{"schema_version":"2","scorer_version":"0.1.0","scoring_version":"prov-4+qual-2+sec-2","generated_at":"2026-11-14T00:05:06.874912Z","repo":{"ref":{"host":"github.com","owner":"cytostack","name":"openwolf"},"default_branch":"main","clone_url":"https://github.com/cytostack/openwolf.git","html_url":"https://github.com/cytostack/openwolf","description":"Portable project memory across Claude Code, Codex and OpenCode, plus token accounting measured from harness transcripts. Local file I/O, no API calls, no telemetry.","stars":2397,"forks":213,"is_fork":false,"is_archived":false,"is_private":false,"size_kb":11232,"primary_language":"TypeScript","license_spdx":"AGPL-3.0","created_at":"2026-03-15T18:16:35Z","pushed_at":"2026-10-19T19:40:55Z","security_policy_url":null,"distribution":{"owner_created_at":"2026-03-15T16:34:29Z","owner_type":"User","release_assets":[{"name":"openwolf-2.5.3.tgz","size":645215,"download_count":9,"release_tag":"v2.5.3","url":"https://github.com/cytostack/openwolf/releases/download/v2.5.3/openwolf-2.5.3.tgz"},{"name":"openwolf-2.5.2.tgz","size":679811,"download_count":12,"release_tag":"v2.5.2","url":"https://github.com/cytostack/openwolf/releases/download/v2.5.2/openwolf-2.5.2.tgz"}]}},"commit_sha":"8568f41aa8a985a496314c3ea313ff1ee2b66483","profile":{"lines_by_language":{"TypeScript":31583,"JavaScript":370,"Vue":151,"Python":69},"files_by_category":{"source":182,"docs":47,"test":40,"config":20,"other":6,"binary":3,"generated":2,"oversized":1},"source_lines":26940,"test_lines":5233},"pillars":{"ai_provenance":{"score":25.2,"confidence":0.95,"coverage":1.0,"label":"explicit","breakdown":{"attributed_share":0.2517,"suspected_share":0.2034,"estimated_share":0.2517,"ai_artifacts":0.0,"flagged_work_units":5.0,"flagged_releases":0.0},"summary":"Explicit AI attribution on 25% of first-party code added; an estimated 25% including velocity signals."},"quality":{"score":62.9,"confidence":0.9,"coverage":1.0,"label":"weak","breakdown":{"complexity":36.2,"duplication":13.1,"lint":91.6,"testing":74.7,"docs":100.0,"type_safety":99.8,"process":null},"summary":"Code quality is weak: test-to-source ratio 0.19, CI runs tests; 34% of function code in complex or long functions; 34% duplicated lines. Weakest area: duplication."},"security":{"score":65.4,"confidence":0.85,"coverage":1.0,"label":"weak","breakdown":{"secrets":100.0,"sast":95.5,"dependencies":11.1,"ci_actions":83.5,"posture":0.0,"scorecard":null},"summary":"Security posture is weak: 45 known vulnerabilities in 19 dependencies; 2 high-severity workflow issues. Weakest area: posture."}},"analyzer_results":[{"analyzer":"sec-scorecard","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no published OpenSSF Scorecard result for this repo"},{"analyzer":"sec-registry","pillar":"security","status":"ok","tool_version":null,"metrics":{"declared":27.0,"checked":27.0,"missing":0.0,"recent":0.0,"lookup_errors":0.0},"findings":[],"evidence":[],"data":{"phantom":false},"error":null},{"analyzer":"ai-attribution","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"commits":128.0,"attributed_commits":40.0,"attributed_commit_share":0.3125,"effective_loc":38555.0,"attributed_loc":9704.0,"attributed_loc_share":0.25169238749837897,"tools_detected":1.0},"findings":[],"evidence":[{"kind":"attribution-summary","description":"Claude Code: 40 attributed commits, 9,704 lines added","ref":null,"url":null,"weight":1.0},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"12c21b593b316bd97d91a7fb16a031fd92035009","url":"https://github.com/cytostack/openwolf/commit/12c21b593b316bd97d91a7fb16a031fd92035009","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"4b06864d023f7cacd15fccb4fec69fe9dea5f51c","url":"https://github.com/cytostack/openwolf/commit/4b06864d023f7cacd15fccb4fec69fe9dea5f51c","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"16d63bb99cbdb8a30af2310691b584c98d51334a","url":"https://github.com/cytostack/openwolf/commit/16d63bb99cbdb8a30af2310691b584c98d51334a","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"9c8fba46f674007726e48df2155b3dca17080074","url":"https://github.com/cytostack/openwolf/commit/9c8fba46f674007726e48df2155b3dca17080074","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"c8acf0a0338439dd8b4f691c576be2b49787e4d5","url":"https://github.com/cytostack/openwolf/commit/c8acf0a0338439dd8b4f691c576be2b49787e4d5","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"97c68003e274087d9fa73e2a470c42dc5c02e3d6","url":"https://github.com/cytostack/openwolf/commit/97c68003e274087d9fa73e2a470c42dc5c02e3d6","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"b925a011fbb80cf207878f7f02f85155b580e660","url":"https://github.com/cytostack/openwolf/commit/b925a011fbb80cf207878f7f02f85155b580e660","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"610c744167aca9d313a97a4c0bcbabc4efb90c55","url":"https://github.com/cytostack/openwolf/commit/610c744167aca9d313a97a4c0bcbabc4efb90c55","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"7defd81b9faacea0134965e539118efb2a890cba","url":"https://github.com/cytostack/openwolf/commit/7defd81b9faacea0134965e539118efb2a890cba","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"8c8d769782ea8260e8668e2afb55fe636dfafe14","url":"https://github.com/cytostack/openwolf/commit/8c8d769782ea8260e8668e2afb55fe636dfafe14","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"bba4e682baba751cee9ea99134cc3cecc6a7f09e","url":"https://github.com/cytostack/openwolf/commit/bba4e682baba751cee9ea99134cc3cecc6a7f09e","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"1903334e667b05c12c49d085251d7ccec85e4990","url":