831f429a0da1b324ffa":77,"3efc6bfb65a515defd46ca8c9b95964932f046c6":27,"d50f681410a11f301854113384dd99b8d943bcb2":9,"a27dd35c4f691d5625b8ec9a3792ff9e72a20f50":193,"7d068dfe538b6787cc0b7bee0c4121cd7a8bbc8b":35,"b32b9110be3758268dc4c44ceeedc5529c517885":1,"df4876e9bc17369f3f4eda5fda2a4982c5734be5":721,"c5f39d8009fce973b3d4599236cdcadd4d762598":132,"5ce4db8f85e2869069021553742cce5937a27d2e":11,"bc469903fb0eaf027eacbfb3208fee2afef024c7":1,"9b428247b1675780681b185b3f9abb4b234cd717":1272,"e07ba40d3ba4295654e5a73028baeecfe0310a24":100,"23b128b39c93f27540aa1962469d9b790257654b":331,"b5a1903676d28c929f4d4117f0ea9b6cecb69d6d":1553},"excluded_import_commits":["c5f5613a0cb407b18293bc2875d63596753a3860","fe364a9ef47cef91bf14ea9a70083644cdcd7823"]},"error":null},{"analyzer":"ai-release-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"releases":47.0,"flagged_releases":2.0,"max_loc_per_day":56722.4},"findings":[],"evidence":[{"kind":"release-burst","description":"v0.3.0 → v0.4.0: 11,587 lines in 3.21 days (3,605.9 lines/day)","ref":"v0.3.0...v0.4.0","url":"https://github.com/amontlabs/lcu/compare/v0.3.0...v0.4.0","weight":0.4},{"kind":"release-burst","description":"v0.4.2 → v0.5.0: 8,295 lines in 0.15 days (56,722.4 lines/day)","ref":"v0.4.2...v0.5.0","url":"https://github.com/amontlabs/lcu/compare/v0.4.2...v0.5.0","weight":0.4}],"data":{"releases":[{"from":"v0.1.0","to":"v0.2.0","loc":94,"days":0.04,"loc_per_day":2256.0,"flagged":false},{"from":"v0.2.0","to":"v0.2.1","loc":176,"days":0.04,"loc_per_day":4224.0,"flagged":false},{"from":"v0.2.1","to":"v0.3.0","loc":413,"days":1.14,"loc_per_day":360.8,"flagged":false},{"from":"v0.3.0","to":"v0.4.0","loc":11587,"days":3.21,"loc_per_day":3605.9,"flagged":true},{"from":"v0.4.0","to":"v0.4.1","loc":578,"days":0.05,"loc_per_day":10753.5,"flagged":false},{"from":"v0.4.1","to":"v0.4.2","loc":4065,"days":1.37,"loc_per_day":2971.7,"flagged":false},{"from":"v0.4.2","to":"v0.5.0","loc":8295,"days":0.15,"loc_per_day":56722.4,"flagged":true},{"from":"v0.5.0","to":"v0.6.0","loc":1052,"days":0.04,"loc_per_day":25248.0,"flagged":false},{"from":"v0.6.0","to":"v0.7.0","loc":249,"days":3.07,"loc_per_day":81.1,"flagged":false},{"from":"v0.7.0","to":"v0.8.0","loc":1350,"days":0.24,"loc_per_day":5742.7,"flagged":false},{"from":"v0.8.0","to":"v0.8.1","loc":1172,"days":0.09,"loc_per_day":13065.9,"flagged":false},{"from":"v0.8.1","to":"v0.8.2","loc":633,"days":0.65,"loc_per_day":969.0,"flagged":false},{"from":"v0.8.2","to":"v0.8.3","loc":860,"days":0.15,"loc_per_day":5574.6,"flagged":false},{"from":"v0.8.3","to":"v0.8.4","loc":646,"days":0.04,"loc_per_day":15504.0,"flagged":false},{"from":"v0.8.4","to":"v0.8.5","loc":280,"days":0.05,"loc_per_day":5333.3,"flagged":false},{"from":"v0.8.5","to":"v0.8.6","loc":620,"days":0.04,"loc_per_day":14880.0,"flagged":false},{"from":"v0.8.6","to":"v0.8.7","loc":849,"days":0.06,"loc_per_day":13233.6,"flagged":false},{"from":"v0.8.7","to":"v0.8.8","loc":545,"days":0.51,"loc_per_day":1078.1,"flagged":false},{"from":"v0.8.8","to":"v0.8.9","loc":396,"days":0.99,"loc_per_day":399.8,"flagged":false},{"from":"v0.8.9","to":"v0.9.0","loc":3971,"days":0.42,"loc_per_day":9382.4,"flagged":false},{"from":"v0.9.0","to":"v0.9.1","loc":1715,"days":0.05,"loc_per_day":35491.3,"flagged":false},{"from":"v0.9.1","to":"v0.9.2","loc":331,"days":0.42,"loc_per_day":792.0,"flagged":false},{"from":"v0.9.2","to":"v0.9.3","loc":820,"days":0.17,"loc_per_day":4795.5,"flagged":false},{"from":"v0.9.3","to":"v0.9.4","loc":29,"days":0.04,"loc_per_day":696.0,"flagged":false},{"from":"v0.9.4","to":"v0.9.5","loc":704,"days":0.12,"loc_per_day":6049.3,"flagged":false},{"from":"v0.9.5","to":"v0.9.6","loc":4517,"days":0.89,"loc_per_day":5085.6,"flagged":false},{"from":"v0.9.6","to":"v0.9.7","loc":2872,"days":1.14,"loc_per_day":2523.4,"flagged":false},{"from":"v0.9.7","to":"v0.10.0","loc":412,"days":1.21,"loc_per_day":341.5,"flagged":false},{"from":"v0.10.0","to":"v0.10.1","loc":880,"days":0.63,"loc_per_day":1404.5,"flagged":false},{"from":"v0.10.1","to":"v0.11.0","loc":1426,"days":0.92,"loc_per_day":1549.1,"flagged":false},{"from":"v0.11.0","to":"v0.11.1","loc":1066,"days":0.18,"loc_per_day":5857.1,"flagged":false},{"from":"v0.11.1","to":"v0.11.2","loc":430,"days":0.22,"loc_per_day":1965.1,"flagged":false},{"from":"v0.11.2","to":"v0.11.3","loc":609,"days":1.58,"loc_per_day":384.3,"flagged":false},{"from":"v0.11.3","to":"v0.11.4","loc":155,"days":2.2,"loc_per_day":70.6,"flagged":false},{"from":"v0.11.4","to":"v0.11.5","loc":1080,"days":5.05,"loc_per_day":213.8,"flagged":false},{"from":"v0.11.5","to":"v0.11.6","loc":64,"days":0.07,"loc_per_day":860.9,"flagged":false},{"from":"v0.11.6","to":"v0.11.7","loc":193,"days":0.84,"loc_per_day":229.1,"flagged":false},{"from":"v0.11.7","to":"v0.11.8","loc":37,"days":0.8,"loc_per_day":46.5,"flagged":false},{"from":"v0.11.8","to":"v0.12.0","loc":1488,"days":0.11,"loc_per_day":13554.4,"flagged":false},{"from":"v0.12.0","to":"v0.12.1","loc":138,"days":1.86,"loc_per_day":74.2,"flagged":false},{"from":"v0.12.1","to":"v0.13.0","loc":1084,"days":2.02,"loc_per_day":536.4,"flagged":false},{"from":"v0.13.0","to":"v0.13.1","loc":324,"days":0.18,"loc_per_day":1817.3,"flagged":false},{"from":"v0.13.1","to":"v0.13.2","loc":2106,"days":2.79,"loc_per_day":754.9,"flagged":false},{"from":"v0.13.2","to":"v0.13.3","loc":124,"days":0.41,"loc_per_day":299.7,"flagged":false},{"from":"v0.13.3","to":"v0.13.4","loc":18,"days":0.64,"loc_per_day":28.1,"flagged":false},{"from":"v0.13.4","to":"v0.13.5","loc":411,"days":3.27,"loc_per_day":125.7,"flagged":false},{"from":"v0.13.5","to":"v0.13.6","loc":197,"days":8.78,"loc_per_day":22.4,"flagged":false}]},"error":null},{"analyzer":"ai-stylometry","pillar":"ai_provenance","status":"ok","tool_version":null,"metrics":{"lines_scanned":20200.0,"index":0.0,"count:narrated_steps":0.0,"per_kloc:narrated_steps":0.0,"files:narrated_steps":0.0,"count:placeholder":0.0,"per_kloc:placeholder":0.0,"files:placeholder":0.0,"count:emoji_in_code":0.0,"per_kloc:emoji_in_code":0.0,"files:emoji_in_code":0.0,"count:assistant_voice":0.0,"per_kloc:assistant_voice":0.0,"files:assistant_voice":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-secrets","pillar":"security","status":"ok","tool_version":"gitleaks 