{"schema_version":"2","scorer_version":"0.1.0","scoring_version":"prov-4+qual-2+sec-2","generated_at":"2026-11-14T00:13:00.238623Z","repo":{"ref":{"host":"github.com","owner":"RAIT-09","name":"obsidian-agent-client"},"default_branch":"master","clone_url":"https://github.com/RAIT-09/obsidian-agent-client.git","html_url":"https://github.com/RAIT-09/obsidian-agent-client","description":"Bring AI agents into Obsidian via Agent Client Protocol (ACP), such as Claude Code, Codex and Gemini CLI.","stars":2470,"forks":230,"is_fork":false,"is_archived":false,"is_private":false,"size_kb":9458,"primary_language":"TypeScript","license_spdx":"Apache-2.0","created_at":"2025-09-18T09:47:13Z","pushed_at":"2026-10-15T06:31:44Z","security_policy_url":null,"distribution":{"owner_created_at":"2019-06-06T15:24:42Z","owner_type":"User","release_assets":[{"name":"main.js","size":839009,"download_count":20841,"release_tag":"0.13.0","url":"https://github.com/RAIT-09/obsidian-agent-client/releases/download/0.13.0/main.js"},{"name":"manifest.json","size":340,"download_count":64548,"release_tag":"0.13.0","url":"https://github.com/RAIT-09/obsidian-agent-client/releases/download/0.13.0/manifest.json"},{"name":"styles.css","size":61544,"download_count":20522,"release_tag":"0.13.0","url":"https://github.com/RAIT-09/obsidian-agent-client/releases/download/0.13.0/styles.css"},{"name":"main.js","size":838294,"download_count":2425,"release_tag":"0.13.0-preview.1","url":"https://github.com/RAIT-09/obsidian-agent-client/releases/download/0.13.0-preview.1/main.js"},{"name":"manifest.json","size":350,"download_count":8527,"release_tag":"0.13.0-preview.1","url":"https://github.com/RAIT-09/obsidian-agent-client/releases/download/0.13.0-preview.1/manifest.json"},{"name":"styles.css","size":61544,"download_count":2406,"release_tag":"0.13.0-preview.1","url":"https://github.com/RAIT-09/obsidian-agent-client/releases/download/0.13.0-preview.1/styles.css"},{"name":"main.js","size":825081,"download_count":12922,"release_tag":"0.12.1","url":"https://github.com/RAIT-09/obsidian-agent-client/releases/download/0.12.1/main.js"},{"name":"manifest.json","size":340,"download_count":29822,"release_tag":"0.12.1","url":"https://github.com/RAIT-09/obsidian-agent-client/releases/download/0.12.1/manifest.json"},{"name":"styles.css","size":52793,"download_count":12773,"release_tag":"0.12.1","url":"https://github.com/RAIT-09/obsidian-agent-client/releases/download/0.12.1/styles.css"},{"name":"main.js","size":825047,"download_count":6045,"release_tag":"0.12.0","url":"https://github.com/RAIT-09/obsidian-agent-client/releases/download/0.12.0/main.js"},{"name":"manifest.json","size":340,"download_count":12387,"release_tag":"0.12.0","url":"https://github.com/RAIT-09/obsidian-agent-client/releases/download/0.12.0/manifest.json"},{"name":"styles.css","size":52793,"download_count":5976,"release_tag":"0.12.0","url":"https://github.com/RAIT-09/obsidian-agent-client/releases/download/0.12.0/styles.css"},{"name":"main.js","size":824460,"download_count":3809,"release_tag":"0.12.0-preview.2","url":"https://github.com/RAIT-09/obsidian-agent-client/releases/download/0.12.0-preview.2/main.js"},{"name":"manifest.json","size":350,"download_count":17929,"release_tag":"0.12.0-preview.2","url":"https://github.com/RAIT-09/obsidian-agent-client/releases/download/0.12.0-preview.2/manifest.json"},{"name":"styles.css","size":52793,"download_count":3767,"release_tag":"0.12.0-preview.2","url":"https://github.com/RAIT-09/obsidian-agent-client/releases/download/0.12.0-preview.2/styles.css"},{"name":"main.js","size":823974,"download_count":1863,"release_tag":"0.12.0-preview.1","url":"https://github.com/RAIT-09/obsidian-agent-client/releases/download/0.12.0-preview.1/main.js"},{"name":"manifest.json","size":350,"download_count":4186,"release_tag":"0.12.0-preview.1","url":"https://github.com/RAIT-09/obsidian-agent-client/releases/download/0.12.0-preview.1/manifest.json"},{"name":"styles.css","size":52793,"download_count":1841,"release_tag":"0.12.0-preview.1","url":"https://github.com/RAIT-09/obsidian-agent-client/releases/download/0.12.0-preview.1/styles.css"},{"name":"main.js","size":798589,"download_count":19821,"release_tag":"0.11.0","url":"https://github.com/RAIT-09/obsidian-agent-client/releases/download/0.11.0/main.js"},{"name":"manifest.json","size":339,"download_count":44126,"release_tag":"0.11.0","url":"https://github.com/RAIT-09/obsidian-agent-client/releases/download/0.11.0/manifest.json"},{"name":"styles.css","size":49360,"download_count":19570,"release_tag":"0.11.0","url":"https://github.com/RAIT-09/obsidian-agent-client/releases/download/0.11.0/styles.css"},{"name":"main.js","size":783908,"download_count":2513,"release_tag":"0.11.0-preview.2","url":"https://github.com/RAIT-09/obsidian-agent-client/releases/download/0.11.0-preview.2/main.js"},{"name":"manifest.json","size":350,"download_count":6690,"release_tag":"0.11.0-preview.2","url":"https://github.com/RAIT-09/obsidian-agent-client/releases/download/0.11.0-preview.2/manifest.json"},{"name":"styles.css","size":49360,"download_count":2486,"release_tag":"0.11.0-preview.2","url":"https://github.com/RAIT-09/obsidian-agent-client/releases/download/0.11.0-preview.2/styles.css"},{"name":"main.js","size":779992,"download_count":4563,"release_tag":"0.11.0-preview.1","url":"https://github.com/RAIT-09/obsidian-agent-client/releases/download/0.11.0-preview.1/main.js"},{"name":"manifest.json","size":350,"download_count":22111,"release_tag":"0.11.0-preview.1","url":"https://github.com/RAIT-09/obsidian-agent-client/releases/download/0.11.0-preview.1/manifest.json"},{"name":"styles.css","size":49205,"download_count":4520,"release_tag":"0.11.0-preview.1","url":"https://github.com/RAIT-09/obsidian-agent-client/releases/download/0.11.0-preview.1/styles.css"},{"name":"main.js","size":763871,"download_count":12117,"release_tag":"0.10.6","url":"https://github.com/RAIT-09/obsidian-agent-client/releases/download/0.10.6/main.js"},{"name":"manifest.json","size":339,"download_count":20280,"release_tag":"0.10.6","url":"https://github.com/RAIT-09/obsidian-agent-client/releases/download/0.10.6/manifest.json"},{"name":"styles.css","size":50217,"download_count":12017,"release_tag":"0.10.6","url":"https://github.com/RAIT-09/obsidian-agent-client/releases/download/0.10.6/styles.css"}]}},"commit_sha":"3d069c91636588be4e65d955e670403a9ea642d8","profile":{"lines_by_language":{"TypeScript":30043,"JavaScript":95,"Shell":49},"files_by_category":{"source":81,"docs":46,"binary":33,"config":22,"test":13,"other":3,"oversized":3,"generated":1},"source_lines":27032,"test_lines":3155},"pillars":{"ai_provenance":{"score":1.5,"confidence":0.95,"coverage":1.0,"label":"explicit","breakdown":{"attributed_share":0.0149,"suspected_share":0.1921,"estimated_share":0.0149,"ai_artifacts":7.0,"flagged_work_units":5.0,"flagged_releases":3.0},"summary":"Explicit AI attribution on 1% of first-party code added; an estimated 1% including velocity signals."},"quality":{"score":72.2,"confidence":0.9,"coverage":1.0,"label":"adequate","breakdown":{"complexity":62.7,"duplication":76.4,"lint":93.7,"testing":67.8,"docs":80.0,"type_safety":40.0,"process":null},"summary":"Code quality is adequate: test-to-source ratio 0.12, CI runs tests; 16% of function code in complex or long functions; 4% duplicated lines. Weakest area: type safety."},"security":{"score":53.4,"confidence":0.85,"coverage":1.0,"label":"weak","breakdown":{"secrets":100.0,"sast":93.4,"dependencies":13.5,"ci_actions":11.1,"posture":0.0,"scorecard":null},"summary":"Security posture is weak: 61 known vulnerabilities in 20 dependencies; 3 high-severity SAST findings; 12 high-severity workflow issues. Weakest area: posture."