{"$schema":"https://json.schemastore.org/sarif-2.1.0.json","version":"2.1.0","runs":[{"tool":{"driver":{"name":"codehealth","informationUri":"https://codehealth.canine.dev","rules":[{"id":"D1","name":"Cyclomatic Complexity","shortDescription":{"text":"Cyclomatic Complexity"},"helpUri":"https://codehealth.canine.dev/dimensions/D1"},{"id":"D2","name":"Cognitive Complexity","shortDescription":{"text":"Cognitive Complexity"},"helpUri":"https://codehealth.canine.dev/dimensions/D2"},{"id":"D3","name":"God Classes","shortDescription":{"text":"God Classes"},"helpUri":"https://codehealth.canine.dev/dimensions/D3"},{"id":"D6","name":"Cohesion (LCOM4)","shortDescription":{"text":"Cohesion (LCOM4)"},"helpUri":"https://codehealth.canine.dev/dimensions/D6"},{"id":"D9","name":"Test Distribution","shortDescription":{"text":"Test Distribution"},"helpUri":"https://codehealth.canine.dev/dimensions/D9"},{"id":"D10","name":"Test Quality","shortDescription":{"text":"Test Quality"},"helpUri":"https://codehealth.canine.dev/dimensions/D10"},{"id":"D12","name":"Dependency Hygiene","shortDescription":{"text":"Dependency Hygiene"},"helpUri":"https://codehealth.canine.dev/dimensions/D12"},{"id":"D13","name":"Secret Scanning","shortDescription":{"text":"Secret Scanning"},"helpUri":"https://codehealth.canine.dev/dimensions/D13","relationships":[{"target":{"id":"CWE-798","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}},"kinds":["relevant"]},{"target":{"id":"CWE-259","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}},"kinds":["relevant"]},{"target":{"id":"A07:2025","toolComponent":{"name":"OWASP Top 10","guid":"7d1f0c2e-4b6a-4e39-9a51-0b2e8c3d5f61"}},"kinds":["relevant"]}],"properties":{"cwe":["CWE-798","CWE-259"],"owasp":"A07:2025"}},{"id":"D14","name":"License Compliance","shortDescription":{"text":"License Compliance"},"helpUri":"https://codehealth.canine.dev/dimensions/D14"},{"id":"D15","name":"Churn \u00D7 Complexity Hotspots","shortDescription":{"text":"Churn \u00D7 Complexity Hotspots"},"helpUri":"https://codehealth.canine.dev/dimensions/D15"},{"id":"D16","name":"Bus Factor","shortDescription":{"text":"Bus Factor"},"helpUri":"https://codehealth.canine.dev/dimensions/D16"},{"id":"D17","name":"Explicit Debt","shortDescription":{"text":"Explicit Debt"},"helpUri":"https://codehealth.canine.dev/dimensions/D17"},{"id":"D19","name":"Documentation Quality","shortDescription":{"text":"Documentation Quality"},"helpUri":"https://codehealth.canine.dev/dimensions/D19"},{"id":"D20","name":"ADR Quality","shortDescription":{"text":"ADR Quality"},"helpUri":"https://codehealth.canine.dev/dimensions/D20"},{"id":"D26","name":"Project Cohesion","shortDescription":{"text":"Project Cohesion"},"helpUri":"https://codehealth.canine.dev/dimensions/D26"},{"id":"D28","name":"Secrets (history)","shortDescription":{"text":"Secrets (history)"},"helpUri":"https://codehealth.canine.dev/dimensions/D28","relationships":[{"target":{"id":"CWE-798","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}},"kinds":["relevant"]},{"target":{"id":"CWE-259","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}},"kinds":["relevant"]},{"target":{"id":"A07:2025","toolComponent":{"name":"OWASP Top 10","guid":"7d1f0c2e-4b6a-4e39-9a51-0b2e8c3d5f61"}},"kinds":["relevant"]}],"properties":{"cwe":["CWE-798","CWE-259"],"owasp":"A07:2025"}},{"id":"D29","name":"Static Analysis (SAST)","shortDescription":{"text":"Static Analysis (SAST)"},"helpUri":"https://codehealth.canine.dev/dimensions/D29","relationships":[{"target":{"id":"CWE-79","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}},"kinds":["relevant"]},{"target":{"id":"CWE-89","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}},"kinds":["relevant"]},{"target":{"id":"CWE-78","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}},"kinds":["relevant"]},{"target":{"id":"CWE-94","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}},"kinds":["relevant"]},{"target":{"id":"CWE-77","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}},"kinds":["relevant"]},{"target":{"id":"A05:2025","toolComponent":{"name":"OWASP Top 10","guid":"7d1f0c2e-4b6a-4e39-9a51-0b2e8c3d5f61"}},"kinds":["relevant"]}],"properties":{"cwe":["CWE-79","CWE-89","CWE-78","CWE-94","CWE-77"],"owasp":"A05:2025"}},{"id":"D30","name":"Dependency Vulnerabilities","shortDescription":{"text":"Dependency Vulnerabilities"},"helpUri":"https://codehealth.canine.dev/dimensions/D30","relationships":[{"target":{"id":"CWE-1395","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}},"kinds":["relevant"]},{"target":{"id":"CWE-937","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}},"kinds":["relevant"]},{"target":{"id":"A03:2025","toolComponent":{"name":"OWASP Top 10","guid":"7d1f0c2e-4b6a-4e39-9a51-0b2e8c3d5f61"}},"kinds":["relevant"]}],"properties":{"cwe":["CWE-1395","CWE-937"],"owasp":"A03:2025"}},{"id":"D34","name":"Knowledge Freshness","shortDescription":{"text":"Knowledge Freshness"},"helpUri":"https://codehealth.canine.dev/dimensions/D34"},{"id":"D35","name":"Change Coupling","shortDescription":{"text":"Change Coupling"},"helpUri":"https://codehealth.canine.dev/dimensions/D35"},{"id":"D36","name":"Supply-chain Provenance \u0026 Signing","shortDescription":{"text":"Supply-chain Provenance \u0026 Signing"},"helpUri":"https://codehealth.canine.dev/dimensions/D36","relationships":[{"target":{"id":"CWE-1357","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}},"kinds":["relevant"]},{"target":{"id":"CWE-494","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}},"kinds":["relevant"]},{"target":{"id":"A03:2025","toolComponent":{"name":"OWASP Top 10","guid":"7d1f0c2e-4b6a-4e39-9a51-0b2e8c3d5f61"}},"kinds":["relevant"]}],"properties":{"cwe":["CWE-1357","CWE-494"],"owasp":"A03:2025"}},{"id":"D43","name":"Malicious Dependencies","shortDescription":{"text":"Malicious Dependencies"},"helpUri":"https://codehealth.canine.dev/dimensions/D43","relationships":[{"target":{"id":"CWE-506","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}},"kinds":["relevant"]},{"target":{"id":"A08:2025","toolComponent":{"name":"OWASP Top 10","guid":"7d1f0c2e-4b6a-4e39-9a51-0b2e8c3d5f61"}},"kinds":["relevant"]}],"properties":{"cwe":["CWE-506"],"owasp":"A08:2025"}},{"id":"D44","name":"Platform End-of-Life","shortDescription":{"text":"Platform End-of-Life"},"helpUri":"https://codehealth.canine.dev/dimensions/D44"},{"id":"AX10","name":"Code composition","shortDescription":{"text":"Code composition"},"helpUri":"https://codehealth.canine.dev/dimensions/AX10"},{"id":"AX3","name":"Project dependency cycles","shortDescription":{"text":"Project dependency cycles"},"helpUri":"https://codehealth.canine.dev/dimensions/AX3"},{"id":"AX4","name":"Dependency direction","shortDescription":{"text":"Dependency direction"},"helpUri":"https://codehealth.canine.dev/dimensions/AX4"},{"id":"AX8","name":"Test isolation","shortDescription":{"text":"Test isolation"},"helpUri":"https://codehealth.canine.dev/dimensions/AX8"},{"id":"AXB2","name":"Runtime readiness","shortDescription":{"text":"Runtime readiness"},"helpUri":"https://codehealth.canine.dev/dimensions/AXB2"},{"id":"ED5","name":"Idempotency","shortDescription":{"text":"Idempotency"},"helpUri":"https://codehealth.canine.dev/dimensions/ED5"},{"id":"GD1","name":"Unfinished \u0026 placeholder code","shortDescription":{"text":"Unfinished \u0026 placeholder code"},"helpUri":"https://codehealth.canine.dev/dimensions/GD1"},{"id":"IC1","name":"Incompleteness \u0026 stubs","shortDescription":{"text":"Incompleteness \u0026 stubs"},"helpUri":"https://codehealth.canine.dev/dimensions/IC1"},{"id":"M1","name":"Documentation (README)","shortDescription":{"text":"Documentation (README)"},"helpUri":"https://codehealth.canine.dev/dimensions/M1"},{"id":"M2","name":"Architecture documentation","shortDescription":{"text":"Architecture documentation"},"helpUri":"https://codehealth.canine.dev/dimensions/M2"},{"id":"M3","name":"Folder \u0026 project structure","shortDescription":{"text":"Folder \u0026 project structure"},"helpUri":"https://codehealth.canine.dev/dimensions/M3"},{"id":"M4","name":"Documentation accuracy","shortDescription":{"text":"Documentation accuracy"},"helpUri":"https://codehealth.canine.dev/dimensions/M4"},{"id":"P1","name":"CI/CD gates","shortDescription":{"text":"CI/CD gates"},"helpUri":"https://codehealth.canine.dev/dimensions/P1"},{"id":"P10","name":"Library API \u0026 versioning","shortDescription":{"text":"Library API \u0026 versioning"},"helpUri":"https://codehealth.canine.dev/dimensions/P10"},{"id":"P12","name":"CI test-gate honesty","shortDescription":{"text":"CI test-gate honesty"},"helpUri":"https://codehealth.canine.dev/dimensions/P12"},{"id":"P2","name":"Observability","shortDescription":{"text":"Observability"},"helpUri":"https://codehealth.canine.dev/dimensions/P2"},{"id":"P3","name":"Security \u0026 performance tooling","shortDescription":{"text":"Security \u0026 performance tooling"},"helpUri":"https://codehealth.canine.dev/dimensions/P3"},{"id":"P4","name":"Deployment \u0026 Rollback","shortDescription":{"text":"Deployment \u0026 Rollback"},"helpUri":"https://codehealth.canine.dev/dimensions/P4"},{"id":"P6","name":"Release Hygiene","shortDescription":{"text":"Release Hygiene"},"helpUri":"https://codehealth.canine.dev/dimensions/P6"},{"id":"PF3","name":"Async \u0026 latency hygiene","shortDescription":{"text":"Async \u0026 latency hygiene"},"helpUri":"https://codehealth.canine.dev/dimensions/PF3"},{"id":"R1","name":"Type Safety","shortDescription":{"text":"Type Safety"},"helpUri":"https://codehealth.canine.dev/dimensions/R1"},{"id":"R10","name":"Code Duplication","shortDescription":{"text":"Code Duplication"},"helpUri":"https://codehealth.canine.dev/dimensions/R10"},{"id":"R2","name":"Cyclomatic Complexity","shortDescription":{"text":"Cyclomatic Complexity"},"helpUri":"https://codehealth.canine.dev/dimensions/R2"},{"id":"R3","name":"Large Files","shortDescription":{"text":"Large Files"},"helpUri":"https://codehealth.canine.dev/dimensions/R3"},{"id":"R4","name":"Test Coverage","shortDescription":{"text":"Test Coverage"},"helpUri":"https://codehealth.canine.dev/dimensions/R4"},{"id":"R6","name":"Tooling","shortDescription":{"text":"Tooling"},"helpUri":"https://codehealth.canine.dev/dimensions/R6"},{"id":"R7","name":"Dead Code","shortDescription":{"text":"Dead Code"},"helpUri":"https://codehealth.canine.dev/dimensions/R7"},{"id":"R8","name":"Dependency Hygiene","shortDescription":{"text":"Dependency Hygiene"},"helpUri":"https://codehealth.canine.dev/dimensions/R8"},{"id":"R9","name":"Circular Imports","shortDescription":{"text":"Circular Imports"},"helpUri":"https://codehealth.canine.dev/dimensions/R9"},{"id":"SC1","name":"Supply-chain hygiene","shortDescription":{"text":"Supply-chain hygiene"},"helpUri":"https://codehealth.canine.dev/dimensions/SC1"},{"id":"X1","name":"Async correctness","shortDescription":{"text":"Async correctness"},"helpUri":"https://codehealth.canine.dev/dimensions/X1"},{"id":"X10","name":"Duplicated predicate","shortDescription":{"text":"Duplicated predicate"},"helpUri":"https://codehealth.canine.dev/dimensions/X10"},{"id":"X12","name":"Unreachable branch","shortDescription":{"text":"Unreachable branch"},"helpUri":"https://codehealth.canine.dev/dimensions/X12"},{"id":"X13","name":"Undrained process stream","shortDescription":{"text":"Undrained process stream"},"helpUri":"https://codehealth.canine.dev/dimensions/X13"},{"id":"X14","name":"Bypassable address classification","shortDescription":{"text":"Bypassable address classification"},"helpUri":"https://codehealth.canine.dev/dimensions/X14"},{"id":"X15","name":"Unvalidated length from an untrusted reader","shortDescription":{"text":"Unvalidated length from an untrusted reader"},"helpUri":"https://codehealth.canine.dev/dimensions/X15"},{"id":"X16","name":"Unfloored truncation loop","shortDescription":{"text":"Unfloored truncation loop"},"helpUri":"https://codehealth.canine.dev/dimensions/X16"},{"id":"X17","name":"Uncapped recursion over a caller-supplied document","shortDescription":{"text":"Uncapped recursion over a caller-supplied document"},"helpUri":"https://codehealth.canine.dev/dimensions/X17"},{"id":"X18","name":"Disposal-pattern correctness","shortDescription":{"text":"Disposal-pattern correctness"},"helpUri":"https://codehealth.canine.dev/dimensions/X18"},{"id":"X19","name":"Unrestored process-global state","shortDescription":{"text":"Unrestored process-global state"},"helpUri":"https://codehealth.canine.dev/dimensions/X19"},{"id":"X20","name":"Mistyped argument guard","shortDescription":{"text":"Mistyped argument guard"},"helpUri":"https://codehealth.canine.dev/dimensions/X20"},{"id":"X21","name":"Side-effecting pattern guard","shortDescription":{"text":"Side-effecting pattern guard"},"helpUri":"https://codehealth.canine.dev/dimensions/X21"},{"id":"X22","name":"Contradicted release guard","shortDescription":{"text":"Contradicted release guard"},"helpUri":"https://codehealth.canine.dev/dimensions/X22"},{"id":"X23","name":"Unguarded diagnostic materialisation","shortDescription":{"text":"Unguarded diagnostic materialisation"},"helpUri":"https://codehealth.canine.dev/dimensions/X23"},{"id":"X24","name":"Document value interpolated into markup unescaped","shortDescription":{"text":"Document value interpolated into markup unescaped"},"helpUri":"https://codehealth.canine.dev/dimensions/X24"},{"id":"X25","name":"Inert configuration knob","shortDescription":{"text":"Inert configuration knob"},"helpUri":"https://codehealth.canine.dev/dimensions/X25"},{"id":"X26","name":"Unsynchronised callback handoff","shortDescription":{"text":"Unsynchronised callback handoff"},"helpUri":"https://codehealth.canine.dev/dimensions/X26"},{"id":"X27","name":"Collection changed while being enumerated","shortDescription":{"text":"Collection changed while being enumerated"},"helpUri":"https://codehealth.canine.dev/dimensions/X27"},{"id":"X28","name":"Index access outside its own emptiness guard","shortDescription":{"text":"Index access outside its own emptiness guard"},"helpUri":"https://codehealth.canine.dev/dimensions/X28"},{"id":"X29","name":"Per-element action decided by a fixed element","shortDescription":{"text":"Per-element action decided by a fixed element"},"helpUri":"https://codehealth.canine.dev/dimensions/X29"},{"id":"X3","name":"Exception handling","shortDescription":{"text":"Exception handling"},"helpUri":"https://codehealth.canine.dev/dimensions/X3"},{"id":"X30","name":"Support guard that admits what it rejects","shortDescription":{"text":"Support guard that admits what it rejects"},"helpUri":"https://codehealth.canine.dev/dimensions/X30"},{"id":"X32","name":"Type resolved by simple name across every loaded assembly","shortDescription":{"text":"Type resolved by simple name across every loaded assembly"},"helpUri":"https://codehealth.canine.dev/dimensions/X32"},{"id":"X5","name":"Nullable reference types","shortDescription":{"text":"Nullable reference types"},"helpUri":"https://codehealth.canine.dev/dimensions/X5"},{"id":"X6","name":"Hand-rolled structured-format parsing","shortDescription":{"text":"Hand-rolled structured-format parsing"},"helpUri":"https://codehealth.canine.dev/dimensions/X6"},{"id":"X7","name":"Silent fallback defaults","shortDescription":{"text":"Silent fallback defaults"},"helpUri":"https://codehealth.canine.dev/dimensions/X7"},{"id":"X9","name":"Subsumed condition operand","shortDescription":{"text":"Subsumed condition operand"},"helpUri":"https://codehealth.canine.dev/dimensions/X9"}]}},"results":[{"ruleId":"D1","level":"warning","message":{"text":"constructor (cyclomatic 82): constructor has cyclomatic complexity 82 (threshold 15). Most of this is not in the body itself: 1 of the 82 points is its own statement and the rest belongs to 27 function items inside it that branch (a function literal at line 614, a function literal at line 440, a function literal at line 378, \u2026). The named helpers are already separate functions; the literals\u0027 work cannot be called, reviewed or tested from outside this body. To reduce it, move the named helpers out of the body to the enclosing scope and lift each literal\u0027s work into a named function there, so each is measured, reviewed and tested on its own, and reduce whichever one then reads as the largest."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"lib/assert.js"},"region":{"startLine":241}}}],"partialFingerprints":{"codehealthFindingId/v1":"8e3dd7be951e814134584f0db3da2b8046d617ab3cdfde86e1e8eaae75bc1a21"}},{"ruleId":"D1","level":"warning","message":{"text":"loadCli (cyclomatic 81): loadCli has cyclomatic complexity 81 (threshold 15). Of this number, 73 points are the body\u0027s own statements and 8 belong to 15 function literals inside it that branch. To reduce it, separate the cases: extract each independent branch into its own named function, and where the body has guards that only reject input, fold those into early returns at the top."