"https://github.com/cytostack/openwolf/commit/1903334e667b05c12c49d085251d7ccec85e4990","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"fb95439b0a78f01498ed4dfb75269715af62838e","url":"https://github.com/cytostack/openwolf/commit/fb95439b0a78f01498ed4dfb75269715af62838e","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"20e06721bc1150760b1ecb5b9271546076c5c916","url":"https://github.com/cytostack/openwolf/commit/20e06721bc1150760b1ecb5b9271546076c5c916","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"7769e5ed55bf02ebb84c16e70bea427282a4236f","url":"https://github.com/cytostack/openwolf/commit/7769e5ed55bf02ebb84c16e70bea427282a4236f","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"67cab8a55a110a293b046e84c311822ba4c03efd","url":"https://github.com/cytostack/openwolf/commit/67cab8a55a110a293b046e84c311822ba4c03efd","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"ab816020847f302a7b63dcf876428c42b26bdc8b","url":"https://github.com/cytostack/openwolf/commit/ab816020847f302a7b63dcf876428c42b26bdc8b","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"999fd47b38ef036129f53b37b5a3d6347dbf0cb6","url":"https://github.com/cytostack/openwolf/commit/999fd47b38ef036129f53b37b5a3d6347dbf0cb6","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"f8141698d3468682c4c79a8307894d88398169a9","url":"https://github.com/cytostack/openwolf/commit/f8141698d3468682c4c79a8307894d88398169a9","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"d5b389c6df77c389651dbacb9cca78e81c903c42","url":"https://github.com/cytostack/openwolf/commit/d5b389c6df77c389651dbacb9cca78e81c903c42","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"514da57a798de7d735930842cbe9c7ca8a89a270","url":"https://github.com/cytostack/openwolf/commit/514da57a798de7d735930842cbe9c7ca8a89a270","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"c64179647313f927f03777be94400d22b2126148","url":"https://github.com/cytostack/openwolf/commit/c64179647313f927f03777be94400d22b2126148","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"6eafe8629f2547ca487ae0f77b02e0c25ee4bc06","url":"https://github.com/cytostack/openwolf/commit/6eafe8629f2547ca487ae0f77b02e0c25ee4bc06","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"82b1040b2c4788286729a71de27a09d8c065422d","url":"https://github.com/cytostack/openwolf/commit/82b1040b2c4788286729a71de27a09d8c065422d","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"69cd41c05364e6e8ea2219bc8c6cfff67a0ebba9","url":"https://github.com/cytostack/openwolf/commit/69cd41c05364e6e8ea2219bc8c6cfff67a0ebba9","weight":0.9}],"data":{"attributed_loc_by_commit":{"f68be488147076e57cf80a9394613b5cdab916e0":1,"ccc3431f7cf7d19fb37ad57aae11d7f213b496b3":6,"d727c69cd642b3f498a9d73b27e1315d14285c74":40,"c0c23761017de055f0a6e1bbe69f0b3da90ee3b1":163,"3371da337696fb019df2c48a5f756ed1a5a2f6ee":30,"edba1544d9b83563ee73f995908668f977989fce":14,"d9691eaf15bb875332142d8c56f6b85d8b23049c":70,"866570ca9a15f9f3277ccdc11258af5b8fb3a6a0":14,"e1fe28974ef31268f20c9c39be70362662940ab3":5,"c9e421cf217b9adbd301d4a74a936404d85b9050":33,"d2c687163959aed96fb5ef0166db00787434d33f":0,"67d48338045c72c7afb34a9cb300ed8d13b0fdcd":0,"24d6814f13af63fff5d79c8c904762e0c0e4599b":302,"2af988ac32c98debee65032e7043c8c7e86c4f5c":0,"9977ca654acfdad8e21ef81cca52c4fd1fbb1618":123,"69cd41c05364e6e8ea2219bc8c6cfff67a0ebba9":42,"82b1040b2c4788286729a71de27a09d8c065422d":219,"6eafe8629f2547ca487ae0f77b02e0c25ee4bc06":329,"c64179647313f927f03777be94400d22b2126148":93,"514da57a798de7d735930842cbe9c7ca8a89a270":15,"d5b389c6df77c389651dbacb9cca78e81c903c42":172,"f8141698d3468682c4c79a8307894d88398169a9":18,"999fd47b38ef036129f53b37b5a3d6347dbf0cb6":1047,"ab816020847f302a7b63dcf876428c42b26bdc8b":14,"67cab8a55a110a293b046e84c311822ba4c03efd":0,"7769e5ed55bf02ebb84c16e70bea427282a4236f":0,"20e06721bc1150760b1ecb5b9271546076c5c916":451,"fb95439b0a78f01498ed4dfb75269715af62838e":605,"1903334e667b05c12c49d085251d7ccec85e4990":639,"bba4e682baba751cee9ea99134cc3cecc6a7f09e":778,"8c8d769782ea8260e8668e2afb55fe636dfafe14":259,"7defd81b9faacea0134965e539118efb2a890cba":0,"610c744167aca9d313a97a4c0bcbabc4efb90c55":1079,"b925a011fbb80cf207878f7f02f85155b580e660":717,"97c68003e274087d9fa73e2a470c42dc5c02e3d6":1240,"c8acf0a0338439dd8b4f691c576be2b49787e4d5":7,"9c8fba46f674007726e48df2155b3dca17080074":56,"16d63bb99cbdb8a30af2310691b584c98d51334a":0,"4b06864d023f7cacd15fccb4fec69fe9dea5f51c":1035,"12c21b593b316bd97d91a7fb16a031fd92035009":88},"tools":{"claude-code":{"name":"Claude Code","commits":40,"loc":9704,"first_seen":1775500487,"last_seen":1787349478}},"monthly":{"2026-03":{"loc":10453,"attributed_loc":0},"2026-04":{"loc":210,"attributed_loc":210},"2026-05":{"loc":171,"attributed_loc":114},"2026-06":{"loc":76,"attributed_loc":14},"2026-07":{"loc":4549,"attributed_loc":38},"2026-08":{"loc":12078,"attributed_loc":9328},"2026-09":{"loc":4560,"attributed_loc":0},"2026-10":{"loc":6458,"attributed_loc":0}}},"error":null},{"analyzer":"ai-artifacts","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"artifacts":0.0,"workflow_agents":0.0,"tools_configured":0.0},"findings":[],"evidence":[],"data":{"artifacts":[],"workflows":[],"tools":[]},"error":null},{"analyzer":"ai-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"work_units":38.0,"flagged_units":5.0,"pre_ai_era_bursts":0.0,"pre_ai_era_measured_loc":0.0,"pre_ai_era_burst_loc":0.0,"measured_loc":25677.0,"flagged_loc":11813.0,"flagged_loc_share":0.4600615336682634,"max_loc_per_hour":2314.775679889139,"median_loc_per_hour":227.25,"pr_timed_units":0.0,"excluded_import_loc":12878.0},"findings":[],"evidence":[{"kind":"velocity-burst","description":"3,712 