}},"analyzer_results":[{"analyzer":"sec-scorecard","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no published OpenSSF Scorecard result for this repo"},{"analyzer":"sec-registry","pillar":"security","status":"ok","tool_version":null,"metrics":{"declared":27.0,"checked":27.0,"missing":0.0,"recent":0.0,"lookup_errors":0.0},"findings":[],"evidence":[],"data":{"phantom":false},"error":null},{"analyzer":"ai-attribution","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"commits":1131.0,"attributed_commits":28.0,"attributed_commit_share":0.02475685234305924,"effective_loc":70377.0,"attributed_loc":1052.0,"attributed_loc_share":0.01494806541909999,"tools_detected":3.0},"findings":[],"evidence":[{"kind":"attribution-summary","description":"GitHub Copilot coding agent: 16 attributed commits, 282 lines added","ref":null,"url":null,"weight":1.0},{"kind":"attribution-summary","description":"Claude Code: 11 attributed commits, 580 lines added","ref":null,"url":null,"weight":1.0},{"kind":"attribution-summary","description":"OpenAI Codex: 1 attributed commits, 190 lines added","ref":null,"url":null,"weight":1.0},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"26bf9442dbf502136c3d360229ec15a897486d51","url":"https://github.com/RAIT-09/obsidian-agent-client/commit/26bf9442dbf502136c3d360229ec15a897486d51","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"f2eea3827e42b792856f09864ac979034d45f528","url":"https://github.com/RAIT-09/obsidian-agent-client/commit/f2eea3827e42b792856f09864ac979034d45f528","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: on merged branch (1ba744f235)","ref":"cb92f4b6ce91e8c023a6b164da9bb3db0709afeb","url":"https://github.com/RAIT-09/obsidian-agent-client/commit/cb92f4b6ce91e8c023a6b164da9bb3db0709afeb","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"a1c3c7d9b4b1642d6d6e57d9836c61249ae19277","url":"https://github.com/RAIT-09/obsidian-agent-client/commit/a1c3c7d9b4b1642d6d6e57d9836c61249ae19277","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"ca5c0f188ace33b28e79bf8b259fc73543309ec9","url":"https://github.com/RAIT-09/obsidian-agent-client/commit/ca5c0f188ace33b28e79bf8b259fc73543309ec9","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"0e2fa4e7bdec3cfcd8381fe9e5963059f4a495b7","url":"https://github.com/RAIT-09/obsidian-agent-client/commit/0e2fa4e7bdec3cfcd8381fe9e5963059f4a495b7","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"2170e6f761aa05a01015126741848be874bdcf58","url":"https://github.com/RAIT-09/obsidian-agent-client/commit/2170e6f761aa05a01015126741848be874bdcf58","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"45bfee291f1122dc6e73fdaa43bc9d16a09be6db","url":"https://github.com/RAIT-09/obsidian-agent-client/commit/45bfee291f1122dc6e73fdaa43bc9d16a09be6db","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"8a420a4794199c7e62efd080cb045195cb4c4793","url":"https://github.com/RAIT-09/obsidian-agent-client/commit/8a420a4794199c7e62efd080cb045195cb4c4793","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"3fd00c7482a8daa63d4ebad8a64aa483d45d55c7","url":"https://github.com/RAIT-09/obsidian-agent-client/commit/3fd00c7482a8daa63d4ebad8a64aa483d45d55c7","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"07e087728012839259e5c9bdc57e4b51edc0d05e","url":"https://github.com/RAIT-09/obsidian-agent-client/commit/07e087728012839259e5c9bdc57e4b51edc0d05e","weight":0.9},{"kind":"attributed-commit","description":"GitHub Copilot coding agent: author copilot-swe-agent[bot]","ref":"8d9f0e29857583a005269437de1c2d0fe228a2bf","url":"https://github.com/RAIT-09/obsidian-agent-client/commit/8d9f0e29857583a005269437de1c2d0fe228a2bf","weight":0.9},{"kind":"attributed-commit","description":"GitHub Copilot coding agent: author copilot-swe-agent[bot]","ref":"991afa4062a517b7383dd0062d09ce2e94ad2506","url":"https://github.com/RAIT-09/obsidian-agent-client/commit/991afa4062a517b7383dd0062d09ce2e94ad2506","weight":0.9},{"kind":"attributed-commit","description":"GitHub Copilot coding agent: author copilot-swe-agent[bot]","ref":"0535c11e6dd679905b9a8b2dcba0e829ef6c82bf","url":"https://github.com/RAIT-09/obsidian-agent-client/commit/0535c11e6dd679905b9a8b2dcba0e829ef6c82bf","weight":0.9},{"kind":"attributed-commit","description":"GitHub Copilot coding agent: author copilot-swe-agent[bot]","ref":"d7108743bb65b51da1954dc176dfc49b5c899683","url":"https://github.com/RAIT-09/obsidian-agent-client/commit/d7108743bb65b51da1954dc176dfc49b5c899683","weight":0.9},{"kind":"attributed-commit","description":"GitHub Copilot coding agent: trailer 'Co-authored-by: Copilot'","ref":"34befa9b31db69f32e4d3a322dfe2e27dc639f0b","url":"https://github.com/RAIT-09/obsidian-agent-client/commit/34befa9b31db69f32e4d3a322dfe2e27dc639f0b","weight":0.9},{"kind":"attributed-commit","description":"GitHub Copilot coding agent: author copilot-swe-agent[bot]","ref":"28bcaeaa50ec4905911b48324ae2812272a97633","url":"https://github.com/RAIT-09/obsidian-agent-client/commit/28bcaeaa50ec4905911b48324ae2812272a97633","weight":0.9},{"kind":"attributed-commit","description":"GitHub Copilot coding agent: trailer 'Co-authored-by: Copilot'","ref":"118a8bc71b390421e028f55e4e8773a0b339a4f4","url":"https://github.com/RAIT-09/obsidian-agent-client/commit/118a8bc71b390421e028f55e4e8773a0b339a4f4","weight":0.9},{"kind":"attributed-commit","description":"GitHub Copilot coding agent: on merged branch (4ea5881ce9)","ref":"4a5073a91749aa6c5f1ad70ff66ffe3ac4d46c3f","url":"https://github.com/RAIT-09/obsidian-agent-client/commit/4a5073a91749aa6c5f1ad70ff66ffe3ac4d46c3f","weight":0.9},{"kind":"attributed-commit","description":"GitHub Copilot coding agent: on merged branch (4ea5881ce9)","ref":"a6b98400c1c66eb7703e1340c2f58c79eaf01c72","url":"https://github.com/RAIT-09/obsidian-agent-client/commit/a6b98400c1c66eb7703e1340c2f58c79eaf01c72","weight":0.9},{"kind":"attributed-commit","description":"GitHub Copilot coding agent: on merged branch (4ea5881ce9)","ref":"5d1b7d2a47ccff11b05678ccd0a2d6c637820b0a","url":"https://github.com/RAIT-09/obsidian-agent-client/commit/5d1b7d2a47ccff11b05678ccd0a2d6c637820b0a","weight":0.9},{"kind":"attributed-commit","description":"GitHub Copilot coding agent: author copilot-swe-agent[bot]","ref":"ea687adf7576fd33db3d02d9247b118d593295a9","url":"https://github.com/RAIT-09/obsidian-agent-client/commit/ea687adf7576fd33db3d02d9247b118d593295a9","weight":0.9},{"kind":"attributed-commit","description":"GitHub Copilot coding agent: author copilot-swe-agent[bot]","ref":"8b985bf8ac10dfb1f1033ee8cffba9a086df4903","url":"https://github.com/RAIT-09/obsidian-agent-client/commit/8b985bf8ac10dfb1f1033ee8cffba9a086df4903","weight":0.9},{"kind":"attributed-commit","description":"GitHub Copilot coding agent: author copilot-swe-agent[bot]","ref":"c744caf4e4f03a920cdbd631ffe316b29f18a6c3","url":"https://github.com/RAIT-09/obsidian-agent-client/commit/c744caf4e4f03a920cdbd631ffe316b29f18a6c3","weight":0.9},{"kind":"attributed-commit","description":"GitHub Copilot coding agent: author copilot-swe-agent[bot]","ref":"62e149d45f16be811e923408cb77e9947cef3f43","url":"https://github.com/RAIT-09/obsidian-agent-client/commit/62e149d45f16be811e923408cb77e9947cef3f43","weight":0.9}],"data":{"attributed_loc_by_commit":{"628d8870a3e0d5571d55f520d80faabaf7f83dd0":24,"b269b3c7daa1a4a0e1dc5fd3d2aa19e96c026628":0,"f7aaac0bcef3a8c1756ba9d30f0aa0f954158048":175,"62e149d45f16be811e923408cb77e9947cef3f43":42,"c744caf4e4f03a920cdbd631ffe316b29f18a6c3":19,"8b985bf8ac10dfb1f1033ee8cffba9a086df4903":37,"ea687adf7576fd33db3d02d9247b118d593295a9":3,"5d1b7d2a47ccff11b05678ccd0a2d6c637820b0a":0,"a6b98400c1c66eb7703e1340c2f58c79eaf01c72":0,"4a5073a91749aa6c5f1ad70ff66ffe3ac4d46c3f":0,"118a8bc71b390421e028f55e4e8773a0b339a4f4":1,"28bcaeaa50ec4905911b48324ae2812272a97633":0,"34befa9b31db69f32e4d3a322dfe2e27dc639f0b":1,"d7108743bb65b51da1954dc176dfc49b5c899683":0,"0535c11e6dd679905b9a8b2dcba0e829ef6c82bf":0,"991afa4062a517b7383dd0062d09ce2e94ad2506":1,"8d9f0e29857583a005269437de1c2d0fe228a2bf":3,"07e087728012839259e5c9bdc57e4b51edc0d05e":9,"3fd00c7482a8daa63d4ebad8a64aa483d45d55c7":69,"8a420a4794199c7e62efd080cb045195cb4c4793":216,"45bfee291f1122dc6e73fdaa43bc9d16a09be6db":31,"2170e6f761aa05a01015126741848be874bdcf58":3,"0e2fa4e7bdec3cfcd8381fe9e5963059f4a495b7":18,"ca5c0f188ace33b28e79bf8b259fc73543309ec9":44,"a1c3c7d9b4b1642d6d6e57d9836c61249ae19277":0,"cb92f4b6ce91e8c023a6b164da9bb3db0709afeb":190,"26bf9442dbf502136c3d360229ec15a897486d51":83,"f2eea3827e42b792856f09864ac979034d45f528":83},"tools":{"claude-code":{"name":"Claude