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"lib/cli.js"},"region":{"startLine":95}}}],"partialFingerprints":{"codehealthFindingId/v1":"42f44bc30c87695609f4b51b56e916593e8566f64610ce87ddbfa68d61479843"}},{"ruleId":"D1","level":"warning","message":{"text":"plan (cyclomatic 74): plan has cyclomatic complexity 74 (threshold 15). Most of this is not in the body itself: 10 of the 74 points are its own statements and the rest belongs to 25 function items inside it that branch (a function literal at line 230, a function literal at line 332, a function literal at line 408, \u2026). The named helpers are already separate functions; the literals\u0027 work cannot be called, reviewed or tested from outside this body. To reduce it, move the named helpers out of the body to the enclosing scope and lift each literal\u0027s work into a named function there, so each is measured, reviewed and tested on its own, and reduce whichever one then reads as the largest."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"lib/watcher.js"},"region":{"startLine":172}}}],"partialFingerprints":{"codehealthFindingId/v1":"4ce186d92cdd9e317c8d9275a5caa9e35fab75d5157d23ed2c0017ee11485e3d"}},{"ruleId":"D1","level":"warning","message":{"text":"run (cyclomatic 46): run has cyclomatic complexity 46 (threshold 15). Of this number, 27 points are the body\u0027s own statements and 19 belong to 10 function items inside it that branch. To reduce it, split the body: these branches sit side by side rather than nested inside one another, so extracting each one on its own would leave a function per branch. Group the statements between the checks into named steps and move each step into its own function, so the body reads as a short sequence of named stages."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"lib/api.js"},"region":{"startLine":106}}}],"partialFingerprints":{"codehealthFindingId/v1":"7bdb056ceed7fff0ee10d58ae1fe3c0dc1c0bd08f09afb69a59d3ddaaa81b47d"}},{"ruleId":"D1","level":"warning","message":{"text":"Reporter.consumeStateChange (cyclomatic 40): Reporter.consumeStateChange has cyclomatic complexity 40 (threshold 15). To reduce it, separate the cases: extract each independent branch into its own named function, and where the body has guards that only reject input, fold those into early returns at the top."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"lib/reporters/default.js"},"region":{"startLine":182}}}],"partialFingerprints":{"codehealthFindingId/v1":"6138a153429ef5f5368070c9f0d3eb59df5d847d7e6a5907bbbfd5aeb143b870"}},{"ruleId":"D1","level":"warning","message":{"text":"Reporter.endRun (cyclomatic 34): Reporter.endRun has cyclomatic complexity 34 (threshold 15). To reduce it, separate the cases: extract each independent branch into its own named function, and where the body has guards that only reject input, fold those into early returns at the top."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"lib/reporters/default.js"},"region":{"startLine":629}}}],"partialFingerprints":{"codehealthFindingId/v1":"2d889849e2aecb0f4fd1f85600d3b856555ed0adbc542414c87834e869b682b5"}},{"ruleId":"D1","level":"warning","message":{"text":"TapReporter.consumeStateChange (cyclomatic 29): TapReporter.consumeStateChange has cyclomatic complexity 29 (threshold 15). To reduce it, keep the dispatch but shrink the arms: move each non-trivial case body into its own named function (or onto the value being matched) so the dispatch reads one line per case, and group related cases into a sub-dispatch. Where every arm is uniform \u2014 the same kind of value, with no behaviour of its own \u2014 a table keyed by the case is the shorter form; wherever the arms carry different data or different behaviour, keep them as cases, because collapsing those trades an explicit, reviewable set of cases for nothing."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"lib/reporters/tap.js"},"region":{"startLine":170}}}],"partialFingerprints":{"codehealthFindingId/v1":"139d5e4751b81e0a45b383c199908b074fe1187268cf106d9bc890e3ad5444ee"}},{"ruleId":"D1","level":"warning","message":{"text":"assert.validateExpectations (cyclomatic 29): assert.validateExpectations has cyclomatic complexity 29 (threshold 15). To reduce it, separate the branches: extract each independent case into its own named function so the top-level body reads as a short sequence of named decisions. This is NOT this file\u0027s highest cyclomatic complexity: Assertions.constructor (cyclomatic 69) is higher and carries no row of its own \u2014 it was excluded as a flat dispatcher (a long switch/match over independent cases: many branches, almost no nesting), which this dimension does not treat as a refactor obligation. It is named here so the ranking you see in this file is not mistaken for the whole of it; the excluded method is counted neither in this dimension\u0027s figures nor in its score."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"lib/assert.js"},"region":{"startLine":57}}}],"partialFingerprints":{"codehealthFindingId/v1":"7e8e6cb1b89f4a456345c881a1b3f3c891306c1700d145d0c055c25338a9b3e7"}},{"ruleId":"D1","level":"warning","message":{"text":"Runner.start (cyclomatic 28): Runner.start has cyclomatic complexity 28 (threshold 15). Of this number, 20 points are the body\u0027s own statements and 8 belong to 3 function literals inside it that branch. To reduce it, separate the cases: extract each independent branch into its own named function, and where the body has guards that only reject input, fold those into early returns at the top."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"lib/runner.js"},"region":{"startLine":398}}}],"partialFingerprints":{"codehealthFindingId/v1":"c0ee9d31700bc39ca6caa7ad8b5ea2609ae08f976dfe093b28e96c85252c51f7"}},{"ruleId":"D1","level":"warning","message":{"text":"run (cyclomatic 27): run has cyclomatic complexity 27 (threshold 15). Of this number, 14 points are the body\u0027s own statements and 13 belong to 13 function items inside it that branch. To reduce it, separate the cases: extract each independent branch into its own named function, and where the body has guards that only reject input, fold those into early returns at the top."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"lib/worker/base.js"},"region":{"startLine":52}}}],"partialFingerprints":{"codehealthFindingId/v1":"e43a2edc3ddddc8eaa44988a819b78f015a1fb0686ef0942ece9458158658145"}},{"ruleId":"D1","level":"warning","message":{"text":"constructor (cyclomatic 26): constructor has cyclomatic complexity 26 (threshold 15). Most of this is not in the body itself: 3 of the 26 points are its own statements and the rest belongs to 5 function items inside it that branch (a function literal at line 81, registerUniqueTitle, notifyTimeoutUpdate, \u2026). The named helpers are already separate functions; the literals\u0027 work cannot be called, reviewed or tested from outside this body. To reduce it, move the named helpers out of the body to the enclosing scope and lift each literal\u0027s work into a named function there, so each is measured, reviewed and tested on its own, and reduce whichever one then reads as the largest."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"lib/runner.js"},"region":{"startLine":20}}}],"partialFingerprints":{"codehealthFindingId/v1":"094c598f756db56ca098abbc8fba6754bfeb31a14d00dd6385b641ff90bb5c02"}},{"ruleId":"D1","level":"warning","message":{"text":"loadConfig (cyclomatic 25): loadConfig has cyclomatic complexity 25 (threshold 15). To reduce it, separate the cases: extract each independent branch into its own named function, and where the body has guards that only reject input, fold those into early returns at the top."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"lib/load-config.js"},"region":{"startLine":77}}}],"partialFingerprints":{"codehealthFindingId/v1":"c8cc6987048ef724391bd9aeebdc460fc7d3b665abf637ca57994deecf4a25e0"}},{"ruleId":"D1","level":"warning","message":{"text":"Reporter.writeSerializedError (cyclomatic 24): Reporter.writeSerializedError has cyclomatic complexity 24 (threshold 15). To reduce it, separate the cases: extract each independent branch into its own named function, and where the body has guards that only reject input, fold those into early returns at the top."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"lib/reporters/default.js"},"region":{"startLine":453}}}],"partialFingerprints":{"codehealthFindingId/v1":"9b4d695d626878e0fa4da0eb32fffa76d54c2ba7d306484ecaf1c34a6644afbf"}},{"ruleId":"D1","level":"warning","message":{"text":"RunStatus.emitStateChange (cyclomatic 23): RunStatus.emitStateChange has cyclomatic complexity 23 (threshold 15). To reduce it, keep the dispatch but shrink the arms: move each non-trivial case body into its own named function (or onto the value being matched) so the dispatch reads one line per case, and group related cases into a sub-dispatch. Where every arm is uniform \u2014 the same kind of value, with no behaviour of its own \u2014 a table keyed by the case is the shorter form; wherever the arms carry different data or different behaviour, keep them as cases, because collapsing those trades an explicit, reviewable set of cases for nothing."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"lib/run-status.js"},"region":{"startLine":75}}}],"partialFingerprints":{"codehealthFindingId/v1":"6e9ece7c17d501b83bc01b37f1234c89e169d46594da2b97a73c1fdb1455ce03"}},{"ruleId":"D1","level":"warning","message":{"text":"globs.applyTestFileFilter (cyclomatic 22): globs.applyTestFileFilter has cyclomatic complexity 22 (threshold 15). To reduce it, separate the cases: extract each independent branch into its own named function, and where the body has guards that only reject input, fold those into early returns at the top."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"lib/globs.js"},"region":{"startLine":139}}}],"partialFingerprints":{"codehealthFindingId/v1":"b0db696745c6612077d90e45aeed161e6950f75b08bd18b030360da28e611c4d"}},{"ruleId":"D1","level":"warning","message":{"text":"create-chain.createConditionalChain (cyclomatic 19): create-chain.createConditionalChain has cyclomatic complexity 19 (threshold 15). Of this number, 17 points are the body\u0027s own statements and 2 belong to one function literal inside it that branches. To reduce it, separate the cases: extract each independent branch into its own named function, and where the body has guards that only reject input, fold those into early returns at the top."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"lib/create-chain.js"},"region":{"startLine":55}}}],"partialFingerprints":{"codehealthFindingId/v1":"52cbefe75988fb02b33e0695b14ecebf117c1079b20c154b73af96232178cea8"}},{"ruleId":"D1","level":"warning","message":{"text":"assert.assertExpectations (cyclomatic 18): assert.assertExpectations has cyclomatic complexity 18 (threshold 15). To reduce it, name the conditions: bind each compound test to a well-named local or a small predicate function, so the body reads as a sequence of named decisions rather than a chain of operators. This is NOT this file\u0027s highest cyclomatic complexity: Assertions.constructor (cyclomatic 69) is higher and carries no row of its own \u2014 it was excluded as a flat dispatcher (a long switch/match over independent cases: many branches, almost no nesting), which this dimension does not treat as a refactor obligation. It is named here so the ranking you see in this file is not mistaken for the whole of it; the excluded method is counted neither in this dimension\u0027s figures nor in its score."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"lib/assert.js"},"region":{"startLine":144}}}],"partialFingerprints":{"codehealthFindingId/v1":"9bca31f8d226cfd82982e43088f62cc67e6f2204bd366181e29325d7a39ae61c"}},{"ruleId":"D1","level":"warning","message":{"text":"suggestExitCode (cyclomatic 17): suggestExitCode has cyclomatic complexity 17 (threshold 15). Of this number, 16 points are the body\u0027s own statements and 1 belongs to one function literal inside it that branches. To reduce it, name the conditions: bind each compound test to a well-named local or a small predicate function, so the body reads as a sequence of named decisions rather than a chain of operators."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"lib/run-status.js"},"region":{"startLine":229}}}],"partialFingerprints":{"codehealthFindingId/v1":"c5808b3b108390959d87513e377f8db243abcab1bb6fa176fd17999ddc5a4df1"}},{"ruleId":"D1","level":"warning","message":{"text":"createConditionalChain::get (cyclomatic 16): createConditionalChain::get has cyclomatic complexity 16 (threshold 15). To reduce it, separate the cases: extract each independent branch into its own named function, and where the body has guards that only reject input, fold those into early returns at the top."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"lib/create-chain.js"},"region":{"startLine":60}}}],"partialFingerprints":{"codehealthFindingId/v1":"eb89b8bccd79ef8aea0ce8541ce96cea460c1a9ab2808210667d6639827e130b"}},{"ruleId":"D2","level":"warning","message":{"text":"loadCli (cognitive 109): loadCli has cognitive complexity 109 (threshold 15). Drivers by points: if/else 47 (68 pts), boolean chains 16, error handling 9 (12 pts), other 6, ternaries 4, loops 2 (3 pts) (nesting depth added 25). Of this number, 98 points are the body\u0027s own statements and 11 belong to 15 function literals inside it that branch. To reduce it, split the body into named stages: move each independent step or branch into its own named function so the body reads as a short sequence of named calls rather than one long body."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"lib/cli.js"},"region":{"startLine":95}}}],"partialFingerprints":{"codehealthFindingId/v1":"3d585aebc008e593bc5737c653bd6a96f2eb8cd1f3f8649934c7c57dac97b992"}},{"ruleId":"D2","level":"warning","message":{"text":"constructor (cognitive 105): constructor has cognitive complexity 105 (threshold 15). Drivers by points: if/else 47 (65 pts), error handling 17 (21 pts), other 11, boolean chains 4, ternaries 3 (4 pts) (nesting depth added 23). None of this is in the body itself: all 105 points belong to 27 function items inside it that branch (a function literal at line 614, a function literal at line 440, a function literal at line 378, \u2026). The named helpers are already separate functions; the literals\u0027 work cannot be called, reviewed or tested from outside this body. To reduce it, move the named helpers out of the body to the enclosing scope and lift each literal\u0027s work into a named function there, so each is measured, reviewed and tested on its own, and reduce whichever one then reads as the largest."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"lib/assert.js"},"region":{"startLine":241}}}],"partialFingerprints":{"codehealthFindingId/v1":"4a8945b5eb79e3775d00d76fa3d6972a99a2262193dc587d90c222eb67a930cf"}},{"ruleId":"D2","level":"warning","message":{"text":"plan (cognitive 94): plan has cognitive complexity 94 (threshold 15). Drivers by points: if/else 38 (62 pts), loops 11 (16 pts), boolean chains 6, match/switch 3 (4 pts), other 3, ternaries 1 (2 pts), error handling 1 (nesting depth added 31). Most of this is not in the body itself: 15 of the 94 points are its own statements and the rest belongs to 25 function items inside it that branch (a function literal at line 408, a function literal at line 332, a function literal at line 432, \u2026). The named helpers are already separate functions; the literals\u0027 work cannot be called, reviewed or tested from outside this body. To reduce it, move the named helpers out of the body to the enclosing scope and lift each literal\u0027s work into a named function there, so each is measured, reviewed and tested on its own, and reduce whichever one then reads as the largest."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"lib/watcher.js"},"region":{"startLine":172}}}],"partialFingerprints":{"codehealthFindingId/v1":"0f030f122e1c2990d097f07e5fec02447198c06629d8ed77e7b6d4faf4a86448"}},{"ruleId":"D2","level":"warning","message":{"text":"globs.applyTestFileFilter (cognitive 49): globs.applyTestFileFilter has cognitive complexity 49 (threshold 15). Drivers by points: if/else 10 (29 pts), loops 6 (14 pts), boolean chains 3, error handling 1 (3 pts) (nesting depth added 29). To reduce it, split the body into named stages: move each independent step or branch into its own named function so the body reads as a short sequence of named calls rather than one long body."