8.30.1","metrics":{"secrets_current":0.0,"secrets_history":0.0,"secrets_nonprod":2.0,"secrets_low_confidence":0.0},"findings":[{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree (test/docs/example file)","path":"docs/verification/full-gate-4djwlqe0-2026-09-22.json","line":28,"fingerprint":"docs/verification/full-gate-4djwlqe0-2026-09-22.json:generic-api-key:28"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree (test/docs/example file)","path":"docs/verification/full-gate-hxkg3p_6-2026-09-22.json","line":98,"fingerprint":"docs/verification/full-gate-hxkg3p_6-2026-09-22.json:generic-api-key:98"}],"evidence":[],"data":{},"error":null},{"analyzer":"sec-sast","pillar":"security","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":26.0,"findings_high":8.0,"findings_medium":17.0,"findings_low":1.0,"weighted_findings":10.662,"scanned_lines":20139.0,"parse_errors":5.0},"findings":[{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"adapters/hermes/__init__.py","line":76,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:adapters/hermes/__init__.py:76"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"scripts/build_bundle.py","line":100,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:scripts/build_bundle.py:100"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"scripts/build_bundle.py","line":172,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:scripts/build_bundle.py:172"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"scripts/check_windows_host_layout.py","line":63,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:scripts/check_windows_host_layout.py:63"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"scripts/check_windows_host_layout.py","line":81,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:scripts/check_windows_host_layout.py:81"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"scripts/provision_agent_tools.py","line":81,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:scripts/provision_agent_tools.py:81"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"scripts/provision_agent_tools.py","line":91,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:scripts/provision_agent_tools.py:91"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"scripts/provision_agent_tools.py","line":109,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:scripts/provision_agent_tools.py:109"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"adapters/claude-mod/lcu-approve/hooks/register.tsx","line":472,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:adapters/claude-mod/lcu-approve/hooks/register.tsx:472"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"adapters/claude-mod/lcu-approve/hooks/register.tsx","line":543,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:adapters/claude-mod/lcu-approve/hooks/register.tsx:543"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"adapters/claude-mod/lcu-approve/hooks/views.tsx","line":60,"fingerprint":"javascript.lang.security.html-in-template-string:adapters/claude-mod/lcu-approve/hooks/views.tsx:60"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"adapters/claude-mod/lcu-approve/hooks/views.tsx","line":65,"fingerprint":"javascript.lang.security.html-in-template-string:adapters/claude-mod/lcu-approve/hooks/views.tsx:65"},{"rule_id":"opengrep/javascript.express.security.express-data-exfiltration","severity":"medium","message":"Depending on the context, user control data in `Object.assign` can cause web response to include data that it should not have or can lead to a mass assignment vulnerability. [confidence low]","path":"adapters/claude.mjs","line":773,"fingerprint":"javascript.express.security.express-data-exfiltration:adapters/claude.mjs:773"},{"rule_id":"opengrep/javascript.lang.security.insecure-object-assign","severity":"medium","message":"Depending on the context, user control data in `Object.assign` can cause web response to include data that it should not have or can lead to a mass assignment vulnerability. [confidence low]","path":"adapters/claude.mjs","line":773,"fingerprint":"javascript.lang.security.insecure-object-assign:adapters/claude.mjs:773"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `key` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled  [confidence low]","path":"adapters/pi/index.ts","line":192,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:adapters/pi/index.ts:192"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"adapters/pi/index.ts","line":192,"fingerprint":"javascript.lang.security.html-in-template-string:adapters/pi/index.ts:192"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"lcu/apps.mjs","line":343,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:lcu/apps.mjs:343"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `name` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled [confidence low]","path":"lcu/linux_sky_service.mjs","line":145,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:lcu/linux_sky_service.mjs:145"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `text` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled [confidence low]","path":"lcu/toml.mjs","line":48,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:lcu/toml.mjs:48"},{"rule_id":"opengrep/javascript.lang.security.audit.prototype-pollution.prototype-pollution-loop","severity":"medium","message":"Possibility of prototype polluting function detected. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can be problematic if the software depends on existence or non-exis [confidence low]","path":"lcu/toml.mjs","line":187,"fingerprint":"javascript.lang.security.audit.prototype-pollution.prototype-pollution-loop:lcu/toml.mjs:187"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"lcu/update_apply.mjs","line":71,"fingerprint":"javascript.lang.security.html-in-template-string:lcu/update_apply.mjs:71"},{"rule_id":"opengrep/javascript.lang.security.insecure-object-assign","severity":"medium","message":"Depending on the context, user control data in `Object.assign` can cause web response to include data that it should not have or can lead to a mass assignment vulnerability. [confidence low]","path":"lcu/windows_host.mjs","line":161,"fingerprint":"javascript.lang.security.insecure-object-assign:lcu/windows_host.mjs:161"},{"rule_id":"opengrep/python.lang.security.audit.insecure-file-permissions","severity":"medium","message":"These permissions `0o755` are widely permissive and grant access to more people than may be necessary. A good default is `0o644` which gives read and write access to yourself and read access to everyone else. [confidence medium]","path":"scripts/build_bundle.py","line":92,"fingerprint":"python.lang.security.audit.insecure-file-permissions:scripts/build_bundle.py:92"},{"rule_id":"opengrep/python.lang.security.audit.dynamic-urllib-use-detected","severity":"medium","message":"Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. [confidence low]","path":"scripts/bundle.py","line":74,"fingerprint":"python.lang.security.audit.dynamic-urllib-use-detected:scripts/bundle.py:74"},{"rule_id":"opengrep/python.lang.security.audit.dynamic-urllib-use-detected","severity":"medium","message":"Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. [confidence low]","path":"scripts/provision_agent_tools.py","line":25,"fingerprint":"python.lang.security.audit.dynamic-urllib-use-detected:scripts/provision_agent_tools.py:25"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"adapters/codex.mjs","line":39,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:adapters/codex.mjs:39"}],"evidence":[],"data":{"rulesets":["javascript","typescript","python","bash","swift","dockerfile"]},"error":null},{"analyzer":"sec-deps","pillar":"security","status":"ok","tool_version":"osv-scanner version: 2.7.1","metrics":{"vulnerable_packages":8.0,"vulnerabilities":23.0,"vulns_critical":0.0,"vulns_high":6.0,"vulns_medium":14.0,"vulns_low":3.0,"vulns_unknown":0.0,"penalty":39.0},"findings":[{"rule_id":"osv/GHSA-22jm-h49p-29qw","severity":"high","message":"@modelcontextprotocol/sdk@1.30.0 (npm) is affected by GHSA-22jm-h49p-29qw","path":"adapters/package-lock.json","line":null,"fingerprint":"@modelcontextprotocol/sdk@1.30.0 (npm):GHSA-22jm-h49p-29qw"},{"rule_id":"osv/GHSA-46jr-4wx8-v453","severity":"high","message":"@modelcontextprotocol/sdk@1.30.0 (npm) is affected by GHSA-46jr-4wx8-v453","path":"adapters/package-lock.json","line":null,"fingerprint":"@modelcontextprotocol/sdk@1.30.0 (npm):GHSA-46jr-4wx8-v453"},{"rule_id":"osv/GHSA-6qxp-vccf-f47h","severity":"high","message":"@modelcontextprotocol/sdk@1.30.0 (npm) is affected by GHSA-6qxp-vccf-f47h","path":"adapters/package-lock.json","line":null,"fingerprint":"@modelcontextprotocol/sdk@1.30.0 (npm):GHSA-6qxp-vccf-f47h"},{"rule_id":"osv/GHSA-f897-62hf-6gxq","severity":"high","message":"@modelcontextprotocol/sdk@1.30.0 (npm) is affected by GHSA-f897-62hf-6gxq","path":"adapters/package-lock.json","line":null,"fingerprint":"@modelcontextprotocol/sdk@1.30.0 (npm):GHSA-f897-62hf-6gxq"},{"rule_id":"osv/GHSA-27r3-jxmh-p828","severity":"high","message":"body-parser@2.3.0 (npm) is affected by GHSA-27r3-jxmh-p828","path":"adapters/package-lock.json","line":null,"fingerprint":"body-parser@2.3.0 (npm):GHSA-27r3-jxmh-p828"},{"rule_id":"osv/GHSA-mrhx-c7xc-m3w5","severity":"high","message":"zod@4.6.5 (npm) is affected by GHSA-mrhx-c7xc-m3w5","path":"adapters/package-lock.json","line":null,"fingerprint":"zod@4.6.5 (npm):GHSA-mrhx-c7xc-m3w5"},{"rule_id":"osv/GHSA-jpvv-r467-5p4w","severity":"medium","message":"@hono/node-server@2.1.1 (npm) is affected by GHSA-jpvv-r467-5p4w","path":"adapters/package-lock.json","line":null,"fingerprint":"@hono/node-server@2.1.1 (npm):GHSA-jpvv-r467-5p4w"},{"rule_id":"osv/GHSA-qv5m-9pm6-hqp3","severity":"medium","message":"@hono/node-server@2.1.1 (npm) is affected by GHSA-qv5m-9pm6-hqp3","path":"adapters/package-lock.json","line":null,"fingerprint":"@hono/node-server@2.1.1 (npm):GHSA-qv5m-9pm6-hqp3"},{"rule_id":"osv/GHSA-rmxm-3fg6-px4f","severity":"medium","message":"@hono/node-server@2.1.1 (npm) is affected by GHSA-rmxm-3fg6-px4f","path":"adapters/package-lock.json","line":null,"fingerprint":"@hono/node-server@2.1.1 (npm):GHSA-rmxm-3fg6-px4f"},{"rule_id":"osv/GHSA-6prh-2h8m-c8cw","severity":"medium","message":"@modelcontextprotocol/sdk@1.30.0 (npm) is affected by GHSA-6prh-2h8m-c8cw","path":"adapters/package-lock.json","line":null,"fingerprint":"@modelcontextprotocol/sdk@1.30.0 (npm):GHSA-6prh-2h8m-c8cw"},{"rule_id":"osv/GHSA-rvq5-wwqv-78pq","severity":"medium","message":"@modelcontextprotocol/sdk@1.30.0 (npm) is affected by GHSA-rvq5-wwqv-78pq","path":"adapters/package-lock.json","line":null,"fingerprint":"@modelcontextprotocol/sdk@1.30.0 (npm):GHSA-rvq5-wwqv-78pq"},{"rule_id":"osv/GHSA-w74x-v6f9-j3xg","severity":"medium","message":"fast-uri@3.1.8 (npm) is affected by GHSA-w74x-v6f9-j3xg","path":"adapters/package-lock.json","line":null,"fingerprint":"fast-uri@3.1.8 (npm):GHSA-w74x-v6f9-j3xg"},{"rule_id":"osv/GHSA-wjr9-j795-jxcr","severity":"medium","message":"fast-uri@3.1.8 (npm) is affected by GHSA-wjr9-j795-jxcr","path":"adapters/package-lock.json","line":null,"fingerprint":"fast-uri@3.1.8 (npm):GHSA-wjr9-j795-jxcr"},{"rule_id":"osv/GHSA-46wx-v44x-9hh2","severity":"medium","message":"hono@4.13.8 (npm) is affected by GHSA-46wx-v44x-9hh2","path":"adapters/package-lock.json","line":null,"fingerprint":"hono@4.13.8 (npm):GHSA-46wx-v44x-9hh2"},{"rule_id":"osv/GHSA-4h7h-rv7c-7m2v","severity":"medium","message":"hono@4.13.8 (npm) is affected by GHSA-4h7h-rv7c-7m2v","path":"adapters/package-lock.json","line":null,"fingerprint":"hono@4.13.8 (npm):GHSA-4h7h-rv7c-7m2v"},{"rule_id":"osv/GHSA-4m76-xfj5-7975","severity":"medium","message":"hono@4.13.8 (npm) is affected by GHSA-4m76-xfj5-7975","path":"adapters/package-lock.json","line":null,"fingerprint":"hono@4.13.8 (npm):GHSA-4m76-xfj5-7975"},{"rule_id":"osv/GHSA-5r4p-p66f-jhc7","severity":"medium","message":"hono@4.13.8 (npm) is affected by GHSA-5r4p-p66f-jhc7","path":"adapters/package-lock.json","line":null,"fingerprint":"hono@4.13.8 (npm):GHSA-5r4p-p66f-jhc7"},{"rule_id":"osv/GHSA-h7mg-cq63-vhpq","severity":"medium","message":"hono@4.13.8 (npm) is affected by GHSA-h7mg-cq63-vhpq","path":"adapters/package-lock.json","line":null,"fingerprint":"hono@4.13.8 (npm):GHSA-h7mg-cq63-vhpq"},{"rule_id":"osv/GHSA-rxp7-6hxx-x8q5","severity":"medium","message":"ip-address@10.7.2 (npm) is affected by GHSA-rxp7-6hxx-x8q5","path":"adapters/package-lock.json","line":null,"fingerprint":"ip-address@10.7.2 (npm):GHSA-rxp7-6hxx-x8q5"},{"rule_id":"osv/GHSA-6pq8-jhm2-2vcw","severity":"medium","message":"qs@6.16.0 (npm) is affected by GHSA-6pq8-jhm2-2vcw","path":"adapters/package-lock.json","line":null,"fingerprint":"qs@6.16.0 (npm):GHSA-6pq8-jhm2-2vcw"},{"rule_id":"osv/GHSA-333x-w4r6-6crp","severity":"low","message":"fast-uri@3.1.8 (npm) is affected by GHSA-333x-w4r6-6crp","path":"adapters/package-lock.json","line":null,"fingerprint":"fast-uri@3.1.8 (npm):GHSA-333x-w4r6-6crp"},{"rule_id":"osv/GHSA-xhq7-xmqj-769h","severity":"low","message":"fast-uri@3.1.8 (npm) is affected by GHSA-xhq7-xmqj-769h","path":"adapters/package-lock.json","line":null,"fingerprint":"fast-uri@3.1.8 (npm):GHSA-xhq7-xmqj-769h"},{"rule_id":"osv/GHSA-3gg2-335m-rxc6","severity":"low","message":"hono@4.13.8 (npm) is affected by GHSA-3gg2-335m-rxc6","path":"adapters/package-lock.json","line":null,"fingerprint":"hono@4.13.8 (npm):GHSA-3gg2-335m-rxc6"}],"evidence":[],"data":{"ecosystems":["npm"]},"error":null},{"analyzer":"sec-actions","pillar":"security","status":"ok","tool_version":"zizmor 1.32.0","metrics":{"workflows":5.0,"findings":29.0,"findings_high":20.0,"findings_medium":8.0,"findings_low":1.0,"penalty":245.8},"findings":[{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":29,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:29"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":30,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:30"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":47,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:47"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":48,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:48"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":51,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:51"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":63,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:63"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":64,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:64"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":67,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:67"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":85,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:85"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":88,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:88"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":91,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:91"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":100,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:100"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":101,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:101"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":120,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:120"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":121,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:121"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":124,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:124"},{"rule_id":"zizmor/dangerous-triggers","severity":"high","message":"use of fundamentally insecure workflow trigger [confidence