Code","commits":11,"loc":580,"first_seen":1765602896,"last_seen":1777209108},"github-copilot":{"name":"GitHub Copilot coding agent","commits":16,"loc":282,"first_seen":1767070351,"last_seen":1767394181},"openai-codex":{"name":"OpenAI Codex","commits":1,"loc":190,"first_seen":1776117621,"last_seen":1776117621}},"monthly":{"2025-09":{"loc":6641,"attributed_loc":0},"2025-10":{"loc":8362,"attributed_loc":0},"2025-11":{"loc":5729,"attributed_loc":0},"2025-12":{"loc":2363,"attributed_loc":300},"2026-01":{"loc":11234,"attributed_loc":300},"2026-02":{"loc":4176,"attributed_loc":31},"2026-03":{"loc":14575,"attributed_loc":65},"2026-04":{"loc":2571,"attributed_loc":356},"2026-05":{"loc":4499,"attributed_loc":0},"2026-06":{"loc":3179,"attributed_loc":0},"2026-07":{"loc":4347,"attributed_loc":0},"2026-08":{"loc":2457,"attributed_loc":0},"2026-09":{"loc":244,"attributed_loc":0}}},"error":null},{"analyzer":"ai-artifacts","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"artifacts":7.0,"workflow_agents":0.0,"tools_configured":4.0,"earliest_adoption":1758188834.0},"findings":[],"evidence":[{"kind":"ai-artifact","description":".claude/hooks/gh-setup.sh (claude-code configuration)","ref":".claude/hooks/gh-setup.sh","url":"https://github.com/RAIT-09/obsidian-agent-client/blob/3d069c91636588be4e65d955e670403a9ea642d8/.claude/hooks/gh-setup.sh","weight":0.5},{"kind":"ai-artifact","description":".claude/settings.json (claude-code configuration)","ref":".claude/settings.json","url":"https://github.com/RAIT-09/obsidian-agent-client/blob/3d069c91636588be4e65d955e670403a9ea642d8/.claude/settings.json","weight":0.5},{"kind":"ai-artifact","description":".claude/skills/release-notes/SKILL.md (claude-code configuration)","ref":".claude/skills/release-notes/SKILL.md","url":"https://github.com/RAIT-09/obsidian-agent-client/blob/3d069c91636588be4e65d955e670403a9ea642d8/.claude/skills/release-notes/SKILL.md","weight":0.5},{"kind":"ai-artifact","description":"CLAUDE.md (claude-code configuration)","ref":"CLAUDE.md","url":"https://github.com/RAIT-09/obsidian-agent-client/blob/3d069c91636588be4e65d955e670403a9ea642d8/CLAUDE.md","weight":0.5},{"kind":"ai-artifact","description":"AGENTS.md (generic-agent configuration)","ref":"AGENTS.md","url":"https://github.com/RAIT-09/obsidian-agent-client/blob/3d069c91636588be4e65d955e670403a9ea642d8/AGENTS.md","weight":0.5},{"kind":"ai-artifact","description":"GEMINI.md (gemini configuration)","ref":"GEMINI.md","url":"https://github.com/RAIT-09/obsidian-agent-client/blob/3d069c91636588be4e65d955e670403a9ea642d8/GEMINI.md","weight":0.5},{"kind":"ai-artifact","description":".github/copilot-instructions.md (github-copilot configuration)","ref":".github/copilot-instructions.md","url":"https://github.com/RAIT-09/obsidian-agent-client/blob/3d069c91636588be4e65d955e670403a9ea642d8/.github/copilot-instructions.md","weight":0.5}],"data":{"artifacts":[{"tool":"claude-code","path":".claude/hooks/gh-setup.sh","added_at":1770226200},{"tool":"claude-code","path":".claude/settings.json","added_at":1770226200},{"tool":"claude-code","path":".claude/skills/release-notes/SKILL.md","added_at":1778694328},{"tool":"claude-code","path":"CLAUDE.md","added_at":1758945242},{"tool":"generic-agent","path":"AGENTS.md","added_at":1758188834},{"tool":"gemini","path":"GEMINI.md","added_at":1761737459},{"tool":"github-copilot","path":".github/copilot-instructions.md","added_at":1767242994}],"workflows":[],"tools":["claude-code","gemini","generic-agent","github-copilot"]},"error":null},{"analyzer":"ai-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"work_units":320.0,"flagged_units":5.0,"pre_ai_era_bursts":0.0,"pre_ai_era_measured_loc":0.0,"pre_ai_era_burst_loc":0.0,"measured_loc":70377.0,"flagged_loc":13520.0,"flagged_loc_share":0.1921082171732242,"max_loc_per_hour":1369.325153374233,"median_loc_per_hour":82.43387401212166,"pr_timed_units":0.0,"excluded_import_loc":0.0},"findings":[],"evidence":[{"kind":"velocity-burst","description":"2,356 lines of first-party code in ~1.7h (1,369 lines/hour, 3 commit session)","ref":"d2948e20b225ba19652e5607bfcf76792e9a2190","url":"https://github.com/RAIT-09/obsidian-agent-client/commit/d2948e20b225ba19652e5607bfcf76792e9a2190","weight":0.41079754601226987},{"kind":"velocity-burst","description":"1,668 lines of first-party code in ~1.2h (1,347 lines/hour, 3 commit session)","ref":"6b2bcb1ae69f4175742e370c99985451123ceaed","url":"https://github.com/RAIT-09/obsidian-agent-client/commit/6b2bcb1ae69f4175742e370c99985451123ceaed","weight":0.4040008970621215},{"kind":"velocity-burst","description":"3,833 lines of first-party code in ~5.5h (699 lines/hour, 13 commit session)","ref":"f42259d6507e206d91d08b01c7c86cf70980f3a2","url":"https://github.com/RAIT-09/obsidian-agent-client/commit/f42259d6507e206d91d08b01c7c86cf70980f3a2","weight":0.209825130518526},{"kind":"velocity-burst","description":"2,604 lines of first-party code in ~4.5h (585 lines/hour, 6 commit session)","ref":"8deaa8f3d585713c5f487d489824e6e33d0994c2","url":"https://github.com/RAIT-09/obsidian-agent-client/commit/8deaa8f3d585713c5f487d489824e6e33d0994c2","weight":0.17543010417316451},{"kind":"velocity-burst","description":"3,059 lines of first-party code in ~5.5h (554 lines/hour, 5 commit session)","ref":"bc083a42029f9d186cbac6228589ea3e0823b884","url":"https://github.com/RAIT-09/obsidian-agent-client/commit/bc083a42029f9d186cbac6228589ea3e0823b884","weight":0.16622490566037737}],"data":{"flagged_loc_by_commit":{"1df1ba6fe5410cb5c2a9c1c93b23d0d25558ebb9":1545,"86e55d11b13d688026fa8c5680634086f5628172":118,"6b2bcb1ae69f4175742e370c99985451123ceaed":5,"1533355d0f7f1b6ce353fb818da99535cd6ba195":336,"2750f1d500c5dc0a010fe212e0fd51af356e99cd":861,"78378a723e6b5d4c1e70991f6e409c5807350953":750,"d09411ab07bc5b89e59b18fe444159fbc31b3595":195,"9046caa6d452609d0e7da78c8122f47af95e818d":5,"8deaa8f3d585713c5f487d489824e6e33d0994c2":457,"588bb83b16de02c4918212129cd41311cdc6204b":122,"441f109f1cad0602f9ac1370f4bcbfcb3b36102a":162,"9e5f6f1eb034e36234a8fd3c55fbe154ee74f6f8":36,"596246a5124299bdc5b9987f755700aa9e842c15":136,"541765cdfc77d6dd7f41cb415c18b4008abe038c":369,"5f466571288a1347626bfc21b36f7b0ad8e0bd68":435,"cbf19c8efcbc407daf4a940e62825d07fbe8c81b":320,"cd4580d0aa93bd17fab7abbd077d5e8d6c4375e7":977,"a0582225cf4c054829326cf3e9300398442b7f0d":152,"cf317136e138dfeb6c27aa76340bb6ca76bfb713":10,"6b0a7cccf32f21fc0f16d227c4dcdc287664e21a":442,"215a8656f71208d742c2c2d1a721e4ad1613fca7":557,"f42259d6507e206d91d08b01c7c86cf70980f3a2":115,"f18ac3b15363be2faec08cdec16eb5e408cb9730":1004,"0d978929e6c103c673121a0a35237ed679ab9cb6":804,"1a29cbca896b1574b5f420efcd83d024700e46d4":690,"bbf0b0811e8e0efbdaa7794118bc74080e400984":383,"bc083a42029f9d186cbac6228589ea3e0823b884":178,"a7abf66e9baf36dbb9b0868274b046454ce303dc":948,"a64d49b3294ed7141f2403a9d27d44635bdeac98":872,"d2948e20b225ba19652e5607bfcf76792e9a2190":536},"excluded_import_commits":[]},"error":null},{"analyzer":"ai-release-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"releases":87.0,"flagged_releases":3.0,"max_loc_per_day":130704.0},"findings":[],"evidence":[{"kind":"release-burst","description":"0.5.3 → 0.6.0-preview.3: 5,376 lines in 0.05 days (114,321.0 lines/day)","ref":"0.5.3...0.6.0-preview.3","url":"https://github.com/RAIT-09/obsidian-agent-client/compare/0.5.3...0.6.0-preview.3","weight":0.4},{"kind":"release-burst","description":"0.5.4 → 0.6.0-preview.4: 5,439 lines in 0.04 days (130,536.0 lines/day)","ref":"0.5.4...0.6.0-preview.4","url":"https://github.com/RAIT-09/obsidian-agent-client/compare/0.5.4...0.6.0-preview.4","weight":0.4},{"kind":"release-burst","description":"0.5.5 → 0.6.0-preview.5: 5,446 lines in 0.04 days (130,704.0 