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"lib/globs.js"},"region":{"startLine":139}}}],"partialFingerprints":{"codehealthFindingId/v1":"b8565472fed45a72d67ab9f36cb606a7828925ec66c2cea3303c98732b9c04b1"}},{"ruleId":"D2","level":"warning","message":{"text":"run (cognitive 48): run has cognitive complexity 48 (threshold 15). Drivers by points: if/else 21 (23 pts), boolean chains 9, other 6, loops 3 (4 pts), ternaries 3 (4 pts), error handling 2 (nesting depth added 4). Of this number, 30 points are the body\u0027s own statements and 18 belong to 10 function items inside it that branch. To reduce it, split the body: most of this score is breadth rather than depth \u2014 checks laid out side by side rather than stacked \u2014 so group the statements between the checks into named steps and move each step into its own function. Some of it IS depth: where a check sits inside another whose only job is to reach it, merge the two into one condition, and where an else follows a branch that already returns, drop the trailing else and let the rest of the body continue at one level."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"lib/api.js"},"region":{"startLine":106}}}],"partialFingerprints":{"codehealthFindingId/v1":"d219925274ca384b7d1ad6f9b9e04cb49d863370840fc1d6cb32c40419e34e4b"}},{"ruleId":"D2","level":"warning","message":{"text":"endRun (cognitive 47): endRun has cognitive complexity 47 (threshold 15). Drivers by points: if/else 25 (34 pts), loops 3 (7 pts), boolean chains 5, ternaries 1 (nesting depth added 13). To reduce it, split the body into named stages: move each independent step or branch into its own named function so the body reads as a short sequence of named calls rather than one long body."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"lib/reporters/default.js"},"region":{"startLine":629}}}],"partialFingerprints":{"codehealthFindingId/v1":"d802a6224ebef2aa576b59717a7de442f9a4fc220ba30b31f2d6c628fd1e35db"}},{"ruleId":"D2","level":"warning","message":{"text":"writeSerializedError (cognitive 43): writeSerializedError has cognitive complexity 43 (threshold 15). Drivers by points: if/else 17 (29 pts), loops 3 (8 pts), ternaries 1 (4 pts), boolean chains 2 (nesting depth added 20). To reduce it, split the body into named stages: move each independent step or branch into its own named function so the body reads as a short sequence of named calls rather than one long body."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"lib/reporters/default.js"},"region":{"startLine":453}}}],"partialFingerprints":{"codehealthFindingId/v1":"3116f93c76ad25deef223797758292dc059a4816fecbbd05ba682bb4b7aafdb2"}},{"ruleId":"D2","level":"warning","message":{"text":"constructor (cognitive 41): constructor has cognitive complexity 41 (threshold 15). Drivers by points: if/else 15 (25 pts), ternaries 3 (9 pts), other 4, boolean chains 3 (nesting depth added 16). Most of this is not in the body itself: 2 of the 41 points are its own statements and the rest belongs to 5 function items inside it that branch (a function literal at line 81, registerUniqueTitle, notifyTimeoutUpdate, \u2026). The named helpers are already separate functions; the literals\u0027 work cannot be called, reviewed or tested from outside this body. To reduce it, move the named helpers out of the body to the enclosing scope and lift each literal\u0027s work into a named function there, so each is measured, reviewed and tested on its own, and reduce whichever one then reads as the largest."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"lib/runner.js"},"region":{"startLine":20}}}],"partialFingerprints":{"codehealthFindingId/v1":"d4375584f1e87e449a39b2af976566ce6b1c2362c136e60615f302e5ec7e205c"}},{"ruleId":"D2","level":"warning","message":{"text":"loadConfig (cognitive 40): loadConfig has cognitive complexity 40 (threshold 15). Drivers by points: if/else 16 (28 pts), loops 3 (5 pts), boolean chains 4, error handling 1 (2 pts), ternaries 1 (nesting depth added 15). To reduce it, split the body into named stages: move each independent step or branch into its own named function so the body reads as a short sequence of named calls rather than one long body."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"lib/load-config.js"},"region":{"startLine":77}}}],"partialFingerprints":{"codehealthFindingId/v1":"1e12d42e2c7d232151756cad92275f07d8525be7510ff254e89f6e965362e7f0"}},{"ruleId":"D2","level":"warning","message":{"text":"Reporter.consumeStateChange (cognitive 36): Reporter.consumeStateChange has cognitive complexity 36 (threshold 15). Drivers by points: if/else 17 (30 pts), boolean chains 4, match/switch 1, ternaries 1 (nesting depth added 13). To reduce it, split the body into named stages: move each independent step or branch into its own named function so the body reads as a short sequence of named calls rather than one long body."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"lib/reporters/default.js"},"region":{"startLine":182}}}],"partialFingerprints":{"codehealthFindingId/v1":"6083646c4c84a4270a9aad6a5e3ad5380bdb4f9bb730c3ed288753660e107dff"}},{"ruleId":"D2","level":"warning","message":{"text":"Runner.start (cognitive 34): Runner.start has cognitive complexity 34 (threshold 15). Drivers by points: if/else 14 (19 pts), boolean chains 10, loops 3, error handling 1, ternaries 1 (nesting depth added 5). Of this number, 26 points are the body\u0027s own statements and 8 belong to 3 function literals inside it that branch. To reduce it, split the body into named stages: move each independent step or branch into its own named function so the body reads as a short sequence of named calls rather than one long body."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"lib/runner.js"},"region":{"startLine":398}}}],"partialFingerprints":{"codehealthFindingId/v1":"23fbb87e88d50ce7020908d7e4d46a08e6f62e6d16d327116288d3ee6af47ba5"}},{"ruleId":"D2","level":"warning","message":{"text":"run (cognitive 34): run has cognitive complexity 34 (threshold 15). Drivers by points: if/else 14 (20 pts), error handling 5 (6 pts), loops 4, boolean chains 3, other 1 (nesting depth added 7). Of this number, 18 points are the body\u0027s own statements and 16 belong to 13 function items inside it that branch. To reduce it, split the body into named stages: move each independent step or branch into its own named function so the body reads as a short sequence of named calls rather than one long body."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"lib/worker/base.js"},"region":{"startLine":52}}}],"partialFingerprints":{"codehealthFindingId/v1":"59c15f892e7be6d163bd3a11d31a4b5b8cd6cadf9a07a25d879547cbbe3033af"}},{"ruleId":"D2","level":"warning","message":{"text":"validateExpectations (cognitive 32): validateExpectations has cognitive complexity 32 (threshold 15). Drivers by points: if/else 9 (15 pts), boolean chains 12, match/switch 1 (3 pts), loops 1 (2 pts) (nesting depth added 9). To reduce it, split the body into named stages: move each independent step or branch into its own named function so the body reads as a short sequence of named calls rather than one long body."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"lib/assert.js"},"region":{"startLine":57}}}],"partialFingerprints":{"codehealthFindingId/v1":"e1f47b4585a40ea87e7ed5b84ba7ae1f5a83e36f1f53592f4aa58d7914deaf83"}},{"ruleId":"D2","level":"warning","message":{"text":"create-chain.createConditionalChain (cognitive 21): create-chain.createConditionalChain has cognitive complexity 21 (threshold 15). Drivers by points: boolean chains 8, if/else 6 (8 pts), ternaries 3 (5 pts) (nesting depth added 4). Of this number, 20 points are the body\u0027s own statements and 1 belongs to one function literal inside it that branches. To reduce it, split the body into named stages: move each independent step or branch into its own named function so the body reads as a short sequence of named calls rather than one long body."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"lib/create-chain.js"},"region":{"startLine":55}}}],"partialFingerprints":{"codehealthFindingId/v1":"dd3a1521c96607ac8a233e1e83074f26f30abefa665546af888657e271006138"}},{"ruleId":"D2","level":"warning","message":{"text":"receiveMessages (cognitive 21): receiveMessages has cognitive complexity 21 (threshold 15). Drivers by points: if/else 6 (14 pts), boolean chains 6, loops 1 (nesting depth added 8). To reduce it, split the body into named stages: move each independent step or branch into its own named function so the body reads as a short sequence of named calls rather than one long body."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"lib/plugin-support/shared-worker-loader.js"},"region":{"startLine":75}}}],"partialFingerprints":{"codehealthFindingId/v1":"7689183cd6536b29a5e0940ee1e971ff9283fda158729661972a100f1549d058"}},{"ruleId":"D2","level":"warning","message":{"text":"TapReporter.consumeStateChange (cognitive 20): TapReporter.consumeStateChange has cognitive complexity 20 (threshold 15). Drivers by points: if/else 8 (15 pts), boolean chains 3, match/switch 1, ternaries 1 (nesting depth added 7). To reduce it, split the body into named stages: move each independent step or branch into its own named function so the body reads as a short sequence of named calls rather than one long body."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"lib/reporters/tap.js"},"region":{"startLine":170}}}],"partialFingerprints":{"codehealthFindingId/v1":"464ea5f543efc8c49e495f8df26824c9079aff0b2550c905cdf90e5f0804689d"}},{"ruleId":"D2","level":"warning","message":{"text":"createConditionalChain::get (cognitive 19): createConditionalChain::get has cognitive complexity 19 (threshold 15). Drivers by points: if/else 6 (8 pts), boolean chains 7, ternaries 2 (4 pts) (nesting depth added 4). To reduce it, split the body into named stages: move each independent step or branch into its own named function so the body reads as a short sequence of named calls rather than one long body."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"lib/create-chain.js"},"region":{"startLine":60}}}],"partialFingerprints":{"codehealthFindingId/v1":"95d04a8f28b9a72f07b76d7ece6cb13540ec1c99c8e868cc54f1521cf68a47da"}},{"ruleId":"D2","level":"warning","message":{"text":"assert.assertExpectations (cognitive 17): assert.assertExpectations has cognitive complexity 17 (threshold 15). Drivers by points: boolean chains 9, if/else 8. To reduce it, name the conditions: bind each compound test to a well-named local or a small predicate function, so the body reads as a sequence of named decisions rather than a chain of operators."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"lib/assert.js"},"region":{"startLine":144}}}],"partialFingerprints":{"codehealthFindingId/v1":"243bebe4b58499a5dea95d09e5e448c7ed2152cf252c3a7f034c8a074310d340"}},{"ruleId":"D2","level":"warning","message":{"text":"FileTracer.#update (cognitive 16): FileTracer.#update has cognitive complexity 16 (threshold 15). Drivers by points: if/else 6 (10 pts), loops 5 (6 pts) (nesting depth added 5). To reduce it, split the body into named stages: move each independent step or branch into its own named function so the body reads as a short sequence of named calls rather than one long body."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"lib/watcher.js"},"region":{"startLine":723}}}],"partialFingerprints":{"codehealthFindingId/v1":"1937489f604901de6ba8eba2cdf53baa1bbfa88d4fbd1c8760110da61ac2d55b"}},{"ruleId":"D2","level":"warning","message":{"text":"suggestExitCode (cognitive 16): suggestExitCode has cognitive complexity 16 (threshold 15). Drivers by points: boolean chains 13, if/else 2, ternaries 1. Of this number, 15 points are the body\u0027s own statements and 1 belongs to one function literal inside it that branches. To reduce it, name the conditions: bind each compound test to a well-named local or a small predicate function, so the body reads as a sequence of named decisions rather than a chain of operators."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"lib/run-status.js"},"region":{"startLine":229}}}],"partialFingerprints":{"codehealthFindingId/v1":"82965d8652f07f5eeb1981a6931b4b184797a6873292dd86152f7c3f287fa21e"}},{"ruleId":"D3","level":"warning","message":{"text":"FunctionTooLong: cli.loadCli: FunctionTooLong \u2014 loadCli runs 309 significant lines (blank, comment-only and punctuation-only lines excluded) in one body. The bar is 100 significant lines; this is 209 over it, 3.09\u00D7 the bar. This is length, not branching: a long straight-line body scores low on complexity and is still read whole to change any part of it, so the complexity numbers beside this row neither confirm nor excuse it. To reduce it, extract each cohesive step of the body \u2014 the runs of statements that work on the same values and would earn the same name \u2014 into its own named unit, and have this one call them in order."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"lib/cli.js"},"region":{"startLine":95}}}],"partialFingerprints":{"codehealthFindingId/v1":"164bbbaf24cf9a95e3a6ab3af931ff400c84be2ffeee8a2d0c355df80b655cc3"}},{"ruleId":"D3","level":"warning","message":{"text":"FunctionTooLong: watcher.plan: FunctionTooLong \u2014 plan runs 292 significant lines (blank, comment-only and punctuation-only lines excluded) in one body. The bar is 100 significant lines; this is 192 over it, 2.92\u00D7 the bar. This is length, not branching: a long straight-line body scores low on complexity and is still read whole to change any part of it, so the complexity numbers beside this row neither confirm nor excuse it. To reduce it, extract each cohesive step of the body \u2014 the runs of statements that work on the same values and would earn the same name \u2014 into its own named unit, and have this one call them in order."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"lib/watcher.js"},"region":{"startLine":172}}}],"partialFingerprints":{"codehealthFindingId/v1":"a973794a466ee5d8d9293a78f5c9f7bba35c8857c2d78eb647e7a8405ee3d8cc"}},{"ruleId":"D3","level":"warning","message":{"text":"MethodTooLong: Api.run: MethodTooLong \u2014 run runs 134 significant lines (blank, comment-only and punctuation-only lines excluded) in one body. The bar is 100 significant lines; this is 34 over it, 1.34\u00D7 the bar. This is length, not branching: a long straight-line body scores low on complexity and is still read whole to change any part of it, so the complexity numbers beside this row neither confirm nor excuse it. To reduce it, extract each cohesive step of the body \u2014 the runs of statements that work on the same values and would earn the same name \u2014 into its own named unit, and have this one call them in order."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"lib/api.js"},"region":{"startLine":106}}}],"partialFingerprints":{"codehealthFindingId/v1":"d1fe6187d569d922af85323bc368766d870a22c2a783a5e290bc087e545a0368"}},{"ruleId":"D3","level":"warning","message":{"text":"MethodTooLong: Reporter.consumeStateChange: MethodTooLong \u2014 consumeStateChange runs 119 significant lines (blank, comment-only and punctuation-only lines excluded) in one body. The bar is 100 significant lines; this is 19 over it, 1.19\u00D7 the bar. This is length, not branching: a long straight-line body scores low on complexity and is still read whole to change any part of it, so the complexity numbers beside this row neither confirm nor excuse it. To reduce it, extract each cohesive step of the body \u2014 the runs of statements that work on the same values and would earn the same name \u2014 into its own named unit, and have this one call them in order."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"lib/reporters/default.js"},"region":{"startLine":182}}}],"partialFingerprints":{"codehealthFindingId/v1":"054ebde6f574e302b32582cb3bea7966978e35af2a730d6994268a3d1301cc4c"}},{"ruleId":"D3","level":"warning","message":{"text":"FunctionTooLong: base.run: FunctionTooLong \u2014 run runs 117 significant lines (blank, comment-only and punctuation-only lines excluded) in one body. The bar is 100 significant lines; this is 17 over it, 1.17\u00D7 the bar. This is length, not branching: a long straight-line body scores low on complexity and is still read whole to change any part of it, so the complexity numbers beside this row neither confirm nor excuse it. To reduce it, extract each cohesive step of the body \u2014 the runs of statements that work on the same values and would earn the same name \u2014 into its own named unit, and have this one call them in order."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"lib/worker/base.js"},"region":{"startLine":52}}}],"partialFingerprints":{"codehealthFindingId/v1":"184637aefaa460f01264d372d8f46afc323b86d0ec98b226a51f3fdad0fabf22"}},{"ruleId":"D3","level":"warning","message":{"text":"MethodTooLong: Runner.constructor: MethodTooLong \u2014 constructor runs 111 significant lines (blank, comment-only and punctuation-only lines excluded) in one body. The bar is 100 significant lines; this is 11 over it, 1.11\u00D7 the bar. This is length, not branching: a long straight-line body scores low on complexity and is still read whole to change any part of it, so the complexity numbers beside this row neither confirm nor excuse it. To reduce it, extract each cohesive step of the body \u2014 the runs of statements that work on the same values and would earn the same name \u2014 into its own named unit, and have this one call them in order."