medium]","path":".github/workflows/claude.yml","line":4,"fingerprint":"dangerous-triggers:.github/workflows/claude.yml:4"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/claude.yml","line":29,"fingerprint":"unpinned-uses:.github/workflows/claude.yml:29"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/claude.yml","line":34,"fingerprint":"unpinned-uses:.github/workflows/claude.yml:34"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/linux-gate.yml","line":33,"fingerprint":"unpinned-uses:.github/workflows/linux-gate.yml:33"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/ci.yml","line":29,"fingerprint":"artipacked:.github/workflows/ci.yml:29"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/ci.yml","line":47,"fingerprint":"artipacked:.github/workflows/ci.yml:47"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/ci.yml","line":63,"fingerprint":"artipacked:.github/workflows/ci.yml:63"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/ci.yml","line":85,"fingerprint":"artipacked:.github/workflows/ci.yml:85"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/ci.yml","line":100,"fingerprint":"artipacked:.github/workflows/ci.yml:100"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/ci.yml","line":120,"fingerprint":"artipacked:.github/workflows/ci.yml:120"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/claude.yml","line":28,"fingerprint":"artipacked:.github/workflows/claude.yml:28"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/linux-gate.yml","line":33,"fingerprint":"artipacked:.github/workflows/linux-gate.yml:33"},{"rule_id":"zizmor/adhoc-packages","severity":"low","message":"ad-hoc installation of packages [confidence high]","path":".github/workflows/video-explainers.yml","line":98,"fingerprint":"adhoc-packages:.github/workflows/video-explainers.yml:98"}],"evidence":[],"data":{},"error":null},{"analyzer":"sec-posture","pillar":"security","status":"ok","tool_version":null,"metrics":{"check:security_policy":0.0,"check:dependency_updates":0.0,"check:signed_commits":1.0,"check:lockfiles":1.0,"signed_commit_share":1.0,"unpinned_manifests":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-distribution","pillar":"security","status":"ok","tool_version":null,"metrics":{"signals":3.0,"binary_assets":30.0,"suspicious":0.0},"findings":[],"evidence":[{"kind":"binary-release-asset","description":"release v0.13.6 ships lcu-0.13.6-darwin-arm64.tar.gz (207 downloads)","ref":"lcu-0.13.6-darwin-arm64.tar.gz","url":"https://github.com/amontlabs/lcu/releases/download/v0.13.6/lcu-0.13.6-darwin-arm64.tar.gz","weight":0.0},{"kind":"binary-release-asset","description":"release v0.13.6 ships lcu-0.13.6-linux-arm64.tar.gz (4 downloads)","ref":"lcu-0.13.6-linux-arm64.tar.gz","url":"https://github.com/amontlabs/lcu/releases/download/v0.13.6/lcu-0.13.6-linux-arm64.tar.gz","weight":0.0},{"kind":"binary-release-asset","description":"release v0.13.6 ships lcu-0.13.6-linux-x64.tar.gz (10 downloads)","ref":"lcu-0.13.6-linux-x64.tar.gz","url":"https://github.com/amontlabs/lcu/releases/download/v0.13.6/lcu-0.13.6-linux-x64.tar.gz","weight":0.0},{"kind":"binary-release-asset","description":"release v0.13.5 ships lcu-0.13.5-darwin-arm64.tar.gz (562 downloads)","ref":"lcu-0.13.5-darwin-arm64.tar.gz","url":"https://github.com/amontlabs/lcu/releases/download/v0.13.5/lcu-0.13.5-darwin-arm64.tar.gz","weight":0.0},{"kind":"binary-release-asset","description":"release v0.13.5 ships lcu-0.13.5-linux-arm64.tar.gz (4 downloads)","ref":"lcu-0.13.5-linux-arm64.tar.gz","url":"https://github.com/amontlabs/lcu/releases/download/v0.13.5/lcu-0.13.5-linux-arm64.tar.gz","weight":0.0},{"kind":"star-burst","description":"2422 stars in 52 days (46/day)","ref":null,"url":null,"weight":0.0},{"kind":"new-owner","description":"owner account is 41 days old with 2422 stars on this repo","ref":null,"url":null,"weight":0.0}],"data":{"signals":["binary-release-assets","star-burst","new-owner"],"suspicious":false,"unusual_traction":true,"metadata":true},"error":null},{"analyzer":"qual-complexity","pillar":"quality","status":"ok","tool_version":"lizard 1.25.1","metrics":{"functions":2082.0,"function_nloc":16052.0,"mean_ccn":3.92,"p90_ccn":10.0,"complex_functions":73.0,"long_functions":5.0,"many_param_functions":0.0,"risky_nloc_share":0.2366},"findings":[],"evidence":[{"kind":"complex-function","description":"registerLocked in lcu/setup.mjs: complexity 93, 143 lines","ref":"lcu/setup.mjs","url":"https://github.com/amontlabs/lcu/blob/c8e5693d7141c60ef42294c03b2eee2d88557a49/lcu/setup.mjs#L1127","weight":1.0},{"kind":"complex-function","description":"validate in lcu/setup.mjs: complexity 56, 65 lines","ref":"lcu/setup.mjs","url":"https://github.com/amontlabs/lcu/blob/c8e5693d7141c60ef42294c03b2eee2d88557a49/lcu/setup.mjs#L827","weight":0.9333333333333333},{"kind":"complex-function","description":"recoverStaleService in lcu/macos_host.mjs: complexity 55, 78 lines","ref":"lcu/macos_host.mjs","url":"https://github.com/amontlabs/lcu/blob/c8e5693d7141c60ef42294c03b2eee2d88557a49/lcu/macos_host.mjs#L379","weight":0.9166666666666666},{"kind":"complex-function","description":"pickTarget in adapters/pi/index.ts: complexity 53, 206 lines","ref":"adapters/pi/index.ts","url":"https://github.com/amontlabs/lcu/blob/c8e5693d7141c60ef42294c03b2eee2d88557a49/adapters/pi/index.ts#L413","weight":0.8833333333333333},{"kind":"complex-function","description":"hostModule in lcu/windows_host_analyze.cjs: complexity 52, 103 lines","ref":"lcu/windows_host_analyze.cjs","url":"https://github.com/amontlabs/lcu/blob/c8e5693d7141c60ef42294c03b2eee2d88557a49/lcu/windows_host_analyze.cjs#L534","weight":0.8666666666666667},{"kind":"complex-function","description":"main in scripts/install.mjs: complexity 52, 90 lines","ref":"scripts/install.mjs","url":"https://github.com/amontlabs/lcu/blob/c8e5693d7141c60ef42294c03b2eee2d88557a49/scripts/install.mjs#L211","weight":0.8666666666666667},{"kind":"complex-function","description":"configure in lcu/setup.mjs: complexity 47, 114 lines","ref":"lcu/setup.mjs","url":"https://github.com/amontlabs/lcu/blob/c8e5693d7141c60ef42294c03b2eee2d88557a49/lcu/setup.mjs#L513","weight":0.7833333333333333},{"kind":"complex-function","description":"environment in lcu/runtime.mjs: complexity 43, 57 