lines/day)","ref":"0.5.5...0.6.0-preview.5","url":"https://github.com/RAIT-09/obsidian-agent-client/compare/0.5.5...0.6.0-preview.5","weight":0.4}],"data":{"releases":[{"from":"0.1.0","to":"0.1.1","loc":252,"days":4.16,"loc_per_day":60.6,"flagged":false},{"from":"0.1.1","to":"0.1.2","loc":460,"days":1.3,"loc_per_day":353.7,"flagged":false},{"from":"0.1.2","to":"0.1.3","loc":71,"days":0.83,"loc_per_day":85.6,"flagged":false},{"from":"0.1.3","to":"0.1.4","loc":361,"days":1.76,"loc_per_day":204.7,"flagged":false},{"from":"0.1.4","to":"0.1.5","loc":6,"days":0.05,"loc_per_day":112.4,"flagged":false},{"from":"0.1.5","to":"0.1.6","loc":82,"days":1.26,"loc_per_day":65.1,"flagged":false},{"from":"0.1.6","to":"0.1.7","loc":482,"days":3.89,"loc_per_day":123.9,"flagged":false},{"from":"0.1.7","to":"0.1.8","loc":4948,"days":8.97,"loc_per_day":551.9,"flagged":false},{"from":"0.1.8","to":"0.2.0","loc":506,"days":1.16,"loc_per_day":434.8,"flagged":false},{"from":"0.2.0","to":"0.2.1","loc":12,"days":0.04,"loc_per_day":288.0,"flagged":false},{"from":"0.2.1","to":"0.2.2","loc":372,"days":1.0,"loc_per_day":373.8,"flagged":false},{"from":"0.2.2","to":"0.2.3","loc":76,"days":1.79,"loc_per_day":42.6,"flagged":false},{"from":"0.2.3","to":"0.2.4","loc":361,"days":1.21,"loc_per_day":299.4,"flagged":false},{"from":"0.2.4","to":"0.2.5-preview.1","loc":662,"days":7.89,"loc_per_day":83.9,"flagged":false},{"from":"0.2.5-preview.1","to":"0.2.5-preview.2","loc":81,"days":0.91,"loc_per_day":88.7,"flagged":false},{"from":"0.2.5-preview.2","to":"0.2.5","loc":0,"days":1.21,"loc_per_day":0.0,"flagged":false},{"from":"0.2.5","to":"0.3.0-preview.1","loc":591,"days":0.57,"loc_per_day":1030.3,"flagged":false},{"from":"0.3.0-preview.1","to":"0.2.6","loc":18,"days":0.33,"loc_per_day":54.7,"flagged":false},{"from":"0.2.6","to":"0.3.0-preview.2","loc":596,"days":4.49,"loc_per_day":132.6,"flagged":false},{"from":"0.3.0-preview.2","to":"0.3.0-preview.3","loc":67,"days":5.67,"loc_per_day":11.8,"flagged":false},{"from":"0.3.0-preview.3","to":"0.3.0","loc":125,"days":0.48,"loc_per_day":263.0,"flagged":false},{"from":"0.3.0","to":"0.3.1","loc":4075,"days":11.45,"loc_per_day":356.0,"flagged":false},{"from":"0.3.1","to":"0.4.0-preview.1","loc":701,"days":2.66,"loc_per_day":263.3,"flagged":false},{"from":"0.4.0-preview.1","to":"0.4.0-preview.2","loc":29,"days":0.25,"loc_per_day":114.7,"flagged":false},{"from":"0.4.0-preview.2","to":"0.4.0-preview.3","loc":549,"days":10.02,"loc_per_day":54.8,"flagged":false},{"from":"0.4.0-preview.3","to":"0.4.0-preview.4","loc":1,"days":0.04,"loc_per_day":24.0,"flagged":false},{"from":"0.4.0-preview.4","to":"0.4.0","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false},{"from":"0.4.0","to":"0.4.1","loc":90,"days":3.73,"loc_per_day":24.1,"flagged":false},{"from":"0.4.1","to":"0.4.2","loc":152,"days":1.92,"loc_per_day":79.2,"flagged":false},{"from":"0.4.2","to":"0.5.0-preview.1","loc":824,"days":2.26,"loc_per_day":364.2,"flagged":false},{"from":"0.5.0-preview.1","to":"0.5.0-preview.2","loc":470,"days":13.1,"loc_per_day":35.9,"flagged":false},{"from":"0.5.0-preview.2","to":"0.5.0-preview.3","loc":1,"days":0.69,"loc_per_day":1.4,"flagged":false},{"from":"0.5.0-preview.3","to":"0.5.0","loc":303,"days":2.83,"loc_per_day":107.1,"flagged":false},{"from":"0.5.0","to":"0.5.1","loc":49,"days":0.42,"loc_per_day":116.8,"flagged":false},{"from":"0.5.1","to":"0.5.2","loc":78,"days":2.96,"loc_per_day":26.4,"flagged":false},{"from":"0.5.2","to":"0.6.0-preview.1","loc":4917,"days":3.14,"loc_per_day":1566.2,"flagged":false},{"from":"0.6.0-preview.1","to":"0.6.0-preview.2","loc":146,"days":0.99,"loc_per_day":147.8,"flagged":false},{"from":"0.6.0-preview.2","to":"0.5.3","loc":167,"days":1.74,"loc_per_day":95.8,"flagged":false},{"from":"0.5.3","to":"0.6.0-preview.3","loc":5376,"days":0.05,"loc_per_day":114321.0,"flagged":true},{"from":"0.6.0-preview.3","to":"0.5.4","loc":63,"days":1.14,"loc_per_day":55.2,"flagged":false},{"from":"0.5.4","to":"0.6.0-preview.4","loc":5439,"days":0.04,"loc_per_day":130536.0,"flagged":true},{"from":"0.6.0-preview.4","to":"0.5.5","loc":64,"days":1.05,"loc_per_day":61.2,"flagged":false},{"from":"0.5.5","to":"0.6.0-preview.5","loc":5446,"days":0.04,"loc_per_day":130704.0,"flagged":true},{"from":"0.6.0-preview.5","to":"0.6.0","loc":0,"days":1.54,"loc_per_day":0.0,"flagged":false},{"from":"0.6.0","to":"0.6.1","loc":80,"days":0.46,"loc_per_day":175.8,"flagged":false},{"from":"0.6.1","to":"0.7.0-preview.1","loc":1814,"days":2.9,"loc_per_day":626.2,"flagged":false},{"from":"0.7.0-preview.1","to":"0.7.0-preview.2","loc":467,"days":3.81,"loc_per_day":122.6,"flagged":false},{"from":"0.7.0-preview.2","to":"0.7.0-preview.3","loc":175,"days":0.92,"loc_per_day":190.3,"flagged":false},{"from":"0.7.0-preview.3","to":"0.7.0","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false},{"from":"0.7.0","to":"0.7.1","loc":2,"days":0.4,"loc_per_day":5.1,"flagged":false},{"from":"0.7.1","to":"0.7.2","loc":7,"days":0.51,"loc_per_day":13.6,"flagged":false},{"from":"0.7.2","to":"0.7.3","loc":173,"days":0.24,"loc_per_day":735.9,"flagged":false},{"from":"0.7.3","to":"0.7.4","loc":21,"days":2.08,"loc_per_day":10.1,"flagged":false},{"from":"0.7.4","to":"0.7.5","loc":31,"days":3.69,"loc_per_day":8.4,"flagged":false},{"from":"0.7.5","to":"0.8.0-preview.1","loc":5117,"days":6.45,"loc_per_day":793.8,"flagged":false},{"from":"0.8.0-preview.1","to":"0.8.0","loc":540,"days":13.79,"loc_per_day":39.2,"flagged":false},{"from":"0.8.0","to":"0.8.1","loc":31,"days":3.2,"loc_per_day":9.7,"flagged":false},{"from":"0.8.1","to":"0.8.2","loc":30,"days":0.99,"loc_per_day":30.3,"flagged":false},{"from":"0.8.2","to":"0.8.3","loc":18,"days":0.5,"loc_per_day":36.1,"flagged":false},{"from":"0.8.3","to":"0.9.0-preview.1","loc":1806,"days":4.3,"loc_per_day":420.4,"flagged":false},{"from":"0.9.0-preview.1","to":"0.9.0-preview.2","loc":50,"days":4.83,"loc_per_day":10.4,"flagged":false},{"from":"0.9.0-preview.2","to":"0.9.0","loc":7,"days":2.34,"loc_per_day":3.0,"flagged":false},{"from":"0.9.0","to":"0.9.1","loc":142,"days":6.76,"loc_per_day":21.0,"flagged":false},{"from":"0.9.1","to":"0.10.0-preview.1","loc":7550,"days":9.28,"loc_per_day":813.2,"flagged":false},{"from":"0.10.0-preview.1","to":"0.9.2","loc":4,"days":1.86,"loc_per_day":2.1,"flagged":false},{"from":"0.9.2","to":"0.9.3","loc":8,"days":0.09,"loc_per_day":86.9,"flagged":false},{"from":"0.9.3","to":"0.9.4","loc":66,"days":1.1,"loc_per_day":59.8,"flagged":false},{"from":"0.9.4","to":"0.10.0-preview.2","loc":14917,"days":7.72,"loc_per_day":1932.1,"flagged":false},{"from":"0.10.0-preview.2","to":"0.10.0-preview.3","loc":56,"days":0.93,"loc_per_day":60.0,"flagged":false},{"from":"0.10.0-preview.3","to":"0.10.0-preview.4","loc":10,"days":0.26,"loc_per_day":39.0,"flagged":false},{"from":"0.10.0-preview.4","to":"0.10.0-preview.5","loc":47,"days":1.98,"loc_per_day":23.7,"flagged":false},{"from":"0.10.0-preview.5","to":"0.10.0","loc":14,"days":1.01,"loc_per_day":13.9,"flagged":false},{"from":"0.10.0","to":"0.10.1","loc":45,"days":6.94,"loc_per_day":6.5,"flagged":false},{"from":"0.10.1","to":"0.10.2","loc":2,"days":2.05,"loc_per_day":1.0,"flagged":false},{"from":"0.10.2","to":"0.10.3","loc":231,"days":27.1,"loc_per_day":8.5,"flagged":false},{"from":"0.10.3","to":"0.10.4","loc":74,"days":6.93,"loc_per_day":10.7,"flagged":false},{"from":"0.10.4","to":"0.10.5","loc":0,"days":0.05,"loc_per_day":0.0,"flagged":false},{"from":"0.10.5","to":"0.10.6","loc":126,"days":8.97,"loc_per_day":14.1,"flagged":false},{"from":"0.10.6","to":"0.11.0-preview.1","loc":3496,"days":5.98,"loc_per_day":584.5,"flagged":false},{"from":"0.11.0-preview.1","to":"0.11.0-preview.2","loc":1055,"days":14.6,"loc_per_day":72.3,"flagged":false},{"from":"0.11.0-preview.2","to":"0.11.0","loc":216,"days":4.44,"loc_per_day":48.6,"flagged":false},{"from":"0.11.0","to":"0.12.0-preview.1","loc":7842,"days":22.02,"loc_per_day":356.1,"flagged":false},{"from":"0.12.0-preview.1","to":"0.12.0-preview.2","loc":28,"days":3.94,"loc_per_day":7.1,"flagged":false},{"from":"0.12.0-preview.2","to":"0.12.0","loc":166,"days":16.64,"loc_per_day":10.0,"flagged":false},{"from":"0.12.0","to":"0.12.1","loc":6,"days":8.36,"loc_per_day":0.7,"flagged":false},{"from":"0.12.1","to":"0.13.0-preview.1","loc":2493,"days":20.65,"loc_per_day":120.7,"flagged":false},{"from":"0.13.0-preview.1","to":"0.13.0","loc":38,"days":9.98,"loc_per_day":3.8,"flagged":false}]},"error":null},{"analyzer":"ai-stylometry","pillar":"ai_provenance","status":"ok","tool_version":null,"metrics":{"lines_scanned":27032.0,"index":0.129,"count:narrated_steps":0.0,"per_kloc:narrated_steps":0.0,"files:narrated_steps":0.0,"count:placeholder":0.0,"per_kloc:placeholder":0.0,"files:placeholder":0.0,"count:emoji_in_code":7.0,"per_kloc:emoji_in_code":0.259,"files:emoji_in_code":3.0,"count:assistant_voice":0.0,"per_kloc:assistant_voice":0.0,"files:assistant_voice":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-secrets","pillar":"security","status":"ok","tool_version":"gitleaks 