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"lib/runner.js"},"region":{"startLine":20}}}],"partialFingerprints":{"codehealthFindingId/v1":"aced2c0250432e4f69a485fbfe52887cb2203a61c9236949b80c0c9f3b5ac3fb"}},{"ruleId":"D3","level":"warning","message":{"text":"ClassTooLong: Reporter: ClassTooLong \u2014 428 significant lines (blank, comment-only and punctuation-only lines excluded), 13 methods. The bar is 400 significant lines; this is 28 over it, 1.07\u00D7 the bar. To reduce it, group the members that share the same data into a smaller type of their own and delegate to it, so no single type carries every responsibility."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"lib/reporters/default.js"},"region":{"startLine":74}}}],"partialFingerprints":{"codehealthFindingId/v1":"75a3624ef1d71da37f97a79da0a78dea93aa9954a91722a9aa3b98921204c6de"}},{"ruleId":"D3","level":"warning","message":{"text":"FileTooLong: lib/assert.js: FileTooLong \u2014 524 significant lines (blank, comment-only and punctuation-only lines excluded; the length bar is tripled for a single-responsibility module of 4 or fewer top-level units). The bar is 500 significant lines; this is 24 over it, 1.05\u00D7 the bar. To reduce it, split the file along the responsibilities already in it: move each cohesive group of declarations into its own sibling file in the same module or package, so no one file has to be read whole to change one of them."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"lib/assert.js"},"region":{"startLine":1}}}],"partialFingerprints":{"codehealthFindingId/v1":"68f393455422fe8fbb39b331030fcc5576840b7accf19ee77f96a4e6bf55660e"}},{"ruleId":"D3","level":"warning","message":{"text":"FileTooLong: lib/watcher.js: FileTooLong \u2014 516 significant lines (blank, comment-only and punctuation-only lines excluded; the length bar is tripled for a single-responsibility module of 4 or fewer top-level units). The bar is 500 significant lines; this is 16 over it, 1.03\u00D7 the bar. To reduce it, split the file along the responsibilities already in it: move each cohesive group of declarations into its own sibling file in the same module or package, so no one file has to be read whole to change one of them."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"lib/watcher.js"},"region":{"startLine":1}}}],"partialFingerprints":{"codehealthFindingId/v1":"f661fd7656fb5a702b3433dba25b3d7b4fbcd7b54657eb91750c50fd1b20a162"}},{"ruleId":"D3","level":"warning","message":{"text":"MethodTooLong: RunStatus.emitStateChange: MethodTooLong \u2014 emitStateChange runs 101 significant lines (blank, comment-only and punctuation-only lines excluded) in one body. The bar is 100 significant lines; this is 1 over it, 1.01\u00D7 the bar. This is length, not branching: a long straight-line body scores low on complexity and is still read whole to change any part of it, so the complexity numbers beside this row neither confirm nor excuse it. To reduce it, extract each cohesive step of the body \u2014 the runs of statements that work on the same values and would earn the same name \u2014 into its own named unit, and have this one call them in order."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"lib/run-status.js"},"region":{"startLine":75}}}],"partialFingerprints":{"codehealthFindingId/v1":"76fccb24d42da22df5515361b9daf6539ac90dc0f61c0a7b98b267d0df3fc3c2"}},{"ruleId":"D10","level":"warning","message":{"text":"Skipped test: baz: Skipped \u2014 switched off by test.skip"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"test/snapshot-workflow/fixtures/invalid-snapfile/test.js"},"region":{"startLine":15}}}],"partialFingerprints":{"codehealthFindingId/v1":"153ab890e20a3bcfd8d937bd79f2523ec2b10883a1ec3315f715f4636aafe568"}},{"ruleId":"D10","level":"warning","message":{"text":"Skipped test: some snapshots: Skipped \u2014 switched off by test.skip"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"test/snapshot-removal/fixtures/skipped-tests/test.js"},"region":{"startLine":17}}}],"partialFingerprints":{"codehealthFindingId/v1":"78c0b823226ad722f3a23bd1c020289a5c0ee8056526ba2e7a8536648ac1bce9"}},{"ruleId":"D10","level":"warning","message":{"text":"No assertions: does not run precompiled files when sources are deleted: This method\u0027s body runs code, and no assertion call was recognised in it. Recognised by name: Assert*, *Should*/ShouldBe*, Verify, Expect, Throws, Record, Received/DidNotReceive, MustHaveHappened/MustNotHaveHappened, EnsureSuccessStatusCode and *AndEnsure* \u2014 so verification routed through a helper of your own naming, through a base-class or callback object whose members hold the assertions, or through a harness that fails by throwing under some other name, is not visible to this check and is not counted here. Read it as \u0027no assertion this check knows how to see\u0027, and if that is right, add one."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"test/watch-mode/typescript.js"},"region":{"startLine":23}}}],"partialFingerprints":{"codehealthFindingId/v1":"6c12ab50519a2b575033bebee960db3f276d911a2e2738f0498e6251dddeb06b"}},{"ruleId":"D10","level":"warning","message":{"text":"No assertions: handles deletion of precompiled and source files (multiple possible sources for precompiled file): This method\u0027s body runs code, and no assertion call was recognised in it. Recognised by name: Assert*, *Should*/ShouldBe*, Verify, Expect, Throws, Record, Received/DidNotReceive, MustHaveHappened/MustNotHaveHappened, EnsureSuccessStatusCode and *AndEnsure* \u2014 so verification routed through a helper of your own naming, through a base-class or callback object whose members hold the assertions, or through a harness that fails by throwing under some other name, is not visible to this check and is not counted here. Read it as \u0027no assertion this check knows how to see\u0027, and if that is right, add one."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"test/watch-mode/typescript.js"},"region":{"startLine":34}}}],"partialFingerprints":{"codehealthFindingId/v1":"8f28c0b331e38f5009ecdcd9d7c129c1553436a5f32a447f7fbf065346d91129"}},{"ruleId":"D10","level":"warning","message":{"text":"No assertions: handles deletion of precompiled and source files (single possible source for precompiled file): This method\u0027s body runs code, and no assertion call was recognised in it. Recognised by name: Assert*, *Should*/ShouldBe*, Verify, Expect, Throws, Record, Received/DidNotReceive, MustHaveHappened/MustNotHaveHappened, EnsureSuccessStatusCode and *AndEnsure* \u2014 so verification routed through a helper of your own naming, through a base-class or callback object whose members hold the assertions, or through a harness that fails by throwing under some other name, is not visible to this check and is not counted here. Read it as \u0027no assertion this check knows how to see\u0027, and if that is right, add one."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"test/watch-mode/typescript.js"},"region":{"startLine":46}}}],"partialFingerprints":{"codehealthFindingId/v1":"d9f829898518b7d58383d76532e3268cffb441042da21195ea096d361b5ef2c6"}},{"ruleId":"D10","level":"error","message":{"text":"No assertions (empty test): timeout with custom message: Test method has an empty body \u2014 it asserts nothing and exercises no code."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"test/test-timeouts/fixtures/custom-message.js"},"region":{"startLine":3}}}],"partialFingerprints":{"codehealthFindingId/v1":"2262f8154dd0037711cdffb3f3198d240d6053183fea30873cd3eb41b8602c53"}},{"ruleId":"D10","level":"warning","message":{"text":"No assertions: timeout with invalid message: This method\u0027s body runs code, and no assertion call was recognised in it. Recognised by name: Assert*, *Should*/ShouldBe*, Verify, Expect, Throws, Record, Received/DidNotReceive, MustHaveHappened/MustNotHaveHappened, EnsureSuccessStatusCode and *AndEnsure* \u2014 so verification routed through a helper of your own naming, through a base-class or callback object whose members hold the assertions, or through a harness that fails by throwing under some other name, is not visible to this check and is not counted here. Read it as \u0027no assertion this check knows how to see\u0027, and if that is right, add one."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"test/test-timeouts/fixtures/invalid-message.js"},"region":{"startLine":3}}}],"partialFingerprints":{"codehealthFindingId/v1":"e604d5a663f2bd5a929a66ab51299c00edc8a6aeea9f49899d36fa40f488c290"}},{"ruleId":"D10","level":"warning","message":{"text":"No assertions: multiline try assertion title: This method\u0027s body runs code, and no assertion call was recognised in it. Recognised by name: Assert*, *Should*/ShouldBe*, Verify, Expect, Throws, Record, Received/DidNotReceive, MustHaveHappened/MustNotHaveHappened, EnsureSuccessStatusCode and *AndEnsure* \u2014 so verification routed through a helper of your own naming, through a base-class or callback object whose members hold the assertions, or through a harness that fails by throwing under some other name, is not visible to this check and is not counted here. Read it as \u0027no assertion this check knows how to see\u0027, and if that is right, add one."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"test/snapshot-tests/fixtures/normalized-title-in-stdout/test.js"},"region":{"startLine":18}}}],"partialFingerprints":{"codehealthFindingId/v1":"a4c26cc6887b772eeb4d12640854edf2fc52fc630af474ff697852be3d4674c1"}},{"ruleId":"D10","level":"warning","message":{"text":"No assertions: try: This method\u0027s body runs code, and no assertion call was recognised in it. Recognised by name: Assert*, *Should*/ShouldBe*, Verify, Expect, Throws, Record, Received/DidNotReceive, MustHaveHappened/MustNotHaveHappened, EnsureSuccessStatusCode and *AndEnsure* \u2014 so verification routed through a helper of your own naming, through a base-class or callback object whose members hold the assertions, or through a harness that fails by throwing under some other name, is not visible to this check and is not counted here. Read it as \u0027no assertion this check knows how to see\u0027, and if that is right, add one."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"test/multiple-implementations/fixtures/try.js"},"region":{"startLine":3}}}],"partialFingerprints":{"codehealthFindingId/v1":"016353a2b2f861cc2de16c9d2511f192effffec12c86b15046e293e11037d36d"}},{"ruleId":"D10","level":"warning","message":{"text":"No assertions: timeout with console output: This method\u0027s body runs code, and no assertion call was recognised in it. Recognised by name: Assert*, *Should*/ShouldBe*, Verify, Expect, Throws, Record, Received/DidNotReceive, MustHaveHappened/MustNotHaveHappened, EnsureSuccessStatusCode and *AndEnsure* \u2014 so verification routed through a helper of your own naming, through a base-class or callback object whose members hold the assertions, or through a harness that fails by throwing under some other name, is not visible to this check and is not counted here. Read it as \u0027no assertion this check knows how to see\u0027, and if that is right, add one."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"test/idle-timeouts/fixtures/console-output.js"},"region":{"startLine":5}}}],"partialFingerprints":{"codehealthFindingId/v1":"c752168523f84849784cf78299e5cc3d3038444825072dedc38b81f5056b9461"}},{"ruleId":"D10","level":"warning","message":{"text":"No assertions: (unnamed test): This method\u0027s body runs code, and no assertion call was recognised in it. Recognised by name: Assert*, *Should*/ShouldBe*, Verify, Expect, Throws, Record, Received/DidNotReceive, MustHaveHappened/MustNotHaveHappened, EnsureSuccessStatusCode and *AndEnsure* \u2014 so verification routed through a helper of your own naming, through a base-class or callback object whose members hold the assertions, or through a harness that fails by throwing under some other name, is not visible to this check and is not counted here. Read it as \u0027no assertion this check knows how to see\u0027, and if that is right, add one."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"test/assertions/fixtures/happy-path.js"},"region":{"startLine":30}}}],"partialFingerprints":{"codehealthFindingId/v1":"0a3331088b4ad7e2f461a4fa5a7be6bebd03b87a9ea056a97c749c89d25512fc"}},{"ruleId":"D10","level":"warning","message":{"text":"No assertions: (unnamed test): This method\u0027s body runs code, and no assertion call was recognised in it. Recognised by name: Assert*, *Should*/ShouldBe*, Verify, Expect, Throws, Record, Received/DidNotReceive, MustHaveHappened/MustNotHaveHappened, EnsureSuccessStatusCode and *AndEnsure* \u2014 so verification routed through a helper of your own naming, through a base-class or callback object whose members hold the assertions, or through a harness that fails by throwing under some other name, is not visible to this check and is not counted here. Read it as \u0027no assertion this check knows how to see\u0027, and if that is right, add one."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"test/assertions/fixtures/happy-path.js"},"region":{"startLine":33}}}],"partialFingerprints":{"codehealthFindingId/v1":"9c27219afbe5487608ad9340f0d383e16db7dced2b9a0ef30dad3cb408047def"}},{"ruleId":"D10","level":"error","message":{"text":"No assertions (empty test): (unnamed test): Test method has an empty body \u2014 it asserts nothing and exercises no code."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"test/assertions/fixtures/happy-path.js"},"region":{"startLine":36}}}],"partialFingerprints":{"codehealthFindingId/v1":"9a1421dc986dc0a38e2dd70e04841af605327e4d27c23df585e0d41b1f69afa4"}},{"ruleId":"D10","level":"error","message":{"text":"No assertions (empty test): (unnamed test): Test method has an empty body \u2014 it asserts nothing and exercises no code."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"test/assertions/fixtures/happy-path.js"},"region":{"startLine":37}}}],"partialFingerprints":{"codehealthFindingId/v1":"2463861f303587736f11632b3f376b1339085830d76e9ae459eff1a4d9413fd5"}},{"ruleId":"D10","level":"warning","message":{"text":"Test project verifies nothing: test/idle-timeouts/fixtures: No conventional assertion call was detected in 1 of 1 tests in \u0060test/idle-timeouts/fixtures\u0060 \u2014 the project as a whole, not one method. Two things look like this: verification that happens indirectly (an approval/verifier harness or BDD step methods), or a suite that genuinely checks nothing. If it is the latter, this project passes unconditionally and cannot fail."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"test/idle-timeouts/fixtures/console-output.js"},"region":{"startLine":5}}}],"partialFingerprints":{"codehealthFindingId/v1":"e391a05b6f4363517d1faa1ee78c6981359bf1ea322bfdba09f79c9f18a85bbf"}},{"ruleId":"D10","level":"warning","message":{"text":"Test project verifies nothing: test/multiple-implementations/fixtures: No conventional assertion call was detected in 1 of 1 tests in \u0060test/multiple-implementations/fixtures\u0060 \u2014 the project as a whole, not one method. Two things look like this: verification that happens indirectly (an approval/verifier harness or BDD step methods), or a suite that genuinely checks nothing. If it is the latter, this project passes unconditionally and cannot fail."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"test/multiple-implementations/fixtures/try.js"},"region":{"startLine":3}}}],"partialFingerprints":{"codehealthFindingId/v1":"1109c19d744c9c6912d2b4ed2f6580e3ed4762d6ca0e72e32cf77a0977803e0e"}},{"ruleId":"D10","level":"warning","message":{"text":"Test project verifies nothing: test/test-timeouts/fixtures: No conventional assertion call was detected in 2 of 2 tests in \u0060test/test-timeouts/fixtures\u0060 \u2014 the project as a whole, not one method. Two things look like this: verification that happens indirectly (an approval/verifier harness or BDD step methods), or a suite that genuinely checks nothing. If it is the latter, this project passes unconditionally and cannot fail."