lines of first-party code in ~1.6h (2,315 lines/hour, 4 commit session)","ref":"d5433a33828ea3e7fa80f9e643f038752bba3262","url":"https://github.com/cytostack/openwolf/commit/d5433a33828ea3e7fa80f9e643f038752bba3262","weight":0.6},{"kind":"velocity-burst","description":"1,240 lines of first-party code in ~0.8h (1,504 lines/hour, 1 commit session)","ref":"97c68003e274087d9fa73e2a470c42dc5c02e3d6","url":"https://github.com/cytostack/openwolf/commit/97c68003e274087d9fa73e2a470c42dc5c02e3d6","weight":0.45106096328730205},{"kind":"velocity-burst","description":"1,379 lines of first-party code in ~1.0h (1,376 lines/hour, 3 commit session)","ref":"7e7335ac5dabd952bffd0e6ecaca35d3b091fdcc","url":"https://github.com/cytostack/openwolf/commit/7e7335ac5dabd952bffd0e6ecaca35d3b091fdcc","weight":0.41278270509977827},{"kind":"velocity-burst","description":"2,750 lines of first-party code in ~4.0h (686 lines/hour, 2 commit session)","ref":"a7625af4df494cafc00c197bff26fa3af4d0f649","url":"https://github.com/cytostack/openwolf/commit/a7625af4df494cafc00c197bff26fa3af4d0f649","weight":0.20590682196339433},{"kind":"velocity-burst","description":"2,732 lines of first-party code in ~4.7h (579 lines/hour, 5 commit session)","ref":"8c8d769782ea8260e8668e2afb55fe636dfafe14","url":"https://github.com/cytostack/openwolf/commit/8c8d769782ea8260e8668e2afb55fe636dfafe14","weight":0.17362363187007182}],"data":{"flagged_loc_by_commit":{"5bb443b1ed0577e9e574ac584498f6082f3a6273":979,"20b594e5a0190ad104af64a6fd3b0c3d8f838979":352,"7e7335ac5dabd952bffd0e6ecaca35d3b091fdcc":48,"20e06721bc1150760b1ecb5b9271546076c5c916":451,"fb95439b0a78f01498ed4dfb75269715af62838e":605,"1903334e667b05c12c49d085251d7ccec85e4990":639,"bba4e682baba751cee9ea99134cc3cecc6a7f09e":778,"8c8d769782ea8260e8668e2afb55fe636dfafe14":259,"97c68003e274087d9fa73e2a470c42dc5c02e3d6":1240,"84c9d983d6963a8994eeaa7d3ca424bd93967f03":2745,"a7625af4df494cafc00c197bff26fa3af4d0f649":5,"32e868b957103ffbe06516f469273e8f4f58305e":3581,"6aa81224e642cb17780b76af561add319d1febf5":15,"41bc880aeb91cea46286dd177bbdbfa4cff3eff3":38,"d5433a33828ea3e7fa80f9e643f038752bba3262":78},"excluded_import_commits":["30c4aec933e32e6910b78fcff7588e3b31d320ec","a404530eb0b6222c9c2c4a848635124616eb2d7e"]},"error":null},{"analyzer":"ai-release-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"releases":12.0,"flagged_releases":0.0,"max_loc_per_day":54744.0},"findings":[],"evidence":[],"data":{"releases":[{"from":"v2.0.0","to":"v2.0.1","loc":140,"days":0.17,"loc_per_day":833.2,"flagged":false},{"from":"v2.0.1","to":"v2.0.4","loc":2413,"days":34.7,"loc_per_day":69.5,"flagged":false},{"from":"v2.0.4","to":"v2.0.5","loc":451,"days":1.11,"loc_per_day":407.8,"flagged":false},{"from":"v2.0.5","to":"v2.1.0","loc":2281,"days":0.04,"loc_per_day":54744.0,"flagged":false},{"from":"v2.1.0","to":"v2.2.0","loc":1079,"days":0.9,"loc_per_day":1204.8,"flagged":false},{"from":"v2.2.0","to":"v2.3.0","loc":717,"days":0.04,"loc_per_day":17208.0,"flagged":false},{"from":"v2.3.0","to":"v2.4.0","loc":1240,"days":0.04,"loc_per_day":29760.0,"flagged":false},{"from":"v2.4.0","to":"v2.4.1","loc":7,"days":0.08,"loc_per_day":85.1,"flagged":false},{"from":"v2.4.1","to":"v2.5.0","loc":1179,"days":1.09,"loc_per_day":1078.1,"flagged":false},{"from":"v2.5.0","to":"v2.5.1","loc":2750,"days":7.95,"loc_per_day":346.0,"flagged":false},{"from":"v2.5.1","to":"v2.5.2","loc":358,"days":16.79,"loc_per_day":21.3,"flagged":false},{"from":"v2.5.2","to":"v2.5.3","loc":6460,"days":34.16,"loc_per_day":189.1,"flagged":false}]},"error":null},{"analyzer":"ai-stylometry","pillar":"ai_provenance","status":"ok","tool_version":null,"metrics":{"lines_scanned":26940.0,"index":0.278,"count:narrated_steps":0.0,"per_kloc:narrated_steps":0.0,"files:narrated_steps":0.0,"count:placeholder":0.0,"per_kloc:placeholder":0.0,"files:placeholder":0.0,"count:emoji_in_code":15.0,"per_kloc:emoji_in_code":0.557,"files:emoji_in_code":9.0,"count:assistant_voice":0.0,"per_kloc:assistant_voice":0.0,"files:assistant_voice":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-secrets","pillar":"security","status":"ok","tool_version":"gitleaks 8.30.1","metrics":{"secrets_current":0.0,"secrets_history":0.0,"secrets_nonprod":0.0,"secrets_low_confidence":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-sast","pillar":"security","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":15.0,"findings_high":0.0,"findings_medium":14.0,"findings_low":1.0,"weighted_findings":3.562,"scanned_lines":26940.0,"parse_errors":5.0},"findings":[{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `body` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled [confidence low]","path":"src/hooks/ignore-runtime.ts","line":150,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:src/hooks/ignore-runtime.ts:150"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `mode` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled [confidence low]","path":"src/hooks/ignore-runtime.ts","line":1057,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:src/hooks/ignore-runtime.ts:1057"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `mode` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled [confidence low]","path":"src/hooks/ignore-runtime.ts","line":1058,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:src/hooks/ignore-runtime.ts:1058"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `id` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled i [confidence low]","path":"src/hooks/memory-archive.ts","line":84,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:src/hooks/memory-archive.ts:84"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/hooks/pre-read.ts","line":126,"fingerprint":"javascript.lang.security.html-in-template-string:src/hooks/pre-read.ts:126"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `glob` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled [confidence low]","path":"src/hooks/rule-reinjection.ts","line":56,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:src/hooks/rule-reinjection.ts:56"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-redos","severity":"medium","message":"Detected the use of a regular expression `^(?:#[^\\n]*\\n)*\\s*(?:\"\"\"(.