8.30.1","metrics":{"secrets_current":0.0,"secrets_history":0.0,"secrets_nonprod":0.0,"secrets_low_confidence":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-sast","pillar":"security","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":15.0,"findings_high":3.0,"findings_medium":12.0,"findings_low":0.0,"weighted_findings":5.25,"scanned_lines":27032.0,"parse_errors":2.0},"findings":[{"rule_id":"opengrep/javascript.lang.security.audit.spawn-shell-true","severity":"high","message":"Found '$SPAWN' with '{shell: needsShell}'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use '{shell: false}' instead. [confidence low]","path":"src/acp/acp-client.ts","line":256,"fingerprint":"javascript.lang.security.audit.spawn-shell-true:src/acp/acp-client.ts:256"},{"rule_id":"opengrep/javascript.lang.security.detect-child-process","severity":"high","message":"Detected calls to child_process from a function argument `config`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed. [confidence low]","path":"src/acp/acp-client.ts","line":256,"fingerprint":"javascript.lang.security.detect-child-process:src/acp/acp-client.ts:256"},{"rule_id":"opengrep/javascript.lang.security.detect-child-process","severity":"high","message":"Detected calls to child_process from a function argument `params`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed. [confidence low]","path":"src/acp/terminal-handler.ts","line":124,"fingerprint":"javascript.lang.security.detect-child-process:src/acp/terminal-handler.ts:124"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/services/message-sender.ts","line":608,"fingerprint":"javascript.lang.security.html-in-template-string:src/services/message-sender.ts:608"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/services/message-sender.ts","line":643,"fingerprint":"javascript.lang.security.html-in-template-string:src/services/message-sender.ts:643"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/services/message-sender.ts","line":793,"fingerprint":"javascript.lang.security.html-in-template-string:src/services/message-sender.ts:793"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/services/message-sender.ts","line":801,"fingerprint":"javascript.lang.security.html-in-template-string:src/services/message-sender.ts:801"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/services/message-sender.ts","line":820,"fingerprint":"javascript.lang.security.html-in-template-string:src/services/message-sender.ts:820"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"src/utils/paths.ts","line":46,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:src/utils/paths.ts:46"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `command` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"src/utils/paths.ts","line":48,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:src/utils/paths.ts:48"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `command` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"src/utils/paths.ts","line":50,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:src/utils/paths.ts:50"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/utils/wikilink-formatter.ts","line":51,"fingerprint":"javascript.lang.security.html-in-template-string:src/utils/wikilink-formatter.ts:51"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/utils/wikilink-formatter.ts","line":54,"fingerprint":"javascript.lang.security.html-in-template-string:src/utils/wikilink-formatter.ts:54"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/utils/wikilink-formatter.ts","line":72,"fingerprint":"javascript.lang.security.html-in-template-string:src/utils/wikilink-formatter.ts:72"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/utils/wikilink-formatter.ts","line":83,"fingerprint":"javascript.lang.security.html-in-template-string:src/utils/wikilink-formatter.ts:83"}],"evidence":[],"data":{"rulesets":["typescript","javascript","bash"]},"error":null},{"analyzer":"sec-deps","pillar":"security","status":"ok","tool_version":"osv-scanner version: 2.7.1","metrics":{"vulnerable_packages":20.0,"vulnerabilities":61.0,"vulns_critical":0.0,"vulns_high":33.0,"vulns_medium":24.0,"vulns_low":4.0,"vulns_unknown":0.0,"penalty":120.0},"findings":[{"rule_id":"osv/GHSA-g2v6-rqmx-r4w6","severity":"high","message":"@vue/server-renderer@3.5.35 (npm) is affected by GHSA-g2v6-rqmx-r4w6","path":"package-lock.json","line":null,"fingerprint":"@vue/server-renderer@3.5.35 (npm):GHSA-g2v6-rqmx-r4w6"},{"rule_id":"osv/GHSA-3jxr-9vmj-r5cp","severity":"high","message":"brace-expansion@1.1.15 (npm) is affected by GHSA-3jxr-9vmj-r5cp","path":"package-lock.json","line":null,"fingerprint":"brace-expansion@1.1.15 (npm):GHSA-3jxr-9vmj-r5cp"},{"rule_id":"osv/GHSA-6j4f-fj2g-mc7p","severity":"high","message":"brace-expansion@1.1.15 (npm) is affected by GHSA-6j4f-fj2g-mc7p","path":"package-lock.json","line":null,"fingerprint":"brace-expansion@1.1.15 (npm):GHSA-6j4f-fj2g-mc7p"},{"rule_id":"osv/GHSA-mh99-v99m-4gvg","severity":"high","message":"brace-expansion@1.1.15 (npm) is affected by GHSA-mh99-v99m-4gvg","path":"package-lock.json","line":null,"fingerprint":"brace-expansion@1.1.15 (npm):GHSA-mh99-v99m-4gvg"},{"rule_id":"osv/GHSA-qhr7-859c-m2p7","severity":"high","message":"brace-expansion@1.1.15 (npm) is affected by GHSA-qhr7-859c-m2p7","path":"package-lock.json","line":null,"fingerprint":"brace-expansion@1.1.15 (npm):GHSA-qhr7-859c-m2p7"},{"rule_id":"osv/GHSA-rgw5-rvv9-x895","severity":"high","message":"brace-expansion@1.1.15 (npm) is affected by GHSA-rgw5-rvv9-x895","path":"package-lock.json","line":null,"fingerprint":"brace-expansion@1.1.15 (npm):GHSA-rgw5-rvv9-x895"},{"rule_id":"osv/GHSA-3jxr-9vmj-r5cp","severity":"high","message":"brace-expansion@2.1.1 (npm) is affected by GHSA-3jxr-9vmj-r5cp","path":"package-lock.json","line":null,"fingerprint":"brace-expansion@2.1.1 (npm):GHSA-3jxr-9vmj-r5cp"},{"rule_id":"osv/GHSA-6j4f-fj2g-mc7p","severity":"high","message":"brace-expansion@2.1.1 (npm) is affected by GHSA-6j4f-fj2g-mc7p","path":"package-lock.json","line":null,"fingerprint":"brace-expansion@2.1.1 (npm):GHSA-6j4f-fj2g-mc7p"},{"rule_id":"osv/GHSA-mh99-v99m-4gvg","severity":"high","message":"brace-expansion@2.1.1 (npm) is affected by GHSA-mh99-v99m-4gvg","path":"package-lock.json","line":null,"fingerprint":"brace-expansion@2.1.1 (npm):GHSA-mh99-v99m-4gvg"},{"rule_id":"osv/GHSA-qhr7-859c-m2p7","severity":"high","message":"brace-expansion@2.1.1 (npm) is affected by GHSA-qhr7-859c-m2p7","path":"package-lock.json","line":null,"fingerprint":"brace-expansion@2.1.1 (npm):GHSA-qhr7-859c-m2p7"},{"rule_id":"osv/GHSA-rgw5-rvv9-x895","severity":"high","message":"brace-expansion@2.1.1 (npm) is affected by GHSA-rgw5-rvv9-x895","path":"package-lock.json","line":null,"fingerprint":"brace-expansion@2.1.1 (npm):GHSA-rgw5-rvv9-x895"},{"rule_id":"osv/GHSA-3jxr-9vmj-r5cp","severity":"high","message":"brace-expansion@5.0.6 (npm) is affected by GHSA-3jxr-9vmj-r5cp","path":"package-lock.json","line":null,"fingerprint":"brace-expansion@5.0.6 (npm):GHSA-3jxr-9vmj-r5cp"},{"rule_id":"osv/GHSA-6j4f-fj2g-mc7p","severity":"high","message":"brace-expansion@5.0.6 (npm) is affected by GHSA-6j4f-fj2g-mc7p","path":"package-lock.json","line":null,"fingerprint":"brace-expansion@5.0.6 (npm):GHSA-6j4f-fj2g-mc7p"},{"rule_id":"osv/GHSA-mh99-v99m-4gvg","severity":"high","message":"brace-expansion@5.0.6 (npm) is affected by GHSA-mh99-v99m-4gvg","path":"package-lock.json","line":null,"fingerprint":"brace-expansion@5.0.6 (npm):GHSA-mh99-v99m-4gvg"},{"rule_id":"osv/GHSA-qhr7-859c-m2p7","severity":"high","message":"brace-expansion@5.0.6 (npm) is affected by GHSA-qhr7-859c-m2p7","path":"package-lock.json","line":null,"fingerprint":"brace-expansion@5.0.6 (npm):GHSA-qhr7-859c-m2p7"},{"rule_id":"osv/GHSA-rgw5-rvv9-x895","severity":"high","message":"brace-expansion@5.0.6 (npm) is affected by GHSA-rgw5-rvv9-x895","path":"package-lock.json","line":null,"fingerprint":"brace-expansion@5.0.6 (npm):GHSA-rgw5-rvv9-x895"},{"rule_id":"osv/GHSA-4c8g-83qw-93j6","severity":"high","message":"fast-uri@3.1.2 (npm) is affected by GHSA-4c8g-83qw-93j6","path":"package-lock.json","line":null,"fingerprint":"fast-uri@3.1.2 (npm):GHSA-4c8g-83qw-93j6"},{"rule_id":"osv/GHSA-7p8r-x3mc-p8w7","severity":"high","message":"fast-uri@3.1.2 (npm) is affected by GHSA-7p8r-x3mc-p8w7","path":"package-lock.json","line":null,"fingerprint":"fast-uri@3.1.2 (npm):GHSA-7p8r-x3mc-p8w7"},{"rule_id":"osv/GHSA-f65p-4m7j-42xc","severity":"high","message":"fast-uri@3.1.2 (npm) is affected by GHSA-f65p-4m7j-42xc","path":"package-lock.json","line":null,"fingerprint":"fast-uri@3.1.2 (npm):GHSA-f65p-4m7j-42xc"},{"rule_id":"osv/GHSA-fph4-wmhf-6fwf","severity":"high","message":"fast-uri@3.1.2 (npm) is affected by GHSA-fph4-wmhf-6fwf","path":"package-lock.json","line":null,"fingerprint":"fast-uri@3.1.2 (npm):GHSA-fph4-wmhf-6fwf"},{"rule_id":"osv/GHSA-jqff-g426-hqxp","severity":"high","message":"fast-uri@3.1.2 (npm) is affected by GHSA-jqff-g426-hqxp","path":"package-lock.json","line":null,"fingerprint":"fast-uri@3.1.2 (npm):GHSA-jqff-g426-hqxp"},{"rule_id":"osv/GHSA-qw65-cvwx-89v3","severity":"high","message":"fast-uri@3.1.2 (npm) is affected by GHSA-qw65-cvwx-89v3","path":"package-lock.json","line":null,"fingerprint":"fast-uri@3.1.2 (npm):GHSA-qw65-cvwx-89v3"},{"rule_id":"osv/GHSA-v2hh-gcrm-f6hx","severity":"high","message":"fast-uri@3.1.2 (npm) is affected by GHSA-v2hh-gcrm-f6hx","path":"package-lock.json","line":null,"fingerprint":"fast-uri@3.1.2 (npm):GHSA-v2hh-gcrm-f6hx"},{"rule_id":"osv/GHSA-2883-xcg3-v3hh","severity":"high","message":"js-yaml@4.2.0 (npm) is affected by GHSA-2883-xcg3-v3hh","path":"package-lock.json","line":null,"fingerprint":"js-yaml@4.2.0 (npm):GHSA-2883-xcg3-v3hh"},{"rule_id":"osv/GHSA-52cp-r559-cp3m","severity":"high","message":"js-yaml@4.2.0 (npm) is affected by GHSA-52cp-r559-cp3m","path":"package-lock.json","line":null,"fingerprint":"js-yaml@4.2.0 (npm):GHSA-52cp-r559-cp3m"},{"rule_id":"osv/GHSA-5p4m-2wfm-xmqj","severity":"high","message":"js-yaml@4.2.0 (npm) is affected by GHSA-5p4m-2wfm-xmqj","path":"package-lock.json","line":null,"fingerprint":"js-yaml@4.2.0 (npm):GHSA-5p4m-2wfm-xmqj"},{"rule_id":"osv/GHSA-28wg-ghj8-5hjv","severity":"high","message":"nanoid@3.3.12 (npm) is affected by GHSA-28wg-ghj8-5hjv","path":"package-lock.json","line":null,"fingerprint":"nanoid@3.3.12 (npm):GHSA-28wg-ghj8-5hjv"},{"rule_id":"osv/GHSA-2v37-7h3g-55p8","severity":"high","message":"nanoid@3.3.12 (npm) is affected by GHSA-2v37-7h3g-55p8","path":"package-lock.json","line":null,"fingerprint":"nanoid@3.3.12 (npm):GHSA-2v37-7h3g-55p8"},{"rule_id":"osv/GHSA-r28c-9q8g-f849","severity":"high","message":"postcss@8.5.15 (npm) is affected by GHSA-r28c-9q8g-f849","path":"package-lock.json","line":null,"fingerprint":"postcss@8.5.15 (npm):GHSA-r28c-9q8g-f849"},{"rule_id":"osv/GHSA-68fv-2mgg-jv7q","severity":"high","message":"source-map-js@1.2.1 (npm) is affected by GHSA-68fv-2mgg-jv7q","path":"package-lock.json","line":null,"fingerprint":"source-map-js@1.2.1 (npm):GHSA-68fv-2mgg-jv7q"},{"rule_id":"osv/GHSA-587h-7wmj-h5pm","severity":"high","message":"vite@5.4.21 (npm) is affected by GHSA-587h-7wmj-h5pm","path":"package-lock.json","line":null,"fingerprint":"vite@5.4.21 (npm):GHSA-587h-7wmj-h5pm"},{"rule_id":"osv/GHSA-587h-7wmj-h5pm","severity":"high","message":"vite@8.0.16 (npm) is affected by GHSA-587h-7wmj-h5pm","path":"package-lock.json","line":null,"fingerprint":"vite@8.0.16 (npm):GHSA-587h-7wmj-h5pm"},{"rule_id":"osv/GHSA-mrhx-c7xc-m3w5","severity":"high","message":"zod@4.4.3 (npm) is affected by GHSA-mrhx-c7xc-m3w5","path":"package-lock.json","line":null,"fingerprint":"zod@4.4.3 (npm):GHSA-mrhx-c7xc-m3w5"},{"rule_id":"osv/GHSA-82fw-gwwq-j7x9","severity":"medium","message":"@vitest/mocker@4.1.8 (npm) is affected by GHSA-82fw-gwwq-j7x9","path":"package-lock.json","line":null,"fingerprint":"@vitest/mocker@4.1.8 (npm):GHSA-82fw-gwwq-j7x9"},{"rule_id":"osv/GHSA-qxg6-89mg-rqv8","severity":"medium","message":"@vitest/mocker@4.1.8 (npm) is affected by GHSA-qxg6-89mg-rqv8","path":"package-lock.json","line":null,"fingerprint":"@vitest/mocker@4.1.8 (npm):GHSA-qxg6-89mg-rqv8"},{"rule_id":"osv/GHSA-q2hr-2g5m-vwhr","severity":"medium","message":"brace-expansion@1.1.15 (npm) is affected by GHSA-q2hr-2g5m-vwhr","path":"package-lock.json","line":null,"fingerprint":"brace-expansion@1.1.15 (npm):GHSA-q2hr-2g5m-vwhr"},{"rule_id":"osv/GHSA-q2hr-2g5m-vwhr","severity":"medium","message":"brace-expansion@2.1.1 (npm) is affected by GHSA-q2hr-2g5m-vwhr","path":"package-lock.json","line":null,"fingerprint":"brace-expansion@2.1.1 (npm):GHSA-q2hr-2g5m-vwhr"},{"rule_id":"osv/GHSA-q2hr-2g5m-vwhr","severity":"medium","message":"brace-expansion@5.0.6 (npm) is affected by GHSA-q2hr-2g5m-vwhr","path":"package-lock.json","line":null,"fingerprint":"brace-expansion@5.0.6 (npm):GHSA-q2hr-2g5m-vwhr"},{"rule_id":"osv/GHSA-67mh-4wv8-2f99","severity":"medium","message":"esbuild@0.17.3 (npm) is affected by GHSA-67mh-4wv8-2f99","path":"package-lock.json","line":null,"fingerprint":"esbuild@0.17.3 (npm):GHSA-67mh-4wv8-2f99"},{"rule_id":"osv/GHSA-67mh-4wv8-2f99","severity":"medium","message":"esbuild@0.21.5 (npm) is affected by GHSA-67mh-4wv8-2f99","path":"package-lock.json","line":null,"fingerprint":"esbuild@0.21.5 (npm):GHSA-67mh-4wv8-2f99"},{"rule_id":"osv/GHSA-hrr3-gc8f-f4qj","severity":"medium","message":"fast-uri@3.1.2 (npm) is affected by GHSA-hrr3-gc8f-f4qj","path":"package-lock.json","line":null,"fingerprint":"fast-uri@3.1.2 (npm):GHSA-hrr3-gc8f-f4qj"},{"rule_id":"osv/GHSA-w74x-v6f9-j3xg","severity":"medium","message":"fast-uri@3.1.2 (npm) is affected by GHSA-w74x-v6f9-j3xg","path":"package-lock.json","line":null,"fingerprint":"fast-uri@3.1.2 (npm):GHSA-w74x-v6f9-j3xg"},{"rule_id":"osv/GHSA-g3hv-75wg-m249","severity":"medium","message":"minimatch@10.2.5 (npm) is affected by GHSA-g3hv-75wg-m249","path":"package-lock.json","line":null,"fingerprint":"minimatch@10.2.5 (npm):GHSA-g3hv-75wg-m249"},{"rule_id":"osv/GHSA-g3hv-75wg-m249","severity":"medium","message":"minimatch@8.0.7 (npm) is affected by GHSA-g3hv-75wg-m249","path":"package-lock.json","line":null,"fingerprint":"minimatch@8.0.7 (npm):GHSA-g3hv-75wg-m249"},{"rule_id":"osv/GHSA-g3hv-75wg-m249","severity":"medium","message":"minimatch@9.0.9 (npm) is affected by GHSA-g3hv-75wg-m249","path":"package-lock.json","line":null,"fingerprint":"minimatch@9.0.9 (npm):GHSA-g3hv-75wg-m249"},{"rule_id":"osv/GHSA-4p3w-j4w9-5jqw","severity":"medium","message":"moment@2.29.4 (npm) is affected by GHSA-4p3w-j4w9-5jqw","path":"package-lock.json","line":null,"fingerprint":"moment@2.29.4 (npm):GHSA-4p3w-j4w9-5jqw"},{"rule_id":"osv/GHSA-fxqj-rqcc-2cmp","severity":"medium","message":"postcss@8.5.15 (npm) is affected by GHSA-fxqj-rqcc-2cmp","path":"package-lock.json","line":null,"fingerprint":"postcss@8.5.15 (npm):GHSA-fxqj-rqcc-2cmp"},{"rule_id":"osv/GHSA-4w7w-66w2-5vf9","severity":"medium","message":"vite@5.4.21 (npm) is affected by GHSA-4w7w-66w2-5vf9","path":"package-lock.json","line":null,"fingerprint":"vite@5.4.21 (npm):GHSA-4w7w-66w2-5vf9"},{"rule_id":"osv/GHSA-698v-4r3x-3vcv","severity":"medium","message":"vite@5.4.21 (npm) is affected by GHSA-698v-4r3x-3vcv","path":"package-lock.json","line":null,"fingerprint":"vite@5.4.21 (npm):GHSA-698v-4r3x-3vcv"},{"rule_id":"osv/GHSA-fx2h-pf6j-xcff","severity":"medium","message":"vite@5.4.21 (npm) is affected by GHSA-fx2h-pf6j-xcff","path":"package-lock.json","line":null,"fingerprint":"vite@5.4.21 (npm):GHSA-fx2h-pf6j-xcff"},{"rule_id":"osv/GHSA-r825-w8mm-5pxw","severity":"medium","message":"vite@5.4.21 (npm) is affected by GHSA-r825-w8mm-5pxw","path":"package-lock.json","line":null,"fingerprint":"vite@5.4.21 (npm):GHSA-r825-w8mm-5pxw"},{"rule_id":"osv/GHSA-rq7h-c2jc-7f22","severity":"medium","message":"vite@5.4.21 (npm) is affected by GHSA-rq7h-c2jc-7f22","path":"package-lock.json","line":null,"fingerprint":"vite@5.4.21 (npm):GHSA-rq7h-c2jc-7f22"},{"rule_id":"osv/GHSA-v6wh-96g9-6wx3","severity":"medium","message":"vite@5.4.21 (npm) is affected by GHSA-v6wh-96g9-6wx3","path":"package-lock.json","line":null,"fingerprint":"vite@5.4.21 (npm):GHSA-v6wh-96g9-6wx3"},{"rule_id":"osv/GHSA-698v-4r3x-3vcv","severity":"medium","message":"vite@8.0.16 (npm) is affected by GHSA-698v-4r3x-3vcv","path":"package-lock.json","line":null,"fingerprint":"vite@8.0.16 (npm):GHSA-698v-4r3x-3vcv"},{"rule_id":"osv/GHSA-r825-w8mm-5pxw","severity":"medium","message":"vite@8.0.16 (npm) is affected by GHSA-r825-w8mm-5pxw","path":"package-lock.json","line":null,"fingerprint":"vite@8.0.16 (npm):GHSA-r825-w8mm-5pxw"},{"rule_id":"osv/GHSA-rq7h-c2jc-7f22","severity":"medium","message":"vite@8.0.16 (npm) is affected by GHSA-rq7h-c2jc-7f22","path":"package-lock.json","line":null,"fingerprint":"vite@8.0.16 (npm):GHSA-rq7h-c2jc-7f22"},{"rule_id":"osv/GHSA-82fw-gwwq-j7x9","severity":"medium","message":"vitest@4.1.8 (npm) is affected by GHSA-82fw-gwwq-j7x9","path":"package-lock.json","line":null,"fingerprint":"vitest@4.1.8 (npm):GHSA-82fw-gwwq-j7x9"},{"rule_id":"osv/GHSA-333x-w4r6-6crp","severity":"low","message":"fast-uri@3.1.2 (npm) is affected by GHSA-333x-w4r6-6crp","path":"package-lock.json","line":null,"fingerprint":"fast-uri@3.1.2 (npm):GHSA-333x-w4r6-6crp"},{"rule_id":"osv/GHSA-xhq7-xmqj-769h","severity":"low","message":"fast-uri@3.1.2 (npm) is affected by GHSA-xhq7-xmqj-769h","path":"package-lock.json","line":null,"fingerprint":"fast-uri@3.1.2 (npm):GHSA-xhq7-xmqj-769h"},{"rule_id":"osv/GHSA-9jrq-w75r-8gcw","severity":"low","message":"vite@5.4.21 (npm) is affected by GHSA-9jrq-w75r-8gcw","path":"package-lock.json","line":null,"fingerprint":"vite@5.4.21 (npm):GHSA-9jrq-w75r-8gcw"},{"rule_id":"osv/GHSA-9jrq-w75r-8gcw","severity":"low","message":"vite@8.0.16 (npm) is affected by GHSA-9jrq-w75r-8gcw","path":"package-lock.json","line":null,"fingerprint":"vite@8.0.16 (npm):GHSA-9jrq-w75r-8gcw"}],"evidence":[],"data":{"ecosystems":["npm"]},"error":null},{"analyzer":"sec-actions","pillar":"security","status":"ok","tool_version":"zizmor 1.32.0","metrics":{"workflows":4.0,"findings":16.0,"findings_high":12.0,"findings_medium":4.0,"findings_low":0.0,"penalty":132.0},"findings":[{"rule_id":"zizmor/excessive-permissions","severity":"high","message":"overly broad permissions [confidence high]","path":".github/workflows/docs.yml","line":13,"fingerprint":"excessive-permissions:.github/workflows/docs.yml:13"},{"rule_id":"zizmor/excessive-permissions","severity":"high","message":"overly broad permissions [confidence high]","path":".github/workflows/docs.yml","line":14,"fingerprint":"excessive-permissions:.github/workflows/docs.yml:14"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/docs.yml","line":25,"fingerprint":"unpinned-uses:.github/workflows/docs.yml:25"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/docs.yml","line":30,"fingerprint":"unpinned-uses:.github/workflows/docs.yml:30"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/docs.yml","line":36,"fingerprint":"unpinned-uses:.github/workflows/docs.yml:36"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/docs.yml","line":45,"fingerprint":"unpinned-uses:.github/workflows/docs.yml:45"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/docs.yml","line":58,"fingerprint":"unpinned-uses:.github/workflows/docs.yml:58"},{"rule_id":"zizmor/dangerous-triggers","severity":"high","message":"use of fundamentally insecure workflow trigger [confidence medium]","path":".github/workflows/relay_to_openclaw.yml","line":16,"fingerprint":"dangerous-triggers:.github/workflows/relay_to_openclaw.yml:16"},{"rule_id":"zizmor/dangerous-triggers","severity":"high","message":"use of fundamentally insecure workflow trigger [confidence medium]","path":".github/workflows/relay_to_openclaw.yml","line":14,"fingerprint":"dangerous-triggers:.github/workflows/relay_to_openclaw.yml:14"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/release.yaml","line":16,"fingerprint":"unpinned-uses:.github/workflows/release.yaml:16"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/release.yaml","line":19,"fingerprint":"unpinned-uses:.github/workflows/release.yaml:19"},{"rule_id":"zizmor/cache-poisoning","severity":"high","message":"runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low]","path":".github/workflows/release.yaml","line":19,"fingerprint":"cache-poisoning:.github/workflows/release.yaml:19"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/ci.yaml","line":12,"fingerprint":"artipacked:.github/workflows/ci.yaml:12"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/docs.yml","line":24,"fingerprint":"artipacked:.github/workflows/docs.yml:24"},{"rule_id":"zizmor/excessive-permissions","severity":"medium","message":"overly broad permissions [confidence medium]","path":".github/workflows/relay_to_openclaw.yml","line":26,"fingerprint":"excessive-permissions:.github/workflows/relay_to_openclaw.yml:26"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/release.yaml","line":16,"fingerprint":"artipacked:.github/workflows/release.yaml:16"}],"evidence":[],"data":{},"error":null},{"analyzer":"sec-posture","pillar":"security","status":"ok","tool_version":null,"metrics":{"check:security_policy":0.0,"check:dependency_updates":0.0,"check:signed_commits":0.0,"check:lockfiles":1.0,"signed_commit_share":0.005,"unpinned_manifests":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-distribution","pillar":"security","status":"ok","tool_version":null,"metrics":{"signals":0.0,"binary_assets":0.0,"suspicious":0.0},"findings":[],"evidence":[],"data":{"signals":[],"suspicious":false,"unusual_traction":false,"metadata":true},"error":null},{"analyzer":"qual-complexity","pillar":"quality","status":"ok","tool_version":"lizard 1.25.1","metrics":{"functions":1425.0,"function_nloc":16410.0,"mean_ccn":2.48,"p90_ccn":5.0,"complex_functions":15.0,"long_functions":10.0,"many_param_functions":1.0,"risky_nloc_share":0.1555},"findings":[],"evidence":[{"kind":"complex-function","description":"SessionHistoryContent in src/ui/SessionHistoryModal.tsx: complexity 27, 141 lines","ref":"src/ui/SessionHistoryModal.tsx","url":"https://github.com/RAIT-09/obsidian-agent-client/blob/3d069c91636588be4e65d955e670403a9ea642d8/src/ui/SessionHistoryModal.tsx#L411","weight":0.45},{"kind":"complex-function","description":"InputArea in src/ui/InputArea.tsx: complexity 26, 265 lines","ref":"src/ui/InputArea.tsx","url":"https://github.com/RAIT-09/obsidian-agent-client/blob/3d069c91636588be4e65d955e670403a9ea642d8/src/ui/InputArea.tsx#L275","weight":0.43333333333333335},{"kind":"complex-function","description":"parseAgentBlock in src/utils/agent-block-parser.ts: complexity 26, 103 lines","ref":"src/utils/agent-block-parser.ts","url":"https://github.com/RAIT-09/obsidian-agent-client/blob/3d069c91636588be4e65d955e670403a9ea642d8/src/utils/agent-block-parser.ts#L173","weight":0.43333333333333335},{"kind":"complex-function","description":"initialize in src/acp/acp-client.ts: complexity 22, 186 lines","ref":"src/acp/acp-client.ts","url":"https://github.com/RAIT-09/obsidian-agent-client/blob/3d069c91636588be4e65d955e670403a9ea642d8/src/acp/acp-client.ts#L124","weight":0.36666666666666664},{"kind":"complex-function","description":"sessionUpdate in src/acp/acp-handler.ts: complexity 21, 107 lines","ref":"src/acp/acp-handler.ts","url":"https://github.com/RAIT-09/obsidian-agent-client/blob/3d069c91636588be4e65d955e670403a9ea642d8/src/acp/acp-handler.ts#L67","weight":0.35},{"kind":"complex-function","description":"toToolCallContent in src/acp/type-converter.ts: complexity 21, 94 lines","ref":"src/acp/type-converter.ts","url":"https://github.com/RAIT-09/obsidian-agent-client/blob/3d069c91636588be4e65d955e670403a9ea642d8/src/acp/type-converter.ts#L59","weight":0.35},{"kind":"complex-function","description":"ChatPanel in