lines","ref":"lcu/runtime.mjs","url":"https://github.com/amontlabs/lcu/blob/c8e5693d7141c60ef42294c03b2eee2d88557a49/lcu/runtime.mjs#L192","weight":0.7166666666666667},{"kind":"complex-function","description":"_present_elicitation in adapters/hermes/__init__.py: complexity 40, 63 lines","ref":"adapters/hermes/__init__.py","url":"https://github.com/amontlabs/lcu/blob/c8e5693d7141c60ef42294c03b2eee2d88557a49/adapters/hermes/__init__.py#L221","weight":0.6666666666666666},{"kind":"complex-function","description":"main in lcu/runtime.mjs: complexity 39, 72 lines","ref":"lcu/runtime.mjs","url":"https://github.com/amontlabs/lcu/blob/c8e5693d7141c60ef42294c03b2eee2d88557a49/lcu/runtime.mjs#L476","weight":0.65}],"data":{},"error":null},{"analyzer":"qual-duplication","pillar":"quality","status":"ok","tool_version":"repotrust-dup-w6","metrics":{"compared_lines":15811.0,"duplicated_lines":147.0,"duplicated_share":0.0093,"files":78.0},"findings":[],"evidence":[{"kind":"duplicate-code","description":"6+ duplicated lines: adapters/claude.mjs:10 and adapters/codex.mjs:11","ref":"adapters/claude.mjs","url":"https://github.com/amontlabs/lcu/blob/c8e5693d7141c60ef42294c03b2eee2d88557a49/adapters/claude.mjs#L10","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: adapters/claude.mjs:503 and adapters/client.mjs:839","ref":"adapters/claude.mjs","url":"https://github.com/amontlabs/lcu/blob/c8e5693d7141c60ef42294c03b2eee2d88557a49/adapters/claude.mjs#L503","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: adapters/client.mjs:585 and adapters/pi/index.ts:113","ref":"adapters/client.mjs","url":"https://github.com/amontlabs/lcu/blob/c8e5693d7141c60ef42294c03b2eee2d88557a49/adapters/client.mjs#L585","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: adapters/dsh/plugin.mjs:23 and adapters/pi/index.ts:36","ref":"adapters/dsh/plugin.mjs","url":"https://github.com/amontlabs/lcu/blob/c8e5693d7141c60ef42294c03b2eee2d88557a49/adapters/dsh/plugin.mjs#L23","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: adapters/dsh/plugin.mjs:123 and adapters/junie.mjs:122","ref":"adapters/dsh/plugin.mjs","url":"https://github.com/amontlabs/lcu/blob/c8e5693d7141c60ef42294c03b2eee2d88557a49/adapters/dsh/plugin.mjs#L123","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: lcu/macos_sky_service.mjs:59 and lcu/windows_sky_service.mjs:18","ref":"lcu/macos_sky_service.mjs","url":"https://github.com/amontlabs/lcu/blob/c8e5693d7141c60ef42294c03b2eee2d88557a49/lcu/macos_sky_service.mjs#L59","weight":0.3}],"data":{},"error":null},{"analyzer":"qual-lint","pillar":"quality","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":68.0,"weighted_findings":33.25,"scanned_lines":20139.0,"category:correctness":67.0,"category:maintainability":1.0},"findings":[{"rule_id":"opengrep/python.lang.maintainability.useless-inner-function","severity":"high","message":"function `admit_turn` is defined inside a function but never used","path":"adapters/hermes/__init__.py","line":366,"fingerprint":"python.lang.maintainability.useless-inner-function:adapters/hermes/__init__.py:366"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"adapters/pi/index.ts","line":594,"fingerprint":"javascript.lang.correctness.no-stringify-keys:adapters/pi/index.ts:594"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"lcu/apps.mjs","line":123,"fingerprint":"javascript.lang.correctness.no-replaceall:lcu/apps.mjs:123"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"lcu/apps.mjs","line":123,"fingerprint":"javascript.lang.correctness.no-replaceall:lcu/apps.mjs:123"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"lcu/browser.mjs","line":192,"fingerprint":"javascript.lang.correctness.no-replaceall:lcu/browser.mjs:192"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"lcu/check_record.mjs","line":31,"fingerprint":"javascript.lang.correctness.no-stringify-keys:lcu/check_record.mjs:31"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"lcu/claude_lifecycle.mjs","line":104,"fingerprint":"javascript.lang.correctness.no-stringify-keys:lcu/claude_lifecycle.mjs:104"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"lcu/doctor.mjs","line":117,"fingerprint":"javascript.lang.correctness.no-replaceall:lcu/doctor.mjs:117"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"lcu/fsutil.mjs","line":23,"fingerprint":"javascript.lang.correctness.no-replaceall:lcu/fsutil.mjs:23"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"lcu/harness_setup.mjs","line":71,"fingerprint":"javascript.lang.correctness.no-replaceall:lcu/harness_setup.mjs:71"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"lcu/origins.mjs","line":210,"fingerprint":"javascript.lang.correctness.no-replaceall:lcu/origins.mjs:210"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"lcu/platforms.mjs","line":178,"fingerprint":"javascript.lang.correctness.no-replaceall:lcu/platforms.mjs:178"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"lcu/runtime.mjs","line":184,"fingerprint":"javascript.lang.correctness.no-stringify-keys:lcu/runtime.mjs:184"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"lcu/toml.mjs","line":163,"fingerprint":"javascript.lang.correctness.no-replaceall:lcu/toml.mjs:163"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"lcu/update_apply.mjs","line":231,"fingerprint":"javascript.lang.correctness.no-replaceall:lcu/update_apply.mjs:231"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"lcu/windows_host.mjs","line":58,"fingerprint":"javascript.lang.correctness.no-stringify-keys:lcu/windows_host.mjs:58"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"scripts/install.mjs","line":131,"fingerprint":"javascript.lang.correctness.no-replaceall:scripts/install.mjs:131"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"scripts/install_windows.mjs","line":38,"fingerprint":"javascript.lang.correctness.no-replaceall:scripts/install_windows.mjs:38"},{"rule_id":"opengrep/python.lang.correctness.unchecked-subprocess-call","severity":"medium","message":"This