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"test/test-timeouts/fixtures/custom-message.js"},"region":{"startLine":3}}}],"partialFingerprints":{"codehealthFindingId/v1":"f017d676610f887ef2b032507d462b35cd2677e9b88b3efc19cfbaf667bde7c1"}},{"ruleId":"D15","level":"warning","message":{"text":"Hotspot: lib/assert.js: lib/assert.js changed 5 times in last 90 days, and the most complex body those changes touched has cyclomatic complexity 69 in Assertions.constructor at line 241. Frequent change and high complexity in one file compound: schedule the next change to it to include carving out the part being edited, with the area under test before it moves. Counted over 2026-07-29..2026-10-27, the 90 days ending at the analysed commit. Reproduce with \u0060git log --since=\u00272026-07-29 20:18:57 \u002B00:00\u0027 --until=\u00272026-10-27 20:18:57 \u002B00:00\u0027 --full-history --no-merges -- lib/assert.js\u0060: merges are excluded because a merge re-states changes already counted at their own commits, and history is NOT path-simplified because a change that reached the file through a merged branch is still a change to it. That command counts raw commits and can read HIGHER than this row, which counts a cherry-picked re-land, and a revert together with the commit it undoes, once each \u2014 a difference of several commits on a file whose history was re-landed or reverted inside the window."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"lib/assert.js"},"region":{"startLine":241}}}],"partialFingerprints":{"codehealthFindingId/v1":"15fc4e397666fe4a21197b444de12662c59693d63a7182c2b11d71d39b4e4568"}},{"ruleId":"D15","level":"warning","message":{"text":"Hotspot: lib/api.js: lib/api.js changed 2 times in last 90 days, and the most complex body those changes touched has cyclomatic complexity 40 in Api.run at line 106. Frequent change and high complexity in one file compound: schedule the next change to it to include carving out the part being edited, with the area under test before it moves. Counted over 2026-07-29..2026-10-27, the 90 days ending at the analysed commit. Reproduce with \u0060git log --since=\u00272026-07-29 20:18:57 \u002B00:00\u0027 --until=\u00272026-10-27 20:18:57 \u002B00:00\u0027 --full-history --no-merges -- lib/api.js\u0060: merges are excluded because a merge re-states changes already counted at their own commits, and history is NOT path-simplified because a change that reached the file through a merged branch is still a change to it. That command counts raw commits and can read HIGHER than this row, which counts a cherry-picked re-land, and a revert together with the commit it undoes, once each \u2014 a difference of several commits on a file whose history was re-landed or reverted inside the window."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"lib/api.js"},"region":{"startLine":106}}}],"partialFingerprints":{"codehealthFindingId/v1":"0d3741d0d0ac2500fb5020cda49065573e216c76c4836d4b67b96d80426e17e6"}},{"ruleId":"D15","level":"warning","message":{"text":"Hotspot: lib/worker/base.js: lib/worker/base.js changed 2 times in last 90 days, and the most complex body those changes touched has cyclomatic complexity 26 in base.run at line 52. Frequent change and high complexity in one file compound: schedule the next change to it to include carving out the part being edited, with the area under test before it moves. Counted over 2026-07-29..2026-10-27, the 90 days ending at the analysed commit. Reproduce with \u0060git log --since=\u00272026-07-29 20:18:57 \u002B00:00\u0027 --until=\u00272026-10-27 20:18:57 \u002B00:00\u0027 --full-history --no-merges -- lib/worker/base.js\u0060: merges are excluded because a merge re-states changes already counted at their own commits, and history is NOT path-simplified because a change that reached the file through a merged branch is still a change to it. That command counts raw commits and can read HIGHER than this row, which counts a cherry-picked re-land, and a revert together with the commit it undoes, once each \u2014 a difference of several commits on a file whose history was re-landed or reverted inside the window."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"lib/worker/base.js"},"region":{"startLine":52}}}],"partialFingerprints":{"codehealthFindingId/v1":"7c3324b21f45a36f249638b114e45ebc171f7823a3c532ad1a73d14060c39a18"}},{"ruleId":"D16","level":"note","message":{"text":"Off-boarding risk: anonymized user #1: If anonymized user #1 becomes unavailable, 2 significant file(s) lose their only recent owner: lib/globs.js, xo.config.js. Pair on, review, or document these before any departure."},"locations":[],"partialFingerprints":{"codehealthFindingId/v1":"0696962014c42e86be0bf8f4d9c90f90b81e3d91414321aaf49e2ecb35d632f9"}},{"ruleId":"D20","level":"note","message":{"text":"No ADRs found: No ADRs found. No recognised ADR directory (\u0060docs/adr/\u0060, \u0060docs/decisions/\u0060, \u0060adr/\u0060, \u0060docs/rfcs/\u0060, an \u0060ADR0001/\u0060 folder, or their siblings) exists anywhere in this tree. What was searched, so you can tell an empty log from a search that missed one: every directory under the tree (build output, dependencies and VCS metadata excepted), for a document that is either any non-index page inside a recognised ADR directory, whatever its name and however deeply nested (\u0060docs/adr/use-postgres.md\u0060, \u0060docs/adr/2024/0001-x.md\u0060); or a file anywhere whose name is ADR-shaped (\u00600001-use-postgres.md\u0060, \u0060adr-012-caching.md\u0060); or, when neither turned anything up, a document carrying the decision-record signature (an \u0022Architecture Decision Record\u0022 heading, or Status / Context / Decision / Consequences as section headings). A decision log that clears none of these \u2014 unnumbered files outside any recognised directory, without those headings \u2014 is not seen by this check and this row is then wrong. If that is your case, say so rather than renaming anything; otherwise, consider recording architectural decisions in \u0060docs/adr/\u0060."},"locations":[],"partialFingerprints":{"codehealthFindingId/v1":"d2bea044ff79d7d275f5a91a6e2f548586178eaf480274c33960ad020c854631"}},{"ruleId":"D28","level":"error","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"175268ca5e6062fb4a9a6ab27d03795d708d6fc2eae2b2ce183f824d4c97e24e"}},{"ruleId":"D28","level":"error","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"b01026595647c706210d43a43b08c2651d371d36b06332ab9e9bad47fb3766ca"}},{"ruleId":"D28","level":"error","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"5f19ee62a31bba465cbf775a0074d8be77951d81b454aa867d454fa5cac0e1df"},"properties":{"commitSha":"02ea7b60ce60485fd8fe1c7938d8f9e3f0f1f78b"},"taxa":[{"id":"CWE-259","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}},{"id":"CWE-540","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}},{"id":"A01:2025","toolComponent":{"name":"OWASP Top 10","guid":"7d1f0c2e-4b6a-4e39-9a51-0b2e8c3d5f61"}}]},{"ruleId":"D28","level":"note","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"3cdfd7beb31b791ae18dcb425e21eb157c842e7bbcd522cc330573c1a6538db1"}},{"ruleId":"D29","level":"error","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"a1f31e3fc38e806c632551480508ae27b2701acddad0a9d80c648ba1fc9463b3"},"taxa":[{"id":"CWE-1357","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}},{"id":"CWE-353","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}},{"id":"A03:2025","toolComponent":{"name":"OWASP Top 10","guid":"7d1f0c2e-4b6a-4e39-9a51-0b2e8c3d5f61"}}]},{"ruleId":"D29","level":"error","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"c2f149aaf8ae268ec9d19ad08488786c77c70c1fd4ce58c42012cfb9d14c73b1"},"taxa":[{"id":"CWE-1357","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}},{"id":"CWE-353","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}},{"id":"A03:2025","toolComponent":{"name":"OWASP Top 10","guid":"7d1f0c2e-4b6a-4e39-9a51-0b2e8c3d5f61"}}]},{"ruleId":"D29","level":"error","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"f31733cc815de25a7bae74d164778ec098ea9aa6fcbd8c5cb1ce929451728f28"},"taxa":[{"id":"CWE-1357","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}},{"id":"CWE-353","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}},{"id":"A03:2025","toolComponent":{"name":"OWASP Top 10","guid":"7d1f0c2e-4b6a-4e39-9a51-0b2e8c3d5f61"}}]},{"ruleId":"D29","level":"error","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"96f88121b035a898a6759141862415469563ae4858d3bd2449d90d5e5ba04a57"},"taxa":[{"id":"CWE-522","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}},{"id":"CWE-829","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}},{"id":"A06:2025","toolComponent":{"name":"OWASP Top 10","guid":"7d1f0c2e-4b6a-4e39-9a51-0b2e8c3d5f61"}},{"id":"CICD-SEC-6","toolComponent":{"name":"OWASP Top 10 CI/CD Security Risks","guid":"3c9b2a6e-5d14-4f7b-8e02-6a1d9c4b7f35"}}]},{"ruleId":"D29","level":"error","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"c1bb7814097052b3b9e49cf20adb5ffa3c94da3abc00863955683dc4725b2e91"},"taxa":[{"id":"CWE-1357","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}},{"id":"CWE-353","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}},{"id":"A03:2025","toolComponent":{"name":"OWASP Top 10","guid":"7d1f0c2e-4b6a-4e39-9a51-0b2e8c3d5f61"}}]},{"ruleId":"D29","level":"error","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"723c47a76f8d14f742f6df68ac07849afb779db69c6b0b1b8c72ca4712c57413"},"taxa":[{"id":"CWE-1357","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}},{"id":"CWE-353","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}},{"id":"A03:2025","toolComponent":{"name":"OWASP Top 10","guid":"7d1f0c2e-4b6a-4e39-9a51-0b2e8c3d5f61"}}]},{"ruleId":"D29","level":"error","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"ae4b19a624088a80ae967fa19fc6e2d3b4d86bf95f6afb9918729adad8224e32"},"taxa":[{"id":"CWE-1357","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}},{"id":"CWE-353","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}},{"id":"A03:2025","toolComponent":{"name":"OWASP Top 10","guid":"7d1f0c2e-4b6a-4e39-9a51-0b2e8c3d5f61"}}]},{"ruleId":"D29","level":"error","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"a196ab56ac1e691c97385fa96a42aa62e4a98c50bf9c1dcf90bc40b8bcca34bf"},"taxa":[{"id":"CWE-1357","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}},{"id":"CWE-353","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}},{"id":"A03:2025","toolComponent":{"name":"OWASP Top 10","guid":"7d1f0c2e-4b6a-4e39-9a51-0b2e8c3d5f61"}}]},{"ruleId":"D29","level":"error","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"82a1893f62fe8dee3fcdaad2e3da3e94b86729172346ee8d336b86cb9d8780c6"},"taxa":[{"id":"CWE-1357","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}},{"id":"CWE-353","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}},{"id":"A03:2025","toolComponent":{"name":"OWASP Top 10","guid":"7d1f0c2e-4b6a-4e39-9a51-0b2e8c3d5f61"}}]},{"ruleId":"D29","level":"error","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"8b05092d201f6fb07c46656b4fc881cb42cda157c4d8fcfdf5592caa39181951"},"taxa":[{"id":"CWE-1357","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}},{"id":"CWE-353","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}},{"id":"A03:2025","toolComponent":{"name":"OWASP Top 10","guid":"7d1f0c2e-4b6a-4e39-9a51-0b2e8c3d5f61"}}]},{"ruleId":"D29","level":"error","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"5be03ab325ce0dd57044d4e411f1428508ecf7870bea56774afff406be2e7ce3"},"taxa":[{"id":"CWE-1357","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}},{"id":"CWE-353","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}},{"id":"A03:2025","toolComponent":{"name":"OWASP Top 10","guid":"7d1f0c2e-4b6a-4e39-9a51-0b2e8c3d5f61"}}]},{"ruleId":"D29","level":"error","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"75369c09bb288495c1ec96550eb2aa9585bb73f2d0abcdd876376a94900b52cc"},"taxa":[{"id":"CWE-1357","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}},{"id":"CWE-353","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}},{"id":"A03:2025","toolComponent":{"name":"OWASP Top 10","guid":"7d1f0c2e-4b6a-4e39-9a51-0b2e8c3d5f61"}}]},{"ruleId":"D29","level":"error","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"1f1b01b514bc6b69efa5732e85ac39cb778d8accb702dcea682ac2d43e0881ee"},"taxa":[{"id":"CWE-1357","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}},{"id":"CWE-353","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}},{"id":"A03:2025","toolComponent":{"name":"OWASP Top 10","guid":"7d1f0c2e-4b6a-4e39-9a51-0b2e8c3d5f61"}}]},{"ruleId":"D29","level":"error","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"3ecdad865cbb72ba3e22c322946f6c14d603d07ddb84a26ecfad788a5dc98b29"},"taxa":[{"id":"CWE-1357","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}},{"id":"CWE-353","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}},{"id":"A03:2025","toolComponent":{"name":"OWASP Top 10","guid":"7d1f0c2e-4b6a-4e39-9a51-0b2e8c3d5f61"}}]},{"ruleId":"D29","level":"error","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"8af93b54d7b6d09176d9c9016e65470b9e3497c2e30cd6af0b8b0a89230292a4"},"taxa":[{"id":"CWE-829","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}},{"id":"A08:2025","toolComponent":{"name":"OWASP Top 10","guid":"7d1f0c2e-4b6a-4e39-9a51-0b2e8c3d5f61"}}]},{"ruleId":"D29","level":"warning","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"92c64767a66197736f7788a650e07229b7570dc3ceaefb3c2491823410582b69"},"taxa":[{"id":"CWE-1333","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}},{"id":"A02:2025","toolComponent":{"name":"OWASP Top 10","guid":"7d1f0c2e-4b6a-4e39-9a51-0b2e8c3d5f61"}}]},{"ruleId":"D30","level":"note","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"b7198a068b97a1af1f65e3196cdf11565ec276006632a836614e182488e4d847"},"properties":{"dependency":{"package":"katex","version":"0.16.47","advisory":"[GHSA redacted]","aliases":["[CVE redacted]"],"reachability":{"kind":"not-imported"}}}},{"ruleId":"D35","level":"warning","message":{"text":"Change coupling: fork.js \u2194 channel.js: \u0060lib/fork.js\u0060 and \u0060lib/worker/channel.js\u0060 change together 75% of the time (9 of the 12 commits that touched whichever of the two files changed less often, counting a file under its earlier names as well \u2014 a repo-wide or module-wide sweep is evidence about the sweep rather than about any pair inside it and is left out of BOTH sides of this ratio, while a dependency bump, a formatter/rename sweep, or a commit whose edit to one of the two files was a tool directive such as //go:generate or whitespace only is left out of the shared count ONLY, so the two sides are not taken over identical commit sets) with no explicit dependency \u2014 the edge is real but nothing declares it. Read the pair before acting: if one registers itself into the other through a hook or an initialiser, the missing dependency is DELIBERATE \u2014 the registration is the link, and it is meant not to be an import \u2014 and the thing to add is a comment on each side naming the other, not a merge; if they simply belong together, co-locate them; if neither holds, the coupling is hidden and worth breaking. You can check this without leaving the row: of the 9 shared commits counted here, the most recent 3 are \u0060b99b703f\u0060 Keep test worker alive until explicitly freed (at that commit the file was still \u0060lib/worker/channel.cjs\u0060); \u0060af5684df\u0060 Don\u0027t force-exit after tests have completed (at that commit the file was still \u0060lib/worker/channel.cjs\u0060); \u00600187779a\u0060 Dependency updates (at that commit the file was still \u0060lib/worker/channel.cjs\u0060) \u2014 run \u0060git show\u0060 on any of them."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"lib/fork.js"},"region":{"startLine":1}}}],"partialFingerprints":{"codehealthFindingId/v1":"dcdc2bedd1fc6335adb24ecaee8dcddaf3bf215ade915fc35ff50b6f67e82527"}},{"ruleId":"D36","level":"note","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"eb00976a698a5d68999b7ee6d27206fd374e916853e7ff1ead5eed42386f043f"},"taxa":[{"id":"CICD-SEC-9","toolComponent":{"name":"OWASP Top 10 CI/CD Security Risks","guid":"3c9b2a6e-5d14-4f7b-8e02-6a1d9c4b7f35"}}]},{"ruleId":"D36","level":"warning","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"90f83b4fa27db32740afe9540c905f3c0499caed87f61049a8a903ecc95b41c3"},"taxa":[{"id":"CICD-SEC-8","toolComponent":{"name":"OWASP Top 10 CI/CD Security Risks","guid":"3c9b2a6e-5d14-4f7b-8e02-6a1d9c4b7f35"}}]},{"ruleId":"D36","level":"warning","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"81d0799af757bba1afbed34637d383ea39ed22bd8ff8ec5b09c5aa413595d701"},"taxa":[{"id":"CICD-SEC-6","toolComponent":{"name":"OWASP Top 10 CI/CD Security Risks","guid":"3c9b2a6e-5d14-4f7b-8e02-6a1d9c4b7f35"}}]},{"ruleId":"D36","level":"note","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"ace515990e7ee0f17b5c17e44dd168a5bdecf90804a3a3dd845cf05540978013"},"taxa":[{"id":"CICD-SEC-3","toolComponent":{"name":"OWASP Top 10 CI/CD Security Risks","guid":"3c9b2a6e-5d14-4f7b-8e02-6a1d9c4b7f35"}}]},{"ruleId":"IC1","level":"note","message":{"text":"Disabled test: A test is skipped/ignored \u2014 coverage that looks present but never runs. Re-enable it or delete it so the green run means something."