src/ui/ChatPanel.tsx: complexity 20, 483 lines","ref":"src/ui/ChatPanel.tsx","url":"https://github.com/RAIT-09/obsidian-agent-client/blob/3d069c91636588be4e65d955e670403a9ea642d8/src/ui/ChatPanel.tsx#L205","weight":0.3333333333333333},{"kind":"complex-function","description":"toInitializeResult in src/acp/type-converter.ts: complexity 19, 44 lines","ref":"src/acp/type-converter.ts","url":"https://github.com/RAIT-09/obsidian-agent-client/blob/3d069c91636588be4e65d955e670403a9ea642d8/src/acp/type-converter.ts#L300","weight":0.31666666666666665},{"kind":"complex-function","description":"(anonymous) in src/hooks/useAgentMessages.ts: complexity 19, 131 lines","ref":"src/hooks/useAgentMessages.ts","url":"https://github.com/RAIT-09/obsidian-agent-client/blob/3d069c91636588be4e65d955e670403a9ea642d8/src/hooks/useAgentMessages.ts#L287","weight":0.31666666666666665},{"kind":"complex-function","description":"computeDiffLines in src/utils/diff-lines.ts: complexity 18, 80 lines","ref":"src/utils/diff-lines.ts","url":"https://github.com/RAIT-09/obsidian-agent-client/blob/3d069c91636588be4e65d955e670403a9ea642d8/src/utils/diff-lines.ts#L50","weight":0.3}],"data":{},"error":null},{"analyzer":"qual-duplication","pillar":"quality","status":"ok","tool_version":"repotrust-dup-w6","metrics":{"compared_lines":18944.0,"duplicated_lines":851.0,"duplicated_share":0.0449,"files":81.0},"findings":[],"evidence":[{"kind":"duplicate-code","description":"6+ duplicated lines: src/acp/acp-client.ts:515 and src/acp/acp-client.ts:1002","ref":"src/acp/acp-client.ts","url":"https://github.com/RAIT-09/obsidian-agent-client/blob/3d069c91636588be4e65d955e670403a9ea642d8/src/acp/acp-client.ts#L515","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: src/hooks/useAgent.ts:53 and src/hooks/useAgentSession.ts:46","ref":"src/hooks/useAgent.ts","url":"https://github.com/RAIT-09/obsidian-agent-client/blob/3d069c91636588be4e65d955e670403a9ea642d8/src/hooks/useAgent.ts#L53","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: src/hooks/useAgent.ts:76 and src/hooks/useAgentMessages.ts:63","ref":"src/hooks/useAgent.ts","url":"https://github.com/RAIT-09/obsidian-agent-client/blob/3d069c91636588be4e65d955e670403a9ea642d8/src/hooks/useAgent.ts#L76","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: src/hooks/useChatActions.ts:378 and src/ui/ChatPanel.tsx:447","ref":"src/hooks/useChatActions.ts","url":"https://github.com/RAIT-09/obsidian-agent-client/blob/3d069c91636588be4e65d955e670403a9ea642d8/src/hooks/useChatActions.ts#L378","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: src/hooks/useHistoryModal.ts:160 and src/hooks/useHistoryModal.ts:219","ref":"src/hooks/useHistoryModal.ts","url":"https://github.com/RAIT-09/obsidian-agent-client/blob/3d069c91636588be4e65d955e670403a9ea642d8/src/hooks/useHistoryModal.ts#L160","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: src/hooks/useSessionHistory.ts:108 and src/ui/SessionHistoryModal.tsx:100","ref":"src/hooks/useSessionHistory.ts","url":"https://github.com/RAIT-09/obsidian-agent-client/blob/3d069c91636588be4e65d955e670403a9ea642d8/src/hooks/useSessionHistory.ts#L108","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: src/hooks/useSessionHistory.ts:553 and src/hooks/useSessionHistory.ts:568","ref":"src/hooks/useSessionHistory.ts","url":"https://github.com/RAIT-09/obsidian-agent-client/blob/3d069c91636588be4e65d955e670403a9ea642d8/src/hooks/useSessionHistory.ts#L553","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: src/plugin.ts:669 and src/plugin.ts:778","ref":"src/plugin.ts","url":"https://github.com/RAIT-09/obsidian-agent-client/blob/3d069c91636588be4e65d955e670403a9ea642d8/src/plugin.ts#L669","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: src/services/message-sender.ts:112 and src/types/chat.ts:206","ref":"src/services/message-sender.ts","url":"https://github.com/RAIT-09/obsidian-agent-client/blob/3d069c91636588be4e65d955e670403a9ea642d8/src/services/message-sender.ts#L112","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: src/services/message-sender.ts:466 and src/services/message-sender.ts:579","ref":"src/services/message-sender.ts","url":"https://github.com/RAIT-09/obsidian-agent-client/blob/3d069c91636588be4e65d955e670403a9ea642d8/src/services/message-sender.ts#L466","weight":0.3}],"data":{},"error":null},{"analyzer":"qual-lint","pillar":"quality","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":7.0,"weighted_findings":7.0,"scanned_lines":27032.0,"category:best-practice":7.0},"findings":[{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"src/ui/ChangeDirectoryModal.ts","line":97,"fingerprint":"javascript.lang.best-practice.lazy-load-module:src/ui/ChangeDirectoryModal.ts:97"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"src/ui/ChatHeader.tsx","line":472,"fingerprint":"typescript.react.best-practice.react-props-spreading:src/ui/ChatHeader.tsx:472"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"src/ui/ChatHeader.tsx","line":475,"fingerprint":"typescript.react.best-practice.react-props-spreading:src/ui/ChatHeader.tsx:475"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"src/ui/ChatHeader.tsx","line":477,"fingerprint":"typescript.react.best-practice.react-props-spreading:src/ui/ChatHeader.tsx:477"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"src/ui/InputArea.tsx","line":438,"fingerprint":"javascript.lang.best-practice.lazy-load-module:src/ui/InputArea.tsx:438"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"src/ui/PlanStrip.tsx","line":38,"fingerprint":"typescript.react.best-practice.react-props-spreading:src/ui/PlanStrip.tsx:38"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"src/ui/ToolCallBlock.tsx","line":101,"fingerprint":"typescript.react.best-practice.react-props-spreading:src/ui/ToolCallBlock.tsx:101"}],"evidence":[],"data":{},"error":null},{"analyzer":"qual-testing","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:has_tests":1.0,"check:test_ratio":0.2334,"check:ci_present":1.0,"check:ci_runs_tests":1.0,"check:ci_runs_lint":0.0,"check:tests_cochange":0.6972,"test_lines":3155.0,"source_lines":27032.0,"test_ratio":0.1167,"ci_files":4.0,"cochange_share":0.1743,"cochange_commits":218.0},"findings":[],"evidence":[{"kind":"ci","description":"CI config: .github/workflows/ci.yaml","ref":".github/workflows/ci.yaml","url":null,"weight":0.0},{"kind":"ci","description":"CI config: .github/workflows/docs.yml","ref":".github/workflows/docs.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI config: .github/workflows/relay_to_openclaw.yml","ref":".github/workflows/relay_to_openclaw.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI config: .github/workflows/release.yaml","ref":".github/workflows/release.yaml","url":null,"weight":0.0},{"kind":"ci","description":"CI runs tests (npm test)","ref":null,"url":null,"weight":0.0}],"data":{"test_commands":["npm test"],"lint_commands":[]},"error":null},{"analyzer":"qual-docs","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:readme":1.0,"check:license":1.0,"check:contributing":1.0,"check:changelog":0.0,"readme_lines":84.0},"findings":[],"evidence":[{"kind":"docs","description":"README.md","ref":"README.md","url":null,"weight":0.0},{"kind":"docs","description":"LICENSE","ref":"LICENSE","url":null,"weight":0.0},{"kind":"docs","description":"CONTRIBUTING.md","ref":"CONTRIBUTING.md","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"qual-type-safety","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:strict_config":0.0,"check:low_escape_density":1.0,"escapes":0.0,"escapes_per_kloc":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"x-blame","pillar":"ai_provenance","status":"ok","tool_version":"git-blame","metrics":{"ai_lines":132.0,"other_lines":26900.0,"files_blamed":81.0,"blame_failures":0.0,"quality:ai_findings":0.0,"quality:ai_per_kloc":0.0,"quality:other_findings":7.0,"quality:other_per_kloc":0.26,"security:ai_findings":0.0,"security:ai_per_kloc":0.0,"security:other_findings":15.0,"security:other_per_kloc":0.558},"findings":[],"evidence":[],"data":{"sampled":false,"comparable":false},"error":null}],"flags":[]}