is not checking the return value of this subprocess call; if it fails no exception will be raised. Consider subprocess.check_call() instead","path":"scripts/install_windows.py","line":8,"fingerprint":"python.lang.correctness.unchecked-subprocess-call:scripts/install_windows.py:8"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"adapters/claude-plugin/scripts/ensure-lcu.sh","line":104,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:adapters/claude-plugin/scripts/ensure-lcu.sh:104"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"adapters/diagnostics.mjs","line":101,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:adapters/diagnostics.mjs:101"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"adapters/diagnostics.mjs","line":101,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:adapters/diagnostics.mjs:101"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"adapters/hermes/bridge.mjs","line":14,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:adapters/hermes/bridge.mjs:14"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"adapters/hermes/bridge.mjs","line":14,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:adapters/hermes/bridge.mjs:14"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"adapters/hermes/bridge.mjs","line":83,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:adapters/hermes/bridge.mjs:83"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"adapters/hermes/bridge.mjs","line":83,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:adapters/hermes/bridge.mjs:83"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"adapters/hermes/bridge.mjs","line":85,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:adapters/hermes/bridge.mjs:85"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"adapters/hermes/bridge.mjs","line":85,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:adapters/hermes/bridge.mjs:85"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"adapters/pi/index.ts","line":464,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:adapters/pi/index.ts:464"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"adapters/pi/index.ts","line":464,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:adapters/pi/index.ts:464"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"adapters/pi/index.ts","line":474,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:adapters/pi/index.ts:474"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"adapters/pi/index.ts","line":513,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:adapters/pi/index.ts:513"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"adapters/pi/index.ts","line":513,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:adapters/pi/index.ts:513"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"adapters/pi/index.ts","line":554,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:adapters/pi/index.ts:554"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"adapters/pi/index.ts","line":564,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:adapters/pi/index.ts:564"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"adapters/pi/index.ts","line":567,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:adapters/pi/index.ts:567"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"lcu/apps.mjs","line":78,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:lcu/apps.mjs:78"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"lcu/apps.mjs","line":78,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:lcu/apps.mjs:78"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"lcu/cross_turn.mjs","line":47,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:lcu/cross_turn.mjs:47"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"lcu/cross_turn.mjs","line":47,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:lcu/cross_turn.mjs:47"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"lcu/doctor.mjs","line":371,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:lcu/doctor.mjs:371"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"lcu/doctor.mjs","line":371,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:lcu/doctor.mjs:371"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"lcu/doctor.mjs","line":371,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:lcu/doctor.mjs:371"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"lcu/harness_setup.mjs","line":192,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:lcu/harness_setup.mjs:192"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"lcu/harness_setup.mjs","line":192,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:lcu/harness_setup.mjs:192"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"lcu/runtime.mjs","line":406,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:lcu/runtime.mjs:406"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"lcu/runtime.mjs","line":406,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:lcu/runtime.mjs:406"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"lcu/runtime.mjs","line":406,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:lcu/runtime.mjs:406"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"lcu/setup.mjs","line":530,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:lcu/setup.mjs:530"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"lcu/setup.mjs","line":530,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:lcu/setup.mjs:530"