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"test/snapshot-removal/fixtures/skipped-tests/test.js"},"region":{"startLine":17}}}],"partialFingerprints":{"codehealthFindingId/v1":"72b9cc3105505b12fa616b47a173adca283975a5b550f0072480742a8afbdbcd"}},{"ruleId":"IC1","level":"note","message":{"text":"Disabled test: A test is skipped/ignored \u2014 coverage that looks present but never runs. Re-enable it or delete it so the green run means something."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"test/snapshot-workflow/fixtures/invalid-snapfile/test.js"},"region":{"startLine":15}}}],"partialFingerprints":{"codehealthFindingId/v1":"7ad10d6d5b2a9d8da3016cfcdf26ab04afd21f156cf77e86567a38776092421f"}},{"ruleId":"M1","level":"warning","message":{"text":"README may be stale: 40 code files changed in the last 6 months but the README was not touched \u2014 it may no longer reflect the system."},"locations":[],"partialFingerprints":{"codehealthFindingId/v1":"e973e7a8d5d866995cbf78b120250fe7f132bf928812d48ca62e69aba11b9910"}},{"ruleId":"M2","level":"note","message":{"text":"No ADRs: No Architecture Decision Records found \u2014 no conventional ADR directory, no numbered \u0060NNNN-title\u0060 documents in any markup this check reads, and nothing ADR-shaped by content. Design rationale recorded elsewhere (a design-notes tree, a mailing list, pull-request discussion) is not visible to this check and is not re-findable per decision, so a future maintainer cannot ask why one choice was made and get an answer."},"locations":[],"partialFingerprints":{"codehealthFindingId/v1":"670b3d6e36a756d63097d0dfbf90afd5fc761308800b9354894a07c3f4e4aa14"}},{"ruleId":"M2","level":"note","message":{"text":"No architecture diagram/doc: No C4/Structurizr/PlantUML/Mermaid/Graphviz/D2 diagram, no drawn diagram named for the architecture, no file named \u0060architecture\u0060 or \u0060design\u0060 in any markup this check reads, and nothing in the README, docs or contributor guides that announces the shape \u2014 no \u0060## Architecture\u0060 heading, no \u0022architecture overview\u0022/\u0022high-level design\u0022 phrasing, no \u0022the architecture is \u2026\u0022 introduction, no guided code tour. A shape laid out in prose that never names itself as the architecture is not visible to this check, and neither is one kept outside the repository, so this row reports the absence of a re-findable shape document \u2014 not evidence that nobody wrote the shape down."},"locations":[],"partialFingerprints":{"codehealthFindingId/v1":"0c190e7c159d1850ee706c3ac4486e151e8a4fe169de4bf61436b9f399654f06"}},{"ruleId":"M4","level":"note","message":{"text":"README/code drift: docs/recipes/typescript.md names Node.js 20, but the repository declares engines \u0060^22.20 || ^24.12 || \u003E=26\u0060. Checked without a model against the repository: its files and folders, the scripts and dependencies of every package.json, the projects, namespaces, package references and target frameworks of the .NET build, the SDK and Node pins, and the identifiers of every file that is not a document; the documents\u0027 own text never counts. A footprint generated at build time, read only by a platform, or living outside this repository is not seen, and this row is then wrong."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"docs/recipes/typescript.md"},"region":{"startLine":21}}}],"partialFingerprints":{"codehealthFindingId/v1":"b788b0d813c8ae67560927e09b6a59f48f4c8a39b243e2fd9f543023b34cdffc"}},{"ruleId":"P1","level":"note","message":{"text":"CI build step not evidenced: A CI pipeline exists but no build step was matched \u2014 changes may merge without the build ever running. A build step may be invoked directly as a command, or declared as a task that a runner named in the pipeline resolves."},"locations":[],"partialFingerprints":{"codehealthFindingId/v1":"251015acef1a259fcc13b7c60660cc8917ccb3ae8056cb5165ae03312dd586e8"}},{"ruleId":"P12","level":"warning","message":{"text":"Coverage collected but not gated: CI collects a coverage report but no step enforces a minimum \u2014 coverage could halve and CI stays green. Add a step that fails the build when coverage drops below a floor (your coverage tool\u0027s minimum-threshold flag, or a coverage-gate action) so the number guards something. What was searched, so you can tell an absence from a miss: this repository\u0027s CI files AND its coverage configuration \u2014 the well-known coverage and test-runner config files, read at the repository root and inside workspace package directories two levels down, so a floor declared beside the tests rather than in the pipeline is credited \u2014 matched against the threshold settings this check knows by name. A floor set in your coverage service\u0027s web UI rather than in a committed file, or under a setting whose name is not one of those, is not seen here."},"locations":[],"partialFingerprints":{"codehealthFindingId/v1":"7f63c06044cf998d9a0698692df30d8873e29bc9b0c98ee829255017c1193d33"}},{"ruleId":"P3","level":"note","message":{"text":"No SAST: No static application security testing detected. For this repository\u0027s stack, add CodeQL\u0027s javascript-typescript pack, \u0060semgrep --config=p/typescript\u0060, or eslint-plugin-security as a CI step. What was searched, so you can tell an absence from a miss: the 8629 CI workflow file(s) in this repository, and the scanner and linter configuration checked in beside them. A scan that runs outside CI, one configured in your forge\u0027s web UI rather than in a committed file, or a tool whose name is none of those this check carries, is not seen \u2014 if that is your case the row is wrong, and saying so is more useful than adding a second scanner."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":".github/workflows/ci.yml"},"region":{"startLine":6}}}],"partialFingerprints":{"codehealthFindingId/v1":"6e54424179c892f03ef2fd003130ac4bd43f39bbf3b1ca0a0143e25acb80ec87"}},{"ruleId":"P3","level":"note","message":{"text":"No dependency-update automation: \u0060package.json\u0060 declares packages, and nothing in the repository keeps them current: no Dependabot or Renovate configuration that schedules updates, and no dependency-review gate on pull requests. A pinned dependency stays at the version it was added at until someone notices \u2014 including after an advisory is published against it. Add a \u0060.github/dependabot.yml\u0060 with one \u0060package-ecosystem\u0060 entry per ecosystem the tree uses (or an enabled \u0060renovate.json\u0060), and gate pull requests with \u0060actions/dependency-review-action\u0060."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"package.json"},"region":{"startLine":87}}}],"partialFingerprints":{"codehealthFindingId/v1":"9b237f7efe841e3a95b381b232502a3a473094adeb069a11eaca8ca533fb1c34"}},{"ruleId":"P6","level":"note","message":{"text":"No changelog: No CHANGELOG/HISTORY/RELEASES file \u2014 what shipped when isn\u0027t easy to reconstruct for support or audit. (Versioning/tagging makes releases traceable, but a changelog records the what.)"},"locations":[],"partialFingerprints":{"codehealthFindingId/v1":"dda5aa5aed8cbb292c3ef2b733bc138f614293ae6426c85e98bf31ef330d9415"}},{"ruleId":"PF3","level":"warning","message":{"text":"Sync-over-async blocking: \u0060fs.readdirSync\u0060 in \u0060loadCli\u0060 blocks the event loop until it finishes \u2014 a blocking call inside async code stalls the event loop \u2014 every other request waits for as long as it runs."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"lib/cli.js"},"region":{"startLine":263}}}],"partialFingerprints":{"codehealthFindingId/v1":"47865cc444388a8b1d97e71909047cd93462f700e24fb2aa6b6857e9802f4fdb"}},{"ruleId":"PF3","level":"warning","message":{"text":"Sync-over-async blocking: \u0060fs.rmSync\u0060 in \u0060loadCli\u0060 blocks the event loop until it finishes \u2014 a blocking call inside async code stalls the event loop \u2014 every other request waits for as long as it runs."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"lib/cli.js"},"region":{"startLine":273}}}],"partialFingerprints":{"codehealthFindingId/v1":"42db0fd96227e28831bd3e8457885300eb85d82ead73158da436e556e92342e0"}},{"ruleId":"PF3","level":"warning","message":{"text":"Sync-over-async blocking: \u0060fs.statSync\u0060 in \u0060fileStats\u0060 blocks the event loop until it finishes \u2014 a blocking call inside async code stalls the event loop \u2014 every other request waits for as long as it runs."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"lib/watcher.js"},"region":{"startLine":192}}}],"partialFingerprints":{"codehealthFindingId/v1":"a0e39d450ea8319bbb85932a4cefa3b99161161d5b7c8c31485880fca5aeb762"}},{"ruleId":"PF3","level":"warning","message":{"text":"Sync-over-async blocking: \u0060gunzipSync\u0060 in \u0060readSnapshots\u0060 blocks the event loop until it finishes \u2014 a blocking call inside async code stalls the event loop \u2014 every other request waits for as long as it runs."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"test/snapshot-workflow/helpers/macros.js"},"region":{"startLine":76}}}],"partialFingerprints":{"codehealthFindingId/v1":"f5b2dc8ca49169372edb125ccb2a1f71b6248382edf053eabf2aacf03e201b57"}},{"ruleId":"R1","level":"warning","message":{"text":"Type Safety: 13 typed \u00B7 163 plain JS \u2014 the untyped files are entrypoints/cli.js, entrypoints/eslint-plugin-helper.js, entrypoints/main.js, entrypoints/plugin.js, lib/api-event-iterator.js, lib/api.js (\u002B157 more)."},"locations":[],"partialFingerprints":{"codehealthFindingId/v1":"d00ee7953f55325a823d27e5db9657c80ca9b9861c0c0abf8fe487cd3fa586d3"}},{"ruleId":"R10","level":"warning","message":{"text":"Duplicated block (17 lines \u00D7 2 locations): lib/assert.js:776 \u00B7 lib/assert.js:806 \u2014 all 2 copies are in the same file, and the CITED SPAN is not a self-contained block \u2014 it runs from inside one construct into the next (the tail of a branch plus the head of the following one, a run of switch arms, the end of a declaration plus the list that follows it) rather than covering a whole unit. So do not lift these lines literally: no call can be substituted for a half-open construct. Extract the enclosing repeated UNIT instead \u2014 the whole function, component or branch these lines sit in \u2014 and where the repetition IS the construct (a run of switch arms, a stack of near-identical declarations) replace it with one table or registry looked up by key rather than a helper each arm calls. The copies still drift apart the first time only one of them is edited, which is why this is reported."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"lib/assert.js"},"region":{"startLine":776}}}],"partialFingerprints":{"codehealthFindingId/v1":"d8ffeeec896d32bcd5742f441702b89a7a0302a3d6f83bf5db29140bf708fd08"}},{"ruleId":"R10","level":"warning","message":{"text":"Duplicated block (15 lines \u00D7 2 locations): lib/runner.js:401 \u00B7 lib/runner.js:422 \u2014 all 2 copies are in the same file, and the CITED SPAN is not a self-contained block \u2014 it runs from inside one construct into the next (the tail of a branch plus the head of the following one, a run of switch arms, the end of a declaration plus the list that follows it) rather than covering a whole unit. So do not lift these lines literally: no call can be substituted for a half-open construct. Extract the enclosing repeated UNIT instead \u2014 the whole function, component or branch these lines sit in \u2014 and where the repetition IS the construct (a run of switch arms, a stack of near-identical declarations) replace it with one table or registry looked up by key rather than a helper each arm calls. The copies still drift apart the first time only one of them is edited, which is why this is reported."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"lib/runner.js"},"region":{"startLine":401}}}],"partialFingerprints":{"codehealthFindingId/v1":"d6989a01e88f2511df1e379e918b2a29fbd73697b52bc3f5fbbfda10854df00c"}},{"ruleId":"R10","level":"warning","message":{"text":"Duplicated block (14 lines \u00D7 2 locations): lib/watcher.js:108 \u00B7 lib/watcher.js:136 \u2014 all 2 copies are in the same file, and the CITED SPAN is not a self-contained block \u2014 it runs from inside one construct into the next (the tail of a branch plus the head of the following one, a run of switch arms, the end of a declaration plus the list that follows it) rather than covering a whole unit. So do not lift these lines literally: no call can be substituted for a half-open construct. Extract the enclosing repeated UNIT instead \u2014 the whole function, component or branch these lines sit in \u2014 and where the repetition IS the construct (a run of switch arms, a stack of near-identical declarations) replace it with one table or registry looked up by key rather than a helper each arm calls. The copies still drift apart the first time only one of them is edited, which is why this is reported."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"lib/watcher.js"},"region":{"startLine":108}}}],"partialFingerprints":{"codehealthFindingId/v1":"87cfedb6982420c891ad415cf7459714998462c46bcaeda00924447e81f63082"}},{"ruleId":"R10","level":"warning","message":{"text":"Duplicated block (12 lines \u00D7 2 locations): lib/assert.js:155 \u00B7 lib/assert.js:179 \u2014 both copies are in the same file, so extract the block into one function there and call it from each site \u2014 the copies drift apart the first time only one of them is edited."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"lib/assert.js"},"region":{"startLine":155}}}],"partialFingerprints":{"codehealthFindingId/v1":"6c92284077eda50d0399fbaa8bcac27a37a3024001bfdb9f04e51616225ff456"}},{"ruleId":"R10","level":"warning","message":{"text":"Duplicated block (12 lines \u00D7 2 locations): lib/assert.js:313 \u00B7 lib/assert.js:365 \u2014 both copies are in the same file, so extract the block into one function there and call it from each site \u2014 the copies drift apart the first time only one of them is edited."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"lib/assert.js"},"region":{"startLine":313}}}],"partialFingerprints":{"codehealthFindingId/v1":"46357dc346b276809cacc8c134157165421ac3025026079c24d3fd81f09f878e"}},{"ruleId":"R10","level":"warning","message":{"text":"Duplicated block (11 lines \u00D7 3 locations): lib/assert.js:168 \u00B7 lib/assert.js:180 \u00B7 lib/assert.js:204 \u2014 all 3 copies are in the same file, so extract the block into one function there and call it from every one of those sites \u2014 resolving only two of them leaves the rest to drift apart the first time one is edited."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"lib/assert.js"},"region":{"startLine":168}}}],"partialFingerprints":{"codehealthFindingId/v1":"d05905d20e3a362a2bd9ea5b0e2b4420a7983b154b902cb7d9509d2bda9298fc"}},{"ruleId":"R10","level":"warning","message":{"text":"Duplicated block with local edits (11 matched lines \u00D7 2 locations): lib/reporters/default.js:150 \u00B7 lib/reporters/tap.js:75 \u2014 the two spans are one implementation copied and then locally edited \u2014 80 tokens are still identical, in the same order in both files, with only local edits between them. The copies have already begun to drift, which is this row\u0027s finding: an edit made to one and not the other changes behaviour silently. Diff the two spans first to learn what genuinely differs, then extract the shared core into one module both sites use, passing the differences in as parameters \u2014 or, if one copy exists only because the other could not be imported from its context, make one of them the single source the other is generated or re-exported from. If one copy is no longer reachable, delete it rather than letting it shadow the live one."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"lib/reporters/default.js"},"region":{"startLine":150}}}],"partialFingerprints":{"codehealthFindingId/v1":"31e36c7eed38257a5e6f46d6a298945df15f6bb9ddec7fc4636b0710f165be34"}},{"ruleId":"R10","level":"warning","message":{"text":"Duplicated block with local edits (10 matched lines \u00D7 2 locations): lib/cli.js:336 \u00B7 lib/eslint-plugin-helper-worker.js:14 \u2014 the two spans are one implementation copied and then locally edited \u2014 70 tokens are still identical, in the same order in both files, with only local edits between them. The copies have already begun to drift, which is this row\u0027s finding: an edit made to one and not the other changes behaviour silently. Diff the two spans first to learn what genuinely differs, then extract the shared core into one module both sites use, passing the differences in as parameters \u2014 or, if one copy exists only because the other could not be imported from its context, make one of them the single source the other is generated or re-exported from. If one copy is no longer reachable, delete it rather than letting it shadow the live one."