+?)\"\"\"|'''(.+?)''')` which appears to be vulnerable to a Regular expression Denial-of-Service (ReDoS). For this reason, it is recommended to review the regex and ensure it is not vulnerable to catastrophic backtracking, and if possi [confidence low]","path":"src/hooks/shared.ts","line":332,"fingerprint":"javascript.lang.security.audit.detect-redos:src/hooks/shared.ts:332"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-redos","severity":"medium","message":"Detected the use of a regular expression `^(?:#[^\\n]*\\n)*\\s*(?:\"\"\"(.+?)\"\"\"|'''(.+?)''')` which appears to be vulnerable to a Regular expression Denial-of-Service (ReDoS). For this reason, it is recommended to review the regex and ensure it is not vulnerable to catastrophic backtracking, and if possi [confidence low]","path":"src/scanner/description-extractor.ts","line":209,"fingerprint":"javascript.lang.security.audit.detect-redos:src/scanner/description-extractor.ts:209"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `pattern` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-control [confidence low]","path":"src/scanner/exclusions.ts","line":88,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:src/scanner/exclusions.ts:88"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/templates/opencode-plugin/core.ts","line":361,"fingerprint":"javascript.lang.security.html-in-template-string:src/templates/opencode-plugin/core.ts:361"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `body` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled [confidence low]","path":"src/templates/opencode-plugin/ignore-runtime.ts","line":150,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:src/templates/opencode-plugin/ignore-runtime.ts:150"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `mode` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled [confidence low]","path":"src/templates/opencode-plugin/ignore-runtime.ts","line":1057,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:src/templates/opencode-plugin/ignore-runtime.ts:1057"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `mode` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled [confidence low]","path":"src/templates/opencode-plugin/ignore-runtime.ts","line":1058,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:src/templates/opencode-plugin/ignore-runtime.ts:1058"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-redos","severity":"medium","message":"Detected the use of a regular expression `^(?:#[^\\n]*\\n)*\\s*(?:\"\"\"(.+?)\"\"\"|'''(.+?)''')` which appears to be vulnerable to a Regular expression Denial-of-Service (ReDoS). For this reason, it is recommended to review the regex and ensure it is not vulnerable to catastrophic backtracking, and if possi [confidence low]","path":"src/templates/opencode-plugin/shared.ts","line":332,"fingerprint":"javascript.lang.security.audit.detect-redos:src/templates/opencode-plugin/shared.ts:332"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"src/dashboard/app/components/layout/ErrorBoundary.tsx","line":32,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:src/dashboard/app/components/layout/ErrorBoundary.tsx:32"}],"evidence":[],"data":{"rulesets":["typescript","javascript","python"]},"error":null},{"analyzer":"sec-deps","pillar":"security","status":"ok","tool_version":"osv-scanner version: 2.7.1","metrics":{"vulnerable_packages":19.0,"vulnerabilities":45.0,"vulns_critical":1.0,"vulns_high":21.0,"vulns_medium":20.0,"vulns_low":3.0,"vulns_unknown":0.0,"penalty":132.0},"findings":[{"rule_id":"osv/GHSA-jqcg-44mw-7w3h","severity":"critical","message":"proxy-addr@2.0.7 (npm) is affected by GHSA-jqcg-44mw-7w3h","path":"pnpm-lock.yaml","line":null,"fingerprint":"proxy-addr@2.0.7 (npm):GHSA-jqcg-44mw-7w3h"},{"rule_id":"osv/GHSA-g2v6-rqmx-r4w6","severity":"high","message":"@vue/server-renderer@3.5.30 (npm) is affected by GHSA-g2v6-rqmx-r4w6","path":"docs/package-lock.json","line":null,"fingerprint":"@vue/server-renderer@3.5.30 (npm):GHSA-g2v6-rqmx-r4w6"},{"rule_id":"osv/GHSA-28wg-ghj8-5hjv","severity":"high","message":"nanoid@3.3.11 (npm) is affected by GHSA-28wg-ghj8-5hjv; also in pnpm-lock.yaml","path":"docs/package-lock.json","line":null,"fingerprint":"nanoid@3.3.11 (npm):GHSA-28wg-ghj8-5hjv"},{"rule_id":"osv/GHSA-2v37-7h3g-55p8","severity":"high","message":"nanoid@3.3.11 (npm) is affected by GHSA-2v37-7h3g-55p8; also in pnpm-lock.yaml","path":"docs/package-lock.json","line":null,"fingerprint":"nanoid@3.3.11 (npm):GHSA-2v37-7h3g-55p8"},{"rule_id":"osv/GHSA-xwg4-73v4-xw9w","severity":"high","message":"nanoid@3.3.11 (npm) is affected by GHSA-xwg4-73v4-xw9w; also in pnpm-lock.yaml","path":"docs/package-lock.json","line":null,"fingerprint":"nanoid@3.3.11 (npm):GHSA-xwg4-73v4-xw9w"},{"rule_id":"osv/GHSA-6g55-p6wh-862q","severity":"high","message":"postcss@8.5.8 (npm) is affected by GHSA-6g55-p6wh-862q; also in pnpm-lock.yaml","path":"docs/package-lock.json","line":null,"fingerprint":"postcss@8.5.8 (npm):GHSA-6g55-p6wh-862q"},{"rule_id":"osv/GHSA-r28c-9q8g-f849","severity":"high","message":"postcss@8.5.8 (npm) is affected by GHSA-r28c-9q8g-f849; also in pnpm-lock.yaml","path":"docs/package-lock.json","line":null,"fingerprint":"postcss@8.5.8 (npm):GHSA-r28c-9q8g-f849"},{"rule_id":"osv/GHSA-68fv-2mgg-jv7q","severity":"high","message":"source-map-js@1.2.1 (npm) is affected by GHSA-68fv-2mgg-jv7q; also in pnpm-lock.yaml","path":"docs/package-lock.json","line":null,"fingerprint":"source-map-js@1.2.1 (npm):GHSA-68fv-2mgg-jv7q"},{"rule_id":"osv/GHSA-587h-7wmj-h5pm","severity":"high","message":"vite@5.4.21 (npm) is affected by GHSA-587h-7wmj-h5pm; also in pnpm-lock.yaml","path":"docs/package-lock.json","line":null,"fingerprint":"vite@5.4.21 (npm):GHSA-587h-7wmj-h5pm"},{"rule_id":"osv/GHSA-g2v6-rqmx-r4w6","severity":"high","message":"@vue/server-renderer@3.5.29 (npm) is affected by GHSA-g2v6-rqmx-r4w6","path":"pnpm-lock.yaml","line":null,"fingerprint":"@vue/server-renderer@3.5.29 (npm):GHSA-g2v6-rqmx-r4w6"},{"rule_id":"osv/GHSA-27r3-jxmh-p828","severity":"high","message":"body-parser@2.3.0 (npm) is affected by GHSA-27r3-jxmh-p828","path":"pnpm-lock.yaml","line":null,"fingerprint":"body-parser@2.3.0 (npm):GHSA-27r3-jxmh-p828"},{"rule_id":"osv/GHSA-73wf-gq98-2v4g","severity":"high","message":"browserslist@4.28.1 (npm) is affected by GHSA-73wf-gq98-2v4g","path":"pnpm-lock.yaml","line":null,"fingerprint":"browserslist@4.28.1 (npm):GHSA-73wf-gq98-2v4g"},{"rule_id":"osv/GHSA-c83g-rgw3-j3cx","severity":"high","message":"browserslist@4.28.1 (npm) is affected by GHSA-c83g-rgw3-j3cx","path":"pnpm-lock.yaml","line":null,"fingerprint":"browserslist@4.28.1 (npm):GHSA-c83g-rgw3-j3cx"},{"rule_id":"osv/GHSA-r5fr-rjxr-66jc","severity":"high","message":"lodash@4.17.23 (npm) is affected by GHSA-r5fr-rjxr-66jc","path":"pnpm-lock.yaml","line":null,"fingerprint":"lodash@4.17.23 (npm):GHSA-r5fr-rjxr-66jc"},{"rule_id":"osv/GHSA-c2c7-rcm5-vvqj","severity":"high","message":"picomatch@4.0.3 (npm) is affected by GHSA-c2c7-rcm5-vvqj","path":"pnpm-lock.yaml","line":null,"fingerprint":"picomatch@4.0.3 (npm):GHSA-c2c7-rcm5-vvqj"},{"rule_id":"osv/GHSA-4qx8-w7c3-pj3p","severity":"high","message":"toml@4.3.0 (npm) is affected by GHSA-4qx8-w7c3-pj3p","path":"pnpm-lock.yaml","line":null,"fingerprint":"toml@4.3.0 (npm):GHSA-4qx8-w7c3-pj3p"},{"rule_id":"osv/GHSA-9j65-hcg3-gc64","severity":"high","message":"toml@4.3.0 (npm) is affected by GHSA-9j65-hcg3-gc64","path":"pnpm-lock.yaml","line":null,"fingerprint":"toml@4.3.0 (npm):GHSA-9j65-hcg3-gc64"},{"rule_id":"osv/GHSA-9qmh-m7c6-f92p","severity":"high","message":"toml@4.3.0 (npm) is affected by GHSA-9qmh-m7c6-f92p","path":"pnpm-lock.yaml","line":null,"fingerprint":"toml@4.3.0 (npm):GHSA-9qmh-m7c6-f92p"},{"rule_id":"osv/GHSA-h895-cgqg-jf52","severity":"high","message":"toml@4.3.0 (npm) is affected by GHSA-h895-cgqg-jf52","path":"pnpm-lock.yaml","line":null,"fingerprint":"toml@4.3.0 (npm):GHSA-h895-cgqg-jf52"},{"rule_id":"osv/GHSA-587h-7wmj-h5pm","severity":"high","message":"vite@6.4.1 (npm) is affected by GHSA-587h-7wmj-h5pm","path":"pnpm-lock.yaml","line":null,"fingerprint":"vite@6.4.1 (npm):GHSA-587h-7wmj-h5pm"},{"rule_id":"osv/GHSA-p9ff-h696-f583","severity":"high","message":"vite@6.4.1 (npm) is affected by GHSA-p9ff-h696-f583","path":"pnpm-lock.yaml","line":null,"fingerprint":"vite@6.4.1 (npm):GHSA-p9ff-h696-f583"},{"rule_id":"osv/GHSA-mrhx-c7xc-m3w5","severity":"high","message":"zod@4.1.8 (npm) is affected by GHSA-mrhx-c7xc-m3w5","path":"pnpm-lock.yaml","line":null,"fingerprint":"zod@4.1.8 (npm):GHSA-mrhx-c7xc-m3w5"},{"rule_id":"osv/GHSA-67mh-4wv8-2f99","severity":"medium","message":"esbuild@0.21.5 (npm) is affected by GHSA-67mh-4wv8-2f99; also in pnpm-lock.yaml","path":"docs/package-lock.json","line":null,"fingerprint":"esbuild@0.21.5 (npm):GHSA-67mh-4wv8-2f99"},{"rule_id":"osv/GHSA-fxqj-rqcc-2cmp","severity":"medium","message":"postcss@8.5.8 (npm) is affected by GHSA-fxqj-rqcc-2cmp; also in pnpm-lock.yaml","path":"docs/package-lock.json","line":null,"fingerprint":"postcss@8.5.8 (npm):GHSA-fxqj-rqcc-2cmp"},{"rule_id":"osv/GHSA-qx2v-qp2m-jg93","severity":"medium","message":"postcss@8.5.8 (npm) is affected by GHSA-qx2v-qp2m-jg93; also in pnpm-lock.yaml","path":"docs/package-lock.json","line":null,"fingerprint":"postcss@8.5.8 (npm):GHSA-qx2v-qp2m-jg93"},{"rule_id":"osv/GHSA-4w7w-66w2-5vf9","severity":"medium","message":"vite@5.4.21 (npm) is affected by GHSA-4w7w-66w2-5vf9; also in pnpm-lock.yaml","path":"docs/package-lock.json","line":null,"fingerprint":"vite@5.4.21 (npm):GHSA-4w7w-66w2-5vf9"},{"rule_id":"osv/GHSA-698v-4r3x-3vcv","severity":"medium","message":"vite@5.4.21 (npm) is affected by GHSA-698v-4r3x-3vcv; also in pnpm-lock.yaml","path":"docs/package-lock.json","line":null,"fingerprint":"vite@5.4.21 (npm):GHSA-698v-4r3x-3vcv"},{"rule_id":"osv/GHSA-fx2h-pf6j-xcff","severity":"medium","message":"vite@5.4.21 (npm) is affected by GHSA-fx2h-pf6j-xcff; also in pnpm-lock.yaml","path":"docs/package-lock.json","line":null,"fingerprint":"vite@5.4.21 (npm):GHSA-fx2h-pf6j-xcff"},{"rule_id":"osv/GHSA-r825-w8mm-5pxw","severity":"medium","message":"vite@5.4.21 (npm) is affected by GHSA-r825-w8mm-5pxw; also in pnpm-lock.yaml","path":"docs/package-lock.json","line":null,"fingerprint":"vite@5.4.21 (npm):GHSA-r825-w8mm-5pxw"},{"rule_id":"osv/GHSA-rq7h-c2jc-7f22","severity":"medium","message":"vite@5.4.21 (npm) is affected by GHSA-rq7h-c2jc-7f22; also in pnpm-lock.yaml","path":"docs/package-lock.json","line":null,"fingerprint":"vite@5.4.21 (npm):GHSA-rq7h-c2jc-7f22"},{"rule_id":"osv/GHSA-v6wh-96g9-6wx3","severity":"medium","message":"vite@5.4.21 (npm) is affected by GHSA-v6wh-96g9-6wx3; also in pnpm-lock.yaml","path":"docs/package-lock.json","line":null,"fingerprint":"vite@5.4.21 (npm):GHSA-v6wh-96g9-6wx3"},{"rule_id":"osv/GHSA-w5vr-8v7q-w6rv","severity":"medium","message":"baseline-browser-mapping@2.10.0 (npm) is affected by GHSA-w5vr-8v7q-w6rv","path":"pnpm-lock.yaml","line":null,"fingerprint":"baseline-browser-mapping@2.10.0 (npm):GHSA-w5vr-8v7q-w6rv"},{"rule_id":"osv/GHSA-chp3-j5qr-2vfr","severity":"medium","message":"effect@4.0.0-beta.83 (npm) is affected by GHSA-chp3-j5qr-2vfr","path":"pnpm-lock.yaml","line":null,"fingerprint":"effect@4.0.0-beta.83 (npm):GHSA-chp3-j5qr-2vfr"},{"rule_id":"osv/GHSA-f23m-r3pf-42rh","severity":"medium","message":"lodash@4.17.23 (npm) is affected by GHSA-f23m-r3pf-42rh","path":"pnpm-lock.yaml","line":null,"fingerprint":"lodash@4.17.23 (npm):GHSA-f23m-r3pf-42rh"},{"rule_id":"osv/GHSA-3v7f-55p6-f55p","severity":"medium","message":"picomatch@4.0.3 (npm) is affected by GHSA-3v7f-55p6-f55p","path":"pnpm-lock.yaml","line":null,"fingerprint":"picomatch@4.0.3 (npm):GHSA-3v7f-55p6-f55p"},{"rule_id":"osv/GHSA-6pq8-jhm2-2vcw","severity":"medium","message":"qs@6.16.0 (npm) is affected by GHSA-6pq8-jhm2-2vcw","path":"pnpm-lock.yaml","line":null,"fingerprint":"qs@6.16.0 (npm):GHSA-6pq8-jhm2-2vcw"},{"rule_id":"osv/GHSA-4w7w-66w2-5vf9","severity":"medium","message":"vite@6.4.1 (npm) is affected by GHSA-4w7w-66w2-5vf9","path":"pnpm-lock.yaml","line":null,"fingerprint":"vite@6.4.1 (npm):GHSA-4w7w-66w2-5vf9"},{"rule_id":"osv/GHSA-698v-4r3x-3vcv","severity":"medium","message":"vite@6.4.1 (npm) is affected by GHSA-698v-4r3x-3vcv","path":"pnpm-lock.yaml","line":null,"fingerprint":"vite@6.4.1 (npm):GHSA-698v-4r3x-3vcv"},{"rule_id":"osv/GHSA-fx2h-pf6j-xcff","severity":"medium","message":"vite@6.4.1 (npm) is affected by GHSA-fx2h-pf6j-xcff","path":"pnpm-lock.yaml","line":null,"fingerprint":"vite@6.4.1 (npm):GHSA-fx2h-pf6j-xcff"},{"rule_id":"osv/GHSA-r825-w8mm-5pxw","severity":"medium","message":"vite@6.4.1 (npm) is affected by GHSA-r825-w8mm-5pxw","path":"pnpm-lock.yaml","line":null,"fingerprint":"vite@6.4.1 (npm):GHSA-r825-w8mm-5pxw"},{"rule_id":"osv/GHSA-rq7h-c2jc-7f22","severity":"medium","message":"vite@6.4.1 (npm) is affected by GHSA-rq7h-c2jc-7f22","path":"pnpm-lock.yaml","line":null,"fingerprint":"vite@6.4.1 (npm):GHSA-rq7h-c2jc-7f22"},{"rule_id":"osv/GHSA-v6wh-96g9-6wx3","severity":"medium","message":"vite@6.4.1 (npm) is affected by GHSA-v6wh-96g9-6wx3","path":"pnpm-lock.yaml","line":null,"fingerprint":"vite@6.4.1 (npm):GHSA-v6wh-96g9-6wx3"},{"rule_id":"osv/GHSA-9jrq-w75r-8gcw","severity":"low","message":"vite@5.4.21 (npm) is affected by GHSA-9jrq-w75r-8gcw; also in pnpm-lock.yaml","path":"docs/package-lock.json","line":null,"fingerprint":"vite@5.4.21 (npm):GHSA-9jrq-w75r-8gcw"},{"rule_id":"osv/GHSA-4x5r-pxfx-6jf8","severity":"low","message":"@babel/core@7.29.0 (npm) is affected by GHSA-4x5r-pxfx-6jf8","path":"pnpm-lock.yaml","line":null,"fingerprint":"@babel/core@7.29.0 (npm):GHSA-4x5r-pxfx-6jf8"},{"rule_id":"osv/GHSA-9jrq-w75r-8gcw","severity":"low","message":"vite@6.4.1 (npm) is affected by GHSA-9jrq-w75r-8gcw","path":"pnpm-lock.yaml","line":null,"fingerprint":"vite@6.4.1 (npm):GHSA-9jrq-w75r-8gcw"}],"evidence":[],"data":{"ecosystems":["npm"]},"error":null},{"analyzer":"sec-actions","pillar":"security","status":"ok","tool_version":"zizmor 1.32.0","metrics":{"workflows":2.0,"findings":5.0,"findings_high":2.0,"findings_medium":3.0,"findings_low":0.0,"penalty":10.8},"findings":[{"rule_id":"zizmor/cache-poisoning","severity":"high","message":"runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low]","path":".github/workflows/validate.yml","line":21,"fingerprint":"cache-poisoning:.github/workflows/validate.yml:21"},{"rule_id":"zizmor/cache-poisoning","severity":"high","message":"runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low]","path":".github/workflows/validate.yml","line":36,"fingerprint":"cache-poisoning:.github/workflows/validate.yml:36"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/docs.yml","line":27,"fingerprint":"artipacked:.github/workflows/docs.yml:27"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/validate.yml","line":17,"fingerprint":"artipacked:.github/workflows/validate.yml:17"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/validate.yml","line":32,"fingerprint":"artipacked:.github/workflows/validate.yml:32"}],"evidence":[],"data":{},"error":null},{"analyzer":"sec-posture","pillar":"security","status":"ok","tool_version":null,"metrics":{"check:security_policy":0.0,"check:dependency_updates":0.0,"check:signed_commits":0.0,"check:lockfiles":1.0,"signed_commit_share":0.0859,"unpinned_manifests":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-distribution","pillar":"security","status":"ok","tool_version":null,"metrics":{"signals":1.0,"binary_assets":2.0,"suspicious":0.0},"findings":[],"evidence":[{"kind":"binary-release-asset","description":"release v2.5.3 ships openwolf-2.5.3.tgz (9 downloads)","ref":"openwolf-2.5.3.tgz","url":"https://github.com/cytostack/openwolf/releases/download/v2.5.3/openwolf-2.5.3.tgz","weight":0.0},{"kind":"binary-release-asset","description":"release v2.5.2 ships openwolf-2.5.2.tgz (12 downloads)","ref":"openwolf-2.5.2.tgz","url":"https://github.com/cytostack/openwolf/releases/download/v2.5.2/openwolf-2.5.2.tgz","weight":0.0}],"data":{"signals":["binary-release-assets"],"suspicious":false,"unusual_traction":false,"metadata":true},"error":null},{"analyzer":"qual-complexity","pillar":"quality","status":"ok","tool_version":"lizard 