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"lcu/setup.mjs","line":633,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:lcu/setup.mjs:633"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"lcu/setup.mjs","line":633,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:lcu/setup.mjs:633"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"lcu/update.mjs","line":473,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:lcu/update.mjs:473"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"lcu/update.mjs","line":473,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:lcu/update.mjs:473"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"lcu/update.mjs","line":478,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:lcu/update.mjs:478"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"lcu/update.mjs","line":478,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:lcu/update.mjs:478"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"lcu/update.mjs","line":478,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:lcu/update.mjs:478"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"lcu/update.mjs","line":500,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:lcu/update.mjs:500"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"lcu/update.mjs","line":500,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:lcu/update.mjs:500"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"lcu/windows_host.mjs","line":29,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:lcu/windows_host.mjs:29"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"lcu/windows_host.mjs","line":29,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:lcu/windows_host.mjs:29"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/install.mjs","line":138,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/install.mjs:138"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/install.mjs","line":138,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/install.mjs:138"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-command-substitution-in-command","severity":"low","message":"The result of command substitution $(...) or `...`, if unquoted, is split on whitespace or other separators specified by the IFS variable. You should surround it with double quotes to avoid splitting the result.","path":"scripts/install.sh","line":56,"fingerprint":"bash.lang.correctness.unquoted-command-substitution-in-command:scripts/install.sh:56"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/install_windows.mjs","line":259,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/install_windows.mjs:259"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/install_windows.mjs","line":259,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/install_windows.mjs:259"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/install_windows.mjs","line":276,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/install_windows.mjs:276"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/install_windows.mjs","line":276,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/install_windows.mjs:276"}],"evidence":[],"data":{},"error":null},{"analyzer":"qual-testing","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:has_tests":1.0,"check:test_ratio":1.0,"check:ci_present":1.0,"check:ci_runs_tests":1.0,"check:ci_runs_lint":1.0,"check:tests_cochange":1.0,"test_lines":34393.0,"source_lines":20200.0,"test_ratio":1.7026,"ci_files":5.0,"cochange_share":0.7394,"cochange_commits":165.0},"findings":[],"evidence":[{"kind":"ci","description":"CI config: .github/workflows/ci.yml","ref":".github/workflows/ci.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI config: .github/workflows/claude.yml","ref":".github/workflows/claude.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI config: .github/workflows/linux-gate.yml","ref":".github/workflows/linux-gate.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI config: .github/workflows/notify-site.yml","ref":".github/workflows/notify-site.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI config: .github/workflows/video-explainers.yml","ref":".github/workflows/video-explainers.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI runs tests (npm test, unittest)","ref":null,"url":null,"weight":0.0},{"kind":"ci","description":"CI runs linters (ruff, shellcheck)","ref":null,"url":null,"weight":0.0}],"data":{"test_commands":["npm test","unittest"],"lint_commands":["ruff","shellcheck"]},"error":null},{"analyzer":"qual-docs","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:readme":1.0,"check:license":1.0,"check:contributing":0.0,"check:changelog":0.0,"readme_lines":97.0},"findings":[],"evidence":[{"kind":"docs","description":"README.md","ref":"README.md","url":null,"weight":0.0},{"kind":"docs","description":"LICENSE","ref":"LICENSE","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"qual-type-safety","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:strict_config":0.0,"check:low_escape_density":0.0,"escapes":50.0,"escapes_per_kloc":17.206},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"x-blame","pillar":"ai_provenance","status":"ok","tool_version":"git-blame","metrics":{"ai_lines":11592.0,"other_lines":8608.0,"files_blamed":78.0,"blame_failures":0.0,"quality:ai_findings":36.0,"quality:ai_per_kloc":3.106,"quality:other_findings":32.0,"quality:other_per_kloc":3.717,"quality:ratio":0.84,"security:ai_findings":8.0,"security:ai_per_kloc":0.69,"security:other_findings":18.0,"security:other_per_kloc":2.091,"security:ratio":0.33},"findings":[],"evidence":[],"data":{"sampled":false,"comparable":true},"error":null}],"flags":["unusual-traction"]}