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"lib/cli.js"},"region":{"startLine":336}}}],"partialFingerprints":{"codehealthFindingId/v1":"ef40583017a829cd9ea0926440b2759cc576183413e7d724bcb5327df2d88b14"}},{"ruleId":"R10","level":"warning","message":{"text":"Duplicated block (10 lines \u00D7 2 locations): lib/test.js:557 \u00B7 lib/test.js:617 \u2014 all 2 copies are in the same file, and the CITED SPAN is not a self-contained block \u2014 it runs from inside one construct into the next (the tail of a branch plus the head of the following one, a run of switch arms, the end of a declaration plus the list that follows it) rather than covering a whole unit. So do not lift these lines literally: no call can be substituted for a half-open construct. Extract the enclosing repeated UNIT instead \u2014 the whole function, component or branch these lines sit in \u2014 and where the repetition IS the construct (a run of switch arms, a stack of near-identical declarations) replace it with one table or registry looked up by key rather than a helper each arm calls. The copies still drift apart the first time only one of them is edited, which is why this is reported."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"lib/test.js"},"region":{"startLine":557}}}],"partialFingerprints":{"codehealthFindingId/v1":"95cbe02cbe13186978049091f5736b26715d43ccd9102a3bce13aace795d6310"}},{"ruleId":"R10","level":"warning","message":{"text":"Duplicated block (8 lines \u00D7 2 locations): lib/reporters/default.js:291 \u00B7 lib/reporters/default.js:302 \u2014 all 2 copies are in the same file, and the CITED SPAN is not a self-contained block \u2014 it runs from inside one construct into the next (the tail of a branch plus the head of the following one, a run of switch arms, the end of a declaration plus the list that follows it) rather than covering a whole unit. So do not lift these lines literally: no call can be substituted for a half-open construct. Extract the enclosing repeated UNIT instead \u2014 the whole function, component or branch these lines sit in \u2014 and where the repetition IS the construct (a run of switch arms, a stack of near-identical declarations) replace it with one table or registry looked up by key rather than a helper each arm calls. The copies still drift apart the first time only one of them is edited, which is why this is reported."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"lib/reporters/default.js"},"region":{"startLine":291}}}],"partialFingerprints":{"codehealthFindingId/v1":"5841f44953b89e4a119ab9ac24d08994f31b05cafe573e3a6a88018740581327"}},{"ruleId":"R10","level":"warning","message":{"text":"Duplicated block (6 lines \u00D7 2 locations): lib/reporters/default.js:724 \u00B7 lib/reporters/default.js:737 \u2014 all 2 copies are in the same file, and the CITED SPAN is not a self-contained block \u2014 it runs from inside one construct into the next (the tail of a branch plus the head of the following one, a run of switch arms, the end of a declaration plus the list that follows it) rather than covering a whole unit. So do not lift these lines literally: no call can be substituted for a half-open construct. Extract the enclosing repeated UNIT instead \u2014 the whole function, component or branch these lines sit in \u2014 and where the repetition IS the construct (a run of switch arms, a stack of near-identical declarations) replace it with one table or registry looked up by key rather than a helper each arm calls. The copies still drift apart the first time only one of them is edited, which is why this is reported."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"lib/reporters/default.js"},"region":{"startLine":724}}}],"partialFingerprints":{"codehealthFindingId/v1":"8b6b1cb0c7913d1507c9d8a3e8188e1d9e1f33f9d01c9e3a13ffe46dba85ddb7"}},{"ruleId":"R10","level":"warning","message":{"text":"Duplicated block (6 lines \u00D7 3 locations): lib/reporters/default.js:740 \u00B7 lib/reporters/default.js:748 \u00B7 lib/reporters/default.js:756 \u2014 all 3 copies are in the same file, and the CITED SPAN is not a self-contained block \u2014 it runs from inside one construct into the next (the tail of a branch plus the head of the following one, a run of switch arms, the end of a declaration plus the list that follows it) rather than covering a whole unit. So do not lift these lines literally: no call can be substituted for a half-open construct. Extract the enclosing repeated UNIT instead \u2014 the whole function, component or branch these lines sit in \u2014 and where the repetition IS the construct (a run of switch arms, a stack of near-identical declarations) replace it with one table or registry looked up by key rather than a helper each arm calls. The copies still drift apart the first time only one of them is edited, which is why this is reported."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"lib/reporters/default.js"},"region":{"startLine":740}}}],"partialFingerprints":{"codehealthFindingId/v1":"a4f24d5c543953ffddde0ea4566b70eecac8ebf9e160440a16c6a96b22fa1da1"}},{"ruleId":"R10","level":"warning","message":{"text":"Duplicated block (5 lines \u00D7 2 locations): lib/reporters/default.js:424 \u00B7 lib/reporters/default.js:433 \u2014 all 2 copies are in the same file, and the CITED SPAN is not a self-contained block \u2014 it runs from inside one construct into the next (the tail of a branch plus the head of the following one, a run of switch arms, the end of a declaration plus the list that follows it) rather than covering a whole unit. So do not lift these lines literally: no call can be substituted for a half-open construct. Extract the enclosing repeated UNIT instead \u2014 the whole function, component or branch these lines sit in \u2014 and where the repetition IS the construct (a run of switch arms, a stack of near-identical declarations) replace it with one table or registry looked up by key rather than a helper each arm calls. The copies still drift apart the first time only one of them is edited, which is why this is reported."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"lib/reporters/default.js"},"region":{"startLine":424}}}],"partialFingerprints":{"codehealthFindingId/v1":"ac46d29c5b780a97543a23eaaca04f45075d4db3e28e19647f2b23206ca9e207"}},{"ruleId":"R2","level":"warning","message":{"text":"Complex function loadCli (cyclomatic 73, cognitive 98): loadCli has cyclomatic complexity 73 and cognitive complexity 98; this row is raised above a cyclomatic bar of 10. The two numbers answer different questions and the gap between them is what decides whether to act: cyclomatic counts the independent arms through the body, cognitive counts what it costs to hold them in your head, so nesting and mixed boolean chains raise it while a flat run of independent arms does not. Cognitive is at or above cyclomatic here, so the branching is nested or entangled rather than laid out side by side \u2014 extracting each decision into its own named function is the change that pays. Measured by this repository\u0027s own parse of the file, so a body assembled at runtime, or generated, is counted as written rather than as it executes."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"lib/cli.js"},"region":{"startLine":95}}}],"partialFingerprints":{"codehealthFindingId/v1":"d5adc803065fbb10aecdee465b1f79275292d2287a8c50cf86610ecbb7448642"}},{"ruleId":"R2","level":"warning","message":{"text":"Complex function consumeStateChange (cyclomatic 40, cognitive 36): consumeStateChange has cyclomatic complexity 40 and cognitive complexity 36; this row is raised above a cyclomatic bar of 10. The two numbers answer different questions and the gap between them is what decides whether to act: cyclomatic counts the independent arms through the body, cognitive counts what it costs to hold them in your head, so nesting and mixed boolean chains raise it while a flat run of independent arms does not. Cognitive sits below cyclomatic here, so much of the count is breadth \u2014 arms side by side rather than stacked \u2014 and splitting per arm would leave a function per arm; group the work between the checks into named steps instead. Measured by this repository\u0027s own parse of the file, so a body assembled at runtime, or generated, is counted as written rather than as it executes."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"lib/reporters/default.js"},"region":{"startLine":182}}}],"partialFingerprints":{"codehealthFindingId/v1":"f85da75ecfbf17162b5f44560bc3e9ac3889f7f473d2adad53102653222f8d0b"}},{"ruleId":"R2","level":"warning","message":{"text":"Complex function endRun (cyclomatic 34, cognitive 47): endRun has cyclomatic complexity 34 and cognitive complexity 47; this row is raised above a cyclomatic bar of 10. The two numbers answer different questions and the gap between them is what decides whether to act: cyclomatic counts the independent arms through the body, cognitive counts what it costs to hold them in your head, so nesting and mixed boolean chains raise it while a flat run of independent arms does not. Cognitive is at or above cyclomatic here, so the branching is nested or entangled rather than laid out side by side \u2014 extracting each decision into its own named function is the change that pays. Measured by this repository\u0027s own parse of the file, so a body assembled at runtime, or generated, is counted as written rather than as it executes."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"lib/reporters/default.js"},"region":{"startLine":629}}}],"partialFingerprints":{"codehealthFindingId/v1":"368ba14e7f301efbf640470f3e74d1e56e4bd2a10c6ab8f5ccaf88f15689248c"}},{"ruleId":"R2","level":"warning","message":{"text":"Complex function validateExpectations (cyclomatic 29, cognitive 32): validateExpectations has cyclomatic complexity 29 and cognitive complexity 32; this row is raised above a cyclomatic bar of 10. The two numbers answer different questions and the gap between them is what decides whether to act: cyclomatic counts the independent arms through the body, cognitive counts what it costs to hold them in your head, so nesting and mixed boolean chains raise it while a flat run of independent arms does not. Cognitive is at or above cyclomatic here, so the branching is nested or entangled rather than laid out side by side \u2014 extracting each decision into its own named function is the change that pays. Measured by this repository\u0027s own parse of the file, so a body assembled at runtime, or generated, is counted as written rather than as it executes."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"lib/assert.js"},"region":{"startLine":57}}}],"partialFingerprints":{"codehealthFindingId/v1":"c2e41bffd5a88110f5a52a30e45447a644aaba94ede7502e9b4e9d354fd7934c"}},{"ruleId":"R2","level":"warning","message":{"text":"Complex function consumeStateChange (cyclomatic 29, cognitive 20): consumeStateChange has cyclomatic complexity 29 and cognitive complexity 20; this row is raised above a cyclomatic bar of 10. The two numbers answer different questions and the gap between them is what decides whether to act: cyclomatic counts the independent arms through the body, cognitive counts what it costs to hold them in your head, so nesting and mixed boolean chains raise it while a flat run of independent arms does not. Cognitive sits below cyclomatic here, so much of the count is breadth \u2014 arms side by side rather than stacked \u2014 and splitting per arm would leave a function per arm; group the work between the checks into named steps instead. Measured by this repository\u0027s own parse of the file, so a body assembled at runtime, or generated, is counted as written rather than as it executes."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"lib/reporters/tap.js"},"region":{"startLine":170}}}],"partialFingerprints":{"codehealthFindingId/v1":"2078c61904eec908fe2793081e5136532208b526a67db81d26b5d5105755be7c"}},{"ruleId":"R2","level":"warning","message":{"text":"Complex function run (cyclomatic 27, cognitive 30): run has cyclomatic complexity 27 and cognitive complexity 30; this row is raised above a cyclomatic bar of 10. The two numbers answer different questions and the gap between them is what decides whether to act: cyclomatic counts the independent arms through the body, cognitive counts what it costs to hold them in your head, so nesting and mixed boolean chains raise it while a flat run of independent arms does not. Cognitive is at or above cyclomatic here, so the branching is nested or entangled rather than laid out side by side \u2014 extracting each decision into its own named function is the change that pays. Measured by this repository\u0027s own parse of the file, so a body assembled at runtime, or generated, is counted as written rather than as it executes."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"lib/api.js"},"region":{"startLine":106}}}],"partialFingerprints":{"codehealthFindingId/v1":"d177030444bcfa81964803e6a2324629bab000b0ee212acdd794c6acea8f29f0"}},{"ruleId":"R2","level":"warning","message":{"text":"Complex function loadConfig (cyclomatic 25, cognitive 40): loadConfig has cyclomatic complexity 25 and cognitive complexity 40; this row is raised above a cyclomatic bar of 10. The two numbers answer different questions and the gap between them is what decides whether to act: cyclomatic counts the independent arms through the body, cognitive counts what it costs to hold them in your head, so nesting and mixed boolean chains raise it while a flat run of independent arms does not. Cognitive is at or above cyclomatic here, so the branching is nested or entangled rather than laid out side by side \u2014 extracting each decision into its own named function is the change that pays. Measured by this repository\u0027s own parse of the file, so a body assembled at runtime, or generated, is counted as written rather than as it executes."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"lib/load-config.js"},"region":{"startLine":77}}}],"partialFingerprints":{"codehealthFindingId/v1":"79e0edf12311eab1a8340a40af0c4a737349fef15b3e9ad0eda13fc5a450e798"}},{"ruleId":"R2","level":"warning","message":{"text":"Complex function writeSerializedError (cyclomatic 24, cognitive 43): writeSerializedError has cyclomatic complexity 24 and cognitive complexity 43; this row is raised above a cyclomatic bar of 10. The two numbers answer different questions and the gap between them is what decides whether to act: cyclomatic counts the independent arms through the body, cognitive counts what it costs to hold them in your head, so nesting and mixed boolean chains raise it while a flat run of independent arms does not. Cognitive is at or above cyclomatic here, so the branching is nested or entangled rather than laid out side by side \u2014 extracting each decision into its own named function is the change that pays. Measured by this repository\u0027s own parse of the file, so a body assembled at runtime, or generated, is counted as written rather than as it executes."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"lib/reporters/default.js"},"region":{"startLine":453}}}],"partialFingerprints":{"codehealthFindingId/v1":"700e29ef42415f100e1186cdc153ae3845c7f70e61ab178e4b7a5a42e9f7d69e"}},{"ruleId":"R2","level":"warning","message":{"text":"Complex function (anonymous) (cyclomatic 23, cognitive 38): (anonymous) has cyclomatic complexity 23 and cognitive complexity 38; this row is raised above a cyclomatic bar of 10. The two numbers answer different questions and the gap between them is what decides whether to act: cyclomatic counts the independent arms through the body, cognitive counts what it costs to hold them in your head, so nesting and mixed boolean chains raise it while a flat run of independent arms does not. Cognitive is at or above cyclomatic here, so the branching is nested or entangled rather than laid out side by side \u2014 extracting each decision into its own named function is the change that pays. Measured by this repository\u0027s own parse of the file, so a body assembled at runtime, or generated, is counted as written rather than as it executes."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"lib/runner.js"},"region":{"startLine":81}}}],"partialFingerprints":{"codehealthFindingId/v1":"d7239030141e368a47ebe96b9e92f564a6707fd741ec7add77e93115296cce79"}},{"ruleId":"R2","level":"warning","message":{"text":"Complex function emitStateChange (cyclomatic 23, cognitive 15): emitStateChange has cyclomatic complexity 23 and cognitive complexity 15; this row is raised above a cyclomatic bar of 10. The two numbers answer different questions and the gap between them is what decides whether to act: cyclomatic counts the independent arms through the body, cognitive counts what it costs to hold them in your head, so nesting and mixed boolean chains raise it while a flat run of independent arms does not. Cognitive sits below cyclomatic here, so much of the count is breadth \u2014 arms side by side rather than stacked \u2014 and splitting per arm would leave a function per arm; group the work between the checks into named steps instead. Measured by this repository\u0027s own parse of the file, so a body assembled at runtime, or generated, is counted as written rather than as it executes."