1.25.1","metrics":{"functions":1929.0,"function_nloc":17410.0,"mean_ccn":4.39,"p90_ccn":10.0,"complex_functions":101.0,"long_functions":12.0,"many_param_functions":2.0,"risky_nloc_share":0.3391},"findings":[],"evidence":[{"kind":"complex-function","description":"extractDescription in src/hooks/shared.ts: complexity 276, 368 lines","ref":"src/hooks/shared.ts","url":"https://github.com/cytostack/openwolf/blob/8568f41aa8a985a496314c3ea313ff1ee2b66483/src/hooks/shared.ts#L276","weight":1.0},{"kind":"complex-function","description":"extractDescription in src/templates/opencode-plugin/shared.ts: complexity 276, 368 lines","ref":"src/templates/opencode-plugin/shared.ts","url":"https://github.com/cytostack/openwolf/blob/8568f41aa8a985a496314c3ea313ff1ee2b66483/src/templates/opencode-plugin/shared.ts#L276","weight":1.0},{"kind":"complex-function","description":"collectUsage in src/tracker/usage.ts: complexity 93, 115 lines","ref":"src/tracker/usage.ts","url":"https://github.com/cytostack/openwolf/blob/8568f41aa8a985a496314c3ea313ff1ee2b66483/src/tracker/usage.ts#L113","weight":1.0},{"kind":"complex-function","description":"detectFixPattern in src/hooks/post-write.ts: complexity 62, 169 lines","ref":"src/hooks/post-write.ts","url":"https://github.com/cytostack/openwolf/blob/8568f41aa8a985a496314c3ea313ff1ee2b66483/src/hooks/post-write.ts#L380","weight":1.0},{"kind":"complex-function","description":"updateProject in src/cli/update.ts: complexity 58, 200 lines","ref":"src/cli/update.ts","url":"https://github.com/cytostack/openwolf/blob/8568f41aa8a985a496314c3ea313ff1ee2b66483/src/cli/update.ts#L143","weight":0.9666666666666667},{"kind":"complex-function","description":"receiptText in src/hooks/visibility.ts: complexity 55, 59 lines","ref":"src/hooks/visibility.ts","url":"https://github.com/cytostack/openwolf/blob/8568f41aa8a985a496314c3ea313ff1ee2b66483/src/hooks/visibility.ts#L36","weight":0.9166666666666666},{"kind":"complex-function","description":"receiptText in src/templates/opencode-plugin/visibility.ts: complexity 55, 59 lines","ref":"src/templates/opencode-plugin/visibility.ts","url":"https://github.com/cytostack/openwolf/blob/8568f41aa8a985a496314c3ea313ff1ee2b66483/src/templates/opencode-plugin/visibility.ts#L36","weight":0.9166666666666666},{"kind":"complex-function","description":"extractTsJs in src/scanner/description-extractor.ts: complexity 53, 65 lines","ref":"src/scanner/description-extractor.ts","url":"https://github.com/cytostack/openwolf/blob/8568f41aa8a985a496314c3ea313ff1ee2b66483/src/scanner/description-extractor.ts#L405","weight":0.8833333333333333},{"kind":"complex-function","description":"normalize in src/handoff/sources.ts: complexity 52, 36 lines","ref":"src/handoff/sources.ts","url":"https://github.com/cytostack/openwolf/blob/8568f41aa8a985a496314c3ea313ff1ee2b66483/src/handoff/sources.ts#L54","weight":0.8666666666666667},{"kind":"complex-function","description":"extractPython in src/scanner/description-extractor.ts: complexity 52, 63 lines","ref":"src/scanner/description-extractor.ts","url":"https://github.com/cytostack/openwolf/blob/8568f41aa8a985a496314c3ea313ff1ee2b66483/src/scanner/description-extractor.ts#L495","weight":0.8666666666666667}],"data":{},"error":null},{"analyzer":"qual-duplication","pillar":"quality","status":"ok","tool_version":"repotrust-dup-w6","metrics":{"compared_lines":19962.0,"duplicated_lines":6753.0,"duplicated_share":0.3383,"files":182.0},"findings":[],"evidence":[{"kind":"duplicate-code","description":"6+ duplicated lines: src/agents/opencode.ts:24 and src/agents/opencode.ts:46","ref":"src/agents/opencode.ts","url":"https://github.com/cytostack/openwolf/blob/8568f41aa8a985a496314c3ea313ff1ee2b66483/src/agents/opencode.ts#L24","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: src/buglog/bug-tracker.ts:15 and src/hooks/post-write.ts:40","ref":"src/buglog/bug-tracker.ts","url":"https://github.com/cytostack/openwolf/blob/8568f41aa8a985a496314c3ea313ff1ee2b66483/src/buglog/bug-tracker.ts#L15","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: src/cli/daemon-cmd.ts:92 and src/cli/daemon-cmd.ts:221","ref":"src/cli/daemon-cmd.ts","url":"https://github.com/cytostack/openwolf/blob/8568f41aa8a985a496314c3ea313ff1ee2b66483/src/cli/daemon-cmd.ts#L92","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: src/cli/index.ts:20 and src/cli/update.ts:31","ref":"src/cli/index.ts","url":"https://github.com/cytostack/openwolf/blob/8568f41aa8a985a496314c3ea313ff1ee2b66483/src/cli/index.ts#L20","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: src/cli/index.ts:23 and src/cli/init.ts:30","ref":"src/cli/index.ts","url":"https://github.com/cytostack/openwolf/blob/8568f41aa8a985a496314c3ea313ff1ee2b66483/src/cli/index.ts#L23","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: src/cli/init.ts:336 and src/cli/update.ts:707","ref":"src/cli/init.ts","url":"https://github.com/cytostack/openwolf/blob/8568f41aa8a985a496314c3ea313ff1ee2b66483/src/cli/init.ts#L336","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: src/dashboard/app/hooks/useWolfData.ts:20 and src/hooks/ledger-math.ts:74","ref":"src/dashboard/app/hooks/useWolfData.ts","url":"https://github.com/cytostack/openwolf/blob/8568f41aa8a985a496314c3ea313ff1ee2b66483/src/dashboard/app/hooks/useWolfData.ts#L20","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: src/dashboard/app/hooks/useWolfData.ts:21 and src/tracker/token-ledger.ts:18","ref":"src/dashboard/app/hooks/useWolfData.ts","url":"https://github.com/cytostack/openwolf/blob/8568f41aa8a985a496314c3ea313ff1ee2b66483/src/dashboard/app/hooks/useWolfData.ts#L21","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: src/dashboard/app/lib/pricing.ts:1 and src/hooks/ledger-math.ts:133","ref":"src/dashboard/app/lib/pricing.ts","url":"https://github.com/cytostack/openwolf/blob/8568f41aa8a985a496314c3ea313ff1ee2b66483/src/dashboard/app/lib/pricing.ts#L1","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: src/dashboard/app/lib/pricing.ts:2 and src/tracker/pricing.ts:2","ref":"src/dashboard/app/lib/pricing.ts","url":"https://github.com/cytostack/openwolf/blob/8568f41aa8a985a496314c3ea313ff1ee2b66483/src/dashboard/app/lib/pricing.ts#L2","weight":0.3}],"data":{},"error":null},{"analyzer":"qual-lint","pillar":"quality","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":14.0,"weighted_findings":9.5,"scanned_lines":26940.0,"category:best-practice":4.0,"category:correctness":10.0},"findings":[{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"scripts/opencode-v2-smoke.py","line":6,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:scripts/opencode-v2-smoke.py:6"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"scripts/opencode-v2-smoke.py","line":39,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:scripts/opencode-v2-smoke.py:39"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"scripts/opencode-v2-smoke.py","line":44,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:scripts/opencode-v2-smoke.py:44"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"src/cli/init.ts","line":462,"fingerprint":"javascript.lang.correctness.no-stringify-keys:src/cli/init.ts:462"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"src/daemon/cron-engine.ts","line":117,"fingerprint":"javascript.lang.correctness.no-stringify-keys:src/daemon/cron-engine.ts:117"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"src/hooks/bug-index.ts","line":36,"fingerprint":"javascript.lang.best-practice.lazy-load-module:src/hooks/bug-index.ts:36"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"src/hooks/handoff-state.ts","line":87,"fingerprint":"javascript.lang.correctness.no-stringify-keys:src/hooks/handoff-state.ts:87"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"src/templates/opencode-plugin/handoff-state.ts","line":87,"fingerprint":"javascript.lang.correctness.no-stringify-keys:src/templates/opencode-plugin/handoff-state.ts:87"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/release-smoke.mjs","line":11,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/release-smoke.mjs:11"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/release-smoke.mjs","line":11,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/release-smoke.mjs:11"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/agents/opencode.ts","line":17,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/agents/opencode.ts:17"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/agents/opencode.ts","line":17,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/agents/opencode.ts:17"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/agents/opencode.ts","line":37,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/agents/opencode.ts:37"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/agents/opencode.ts","line":37,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/agents/opencode.ts:37"}],"evidence":[],"data":{},"error":null},{"analyzer":"qual-testing","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:has_tests":1.0,"check:test_ratio":0.3885,"check:ci_present":1.0,"check:ci_runs_tests":1.0,"check:ci_runs_lint":0.0,"check:tests_cochange":1.0,"test_lines":5233.0,"source_lines":26940.0,"test_ratio":0.1942,"ci_files":2.0,"cochange_share":0.3846,"cochange_commits":91.0},"findings":[],"evidence":[{"kind":"ci","description":"CI config: .github/workflows/docs.yml","ref":".github/workflows/docs.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI config: .github/workflows/validate.yml","ref":".github/workflows/validate.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI runs tests (npm test, pnpm test)","ref":null,"url":null,"weight":0.0}],"data":{"test_commands":["npm test","pnpm test"],"lint_commands":[]},"error":null},{"analyzer":"qual-docs","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:readme":1.0,"check:license":1.0,"check:contributing":1.0,"check:changelog":1.0,"readme_lines":228.0},"findings":[],"evidence":[{"kind":"docs","description":"README.md","ref":"README.md","url":null,"weight":0.0},{"kind":"docs","description":"LICENSE","ref":"LICENSE","url":null,"weight":0.0},{"kind":"docs","description":"CONTRIBUTING.md","ref":"CONTRIBUTING.md","url":null,"weight":0.0},{"kind":"docs","description":"CHANGELOG.md","ref":"CHANGELOG.md","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"qual-type-safety","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:strict_config":0.9974,"check:low_escape_density":1.0,"escapes":125.0,"escapes_per_kloc":4.731},"findings":[],"evidence":[{"kind":"typing","description":"TypeScript strict type checking: tsconfig.dashboard.json","ref":"tsconfig.dashboard.json","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"x-blame","pillar":"ai_provenance","status":"ok","tool_version":"git-blame","metrics":{"ai_lines":6462.0,"other_lines":20478.0,"files_blamed":182.0,"blame_failures":0.0,"quality:ai_findings":1.0,"quality:ai_per_kloc":0.155,"quality:other_findings":13.0,"quality:other_per_kloc":0.635,"quality:ratio":0.24,"security:ai_findings":3.0,"security:ai_per_kloc":0.464,"security:other_findings":12.0,"security:other_per_kloc":0.586,"security:ratio":0.79},"findings":[],"evidence":[],"data":{"sampled":false,"comparable":true},"error":null}],"flags":[]}