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"lib/run-status.js"},"region":{"startLine":75}}}],"partialFingerprints":{"codehealthFindingId/v1":"ed2bd3acc570ebaf6da0d2c95076ce4e67af5266a68886da8ff22c3737ed07a8"}},{"ruleId":"R2","level":"warning","message":{"text":"Complex function applyTestFileFilter (cyclomatic 22, cognitive 49): applyTestFileFilter has cyclomatic complexity 22 and cognitive complexity 49; this row is raised above a cyclomatic bar of 10. The two numbers answer different questions and the gap between them is what decides whether to act: cyclomatic counts the independent arms through the body, cognitive counts what it costs to hold them in your head, so nesting and mixed boolean chains raise it while a flat run of independent arms does not. Cognitive is at or above cyclomatic here, so the branching is nested or entangled rather than laid out side by side \u2014 extracting each decision into its own named function is the change that pays. Measured by this repository\u0027s own parse of the file, so a body assembled at runtime, or generated, is counted as written rather than as it executes."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"lib/globs.js"},"region":{"startLine":139}}}],"partialFingerprints":{"codehealthFindingId/v1":"c7f7b1e6eee82c675d54efbf45301d87d9692cae03d14631f1011fe139c9f195"}},{"ruleId":"R2","level":"warning","message":{"text":"Complex function (anonymous) (cyclomatic 22, cognitive 39): (anonymous) has cyclomatic complexity 22 and cognitive complexity 39; this row is raised above a cyclomatic bar of 10. The two numbers answer different questions and the gap between them is what decides whether to act: cyclomatic counts the independent arms through the body, cognitive counts what it costs to hold them in your head, so nesting and mixed boolean chains raise it while a flat run of independent arms does not. Cognitive is at or above cyclomatic here, so the branching is nested or entangled rather than laid out side by side \u2014 extracting each decision into its own named function is the change that pays. Measured by this repository\u0027s own parse of the file, so a body assembled at runtime, or generated, is counted as written rather than as it executes."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"lib/assert.js"},"region":{"startLine":614}}}],"partialFingerprints":{"codehealthFindingId/v1":"8f7a3d3f5fe8e7b6fc7be300fdc66cce79140ed7fc88a8f762055f82c1f3830a"}},{"ruleId":"R2","level":"warning","message":{"text":"Complex function start (cyclomatic 20, cognitive 26): start has cyclomatic complexity 20 and cognitive complexity 26; this row is raised above a cyclomatic bar of 10. The two numbers answer different questions and the gap between them is what decides whether to act: cyclomatic counts the independent arms through the body, cognitive counts what it costs to hold them in your head, so nesting and mixed boolean chains raise it while a flat run of independent arms does not. Cognitive is at or above cyclomatic here, so the branching is nested or entangled rather than laid out side by side \u2014 extracting each decision into its own named function is the change that pays. Measured by this repository\u0027s own parse of the file, so a body assembled at runtime, or generated, is counted as written rather than as it executes."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"lib/runner.js"},"region":{"startLine":398}}}],"partialFingerprints":{"codehealthFindingId/v1":"365264a9f08d6783eecf1005e9d01a58c0dadcd1b16bbc45839329f56d6a67e2"}},{"ruleId":"R2","level":"warning","message":{"text":"Complex function exec (cyclomatic 19, cognitive 17): exec has cyclomatic complexity 19 and cognitive complexity 17; this row is raised above a cyclomatic bar of 10. The two numbers answer different questions and the gap between them is what decides whether to act: cyclomatic counts the independent arms through the body, cognitive counts what it costs to hold them in your head, so nesting and mixed boolean chains raise it while a flat run of independent arms does not. Cognitive sits below cyclomatic here, so much of the count is breadth \u2014 arms side by side rather than stacked \u2014 and splitting per arm would leave a function per arm; group the work between the checks into named steps instead. Measured by this repository\u0027s own parse of the file, so a body assembled at runtime, or generated, is counted as written rather than as it executes."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"test/helpers/exec.js"},"region":{"startLine":76}}}],"partialFingerprints":{"codehealthFindingId/v1":"db471e7dd190ba314406beb743f2467d6b6abc635d8c3266c61530eb16128954"}},{"ruleId":"R2","level":"warning","message":{"text":"Complex function assertExpectations (cyclomatic 18, cognitive 17): assertExpectations has cyclomatic complexity 18 and cognitive complexity 17; this row is raised above a cyclomatic bar of 10. The two numbers answer different questions and the gap between them is what decides whether to act: cyclomatic counts the independent arms through the body, cognitive counts what it costs to hold them in your head, so nesting and mixed boolean chains raise it while a flat run of independent arms does not. Cognitive sits below cyclomatic here, so much of the count is breadth \u2014 arms side by side rather than stacked \u2014 and splitting per arm would leave a function per arm; group the work between the checks into named steps instead. Measured by this repository\u0027s own parse of the file, so a body assembled at runtime, or generated, is counted as written rather than as it executes."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"lib/assert.js"},"region":{"startLine":144}}}],"partialFingerprints":{"codehealthFindingId/v1":"9e780d087b7b0c8c3ff0504f21370683db85f15223d75d42181e23f2c5b29af5"}},{"ruleId":"R2","level":"warning","message":{"text":"Complex function get (cyclomatic 16, cognitive 19): get has cyclomatic complexity 16 and cognitive complexity 19; this row is raised above a cyclomatic bar of 10. The two numbers answer different questions and the gap between them is what decides whether to act: cyclomatic counts the independent arms through the body, cognitive counts what it costs to hold them in your head, so nesting and mixed boolean chains raise it while a flat run of independent arms does not. Cognitive is at or above cyclomatic here, so the branching is nested or entangled rather than laid out side by side \u2014 extracting each decision into its own named function is the change that pays. Measured by this repository\u0027s own parse of the file, so a body assembled at runtime, or generated, is counted as written rather than as it executes."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"lib/create-chain.js"},"region":{"startLine":60}}}],"partialFingerprints":{"codehealthFindingId/v1":"c737e336e2d2b576d7d1dffae49ee99a4840c92118c5906e5da7fe8849865366"}},{"ruleId":"R2","level":"warning","message":{"text":"Complex function suggestExitCode (cyclomatic 16, cognitive 15): suggestExitCode has cyclomatic complexity 16 and cognitive complexity 15; this row is raised above a cyclomatic bar of 10. The two numbers answer different questions and the gap between them is what decides whether to act: cyclomatic counts the independent arms through the body, cognitive counts what it costs to hold them in your head, so nesting and mixed boolean chains raise it while a flat run of independent arms does not. Cognitive sits below cyclomatic here, so much of the count is breadth \u2014 arms side by side rather than stacked \u2014 and splitting per arm would leave a function per arm; group the work between the checks into named steps instead. Measured by this repository\u0027s own parse of the file, so a body assembled at runtime, or generated, is counted as written rather than as it executes."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"lib/run-status.js"},"region":{"startLine":229}}}],"partialFingerprints":{"codehealthFindingId/v1":"85d7d3015fe669f7d2089288fefb5579464cdbf0f80610223715d09913e963d4"}},{"ruleId":"R2","level":"warning","message":{"text":"Complex function (anonymous) (cyclomatic 14, cognitive 25): (anonymous) has cyclomatic complexity 14 and cognitive complexity 25; this row is raised above a cyclomatic bar of 10. The two numbers answer different questions and the gap between them is what decides whether to act: cyclomatic counts the independent arms through the body, cognitive counts what it costs to hold them in your head, so nesting and mixed boolean chains raise it while a flat run of independent arms does not. Cognitive is at or above cyclomatic here, so the branching is nested or entangled rather than laid out side by side \u2014 extracting each decision into its own named function is the change that pays. Measured by this repository\u0027s own parse of the file, so a body assembled at runtime, or generated, is counted as written rather than as it executes."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"lib/watcher.js"},"region":{"startLine":408}}}],"partialFingerprints":{"codehealthFindingId/v1":"a720abbe193b5be5a69cafcfeb1669bff5bfb1c7f9e25b505557b595384b98f3"}},{"ruleId":"R2","level":"warning","message":{"text":"Complex function receiveMessages (cyclomatic 14, cognitive 21): receiveMessages has cyclomatic complexity 14 and cognitive complexity 21; this row is raised above a cyclomatic bar of 10. The two numbers answer different questions and the gap between them is what decides whether to act: cyclomatic counts the independent arms through the body, cognitive counts what it costs to hold them in your head, so nesting and mixed boolean chains raise it while a flat run of independent arms does not. Cognitive is at or above cyclomatic here, so the branching is nested or entangled rather than laid out side by side \u2014 extracting each decision into its own named function is the change that pays. Measured by this repository\u0027s own parse of the file, so a body assembled at runtime, or generated, is counted as written rather than as it executes."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"lib/plugin-support/shared-worker-loader.js"},"region":{"startLine":75}}}],"partialFingerprints":{"codehealthFindingId/v1":"0986de4c8fcd45bbfade238db1b9c9f784638b22d791a326e39c0efa04e8d1bc"}},{"ruleId":"R2","level":"warning","message":{"text":"Complex function run (cyclomatic 14, cognitive 18): run has cyclomatic complexity 14 and cognitive complexity 18; this row is raised above a cyclomatic bar of 10. The two numbers answer different questions and the gap between them is what decides whether to act: cyclomatic counts the independent arms through the body, cognitive counts what it costs to hold them in your head, so nesting and mixed boolean chains raise it while a flat run of independent arms does not. Cognitive is at or above cyclomatic here, so the branching is nested or entangled rather than laid out side by side \u2014 extracting each decision into its own named function is the change that pays. Measured by this repository\u0027s own parse of the file, so a body assembled at runtime, or generated, is counted as written rather than as it executes."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"lib/worker/base.js"},"region":{"startLine":52}}}],"partialFingerprints":{"codehealthFindingId/v1":"15a73cd534119ea67e851ef49de66bab2cd2948848dadb7363ebe0bfac584cd3"}},{"ruleId":"R3","level":"warning","message":{"text":"test-tap/assert.js: 1616 lines of code: test-tap/assert.js has 1616 significant lines (blank lines excluded), over the 400-line bar, and contains logic \u2014 a file this long is usually several responsibilities in one module."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"test-tap/assert.js"},"region":{"startLine":1}}}],"partialFingerprints":{"codehealthFindingId/v1":"1fc0e4f26544e03ca806aa06d15661fa525a434d421ebe37c213958d7eb958c3"}},{"ruleId":"R3","level":"warning","message":{"text":"lib/assert.js: 726 lines of code: lib/assert.js has 726 significant lines (blank lines excluded), over the 400-line bar, and contains logic \u2014 a file this long is usually several responsibilities in one module."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"lib/assert.js"},"region":{"startLine":1}}}],"partialFingerprints":{"codehealthFindingId/v1":"f423d86c71e0afa9227ba6bf78129a477eecbf5fc9433f69e65e9f33516d27ac"}},{"ruleId":"R3","level":"warning","message":{"text":"lib/watcher.js: 707 lines of code: lib/watcher.js has 707 significant lines (blank lines excluded), over the 400-line bar, and contains logic \u2014 a file this long is usually several responsibilities in one module."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"lib/watcher.js"},"region":{"startLine":1}}}],"partialFingerprints":{"codehealthFindingId/v1":"74493a256fbe57c0120cfa1a4256fee7a599b2a10397313d5bedd02661b71d0c"}},{"ruleId":"R3","level":"warning","message":{"text":"test-tap/test.js: 705 lines of code: test-tap/test.js has 705 significant lines (blank lines excluded), over the 400-line bar, and contains logic \u2014 a file this long is usually several responsibilities in one module."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"test-tap/test.js"},"region":{"startLine":1}}}],"partialFingerprints":{"codehealthFindingId/v1":"8c9716a9eb7eca637b1362b09767b55da1b4ef38f8796109f14b4ef8aa452a34"}},{"ruleId":"R3","level":"warning","message":{"text":"test-tap/runner.js: 692 lines of code: test-tap/runner.js has 692 significant lines (blank lines excluded), over the 400-line bar, and contains logic \u2014 a file this long is usually several responsibilities in one module."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"test-tap/runner.js"},"region":{"startLine":1}}}],"partialFingerprints":{"codehealthFindingId/v1":"afd1c4f1354fdc2e2e8b98fb638168143b0b23f95ef6bb10c4624705fb16d5bd"}},{"ruleId":"R3","level":"warning","message":{"text":"lib/reporters/default.js: 633 lines of code: lib/reporters/default.js has 633 significant lines (blank lines excluded), over the 400-line bar, and contains logic \u2014 a file this long is usually several responsibilities in one module."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"lib/reporters/default.js"},"region":{"startLine":1}}}],"partialFingerprints":{"codehealthFindingId/v1":"f1934763b1585e387cd71c372f938fbf4aa9b8fd33e9f7150aca18b631f5609e"}},{"ruleId":"R3","level":"warning","message":{"text":"lib/test.js: 569 lines of code: lib/test.js has 569 significant lines (blank lines excluded), over the 400-line bar, and contains logic \u2014 a file this long is usually several responsibilities in one module."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"lib/test.js"},"region":{"startLine":1}}}],"partialFingerprints":{"codehealthFindingId/v1":"1519c905d5211c615241bc35e181a9a5978dbaecd6617a3839d00e26b87c8826"}},{"ruleId":"R3","level":"warning","message":{"text":"lib/cli.js: 484 lines of code: lib/cli.js has 484 significant lines (blank lines excluded), over the 400-line bar, and contains logic \u2014 a file this long is usually several responsibilities in one module."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"lib/cli.js"},"region":{"startLine":1}}}],"partialFingerprints":{"codehealthFindingId/v1":"447cce4f9275a11610d74e21b781015d2a236db529ee212f8af40dcf003d7dd5"}},{"ruleId":"R3","level":"warning","message":{"text":"lib/snapshot-manager.js: 477 lines of code: lib/snapshot-manager.js has 477 significant lines (blank lines excluded), over the 400-line bar, and contains logic \u2014 a file this long is usually several responsibilities in one module."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"lib/snapshot-manager.js"},"region":{"startLine":1}}}],"partialFingerprints":{"codehealthFindingId/v1":"79e168981402cff3b1ba2ab82e4e46f14e93b61b92b94833ba5baeff067fe0e5"}},{"ruleId":"R3","level":"warning","message":{"text":"test-tap/hooks.js: 465 lines of code: test-tap/hooks.js has 465 significant lines (blank lines excluded), over the 400-line bar, and contains logic \u2014 a file this long is usually several responsibilities in one module."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"test-tap/hooks.js"},"region":{"startLine":1}}}],"partialFingerprints":{"codehealthFindingId/v1":"1b40190720046efa65cac01ab19af0215d107f286070fc59b0294165baaa7e38"}},{"ruleId":"R3","level":"warning","message":{"text":"lib/runner.js: 455 lines of code: lib/runner.js has 455 significant lines (blank lines excluded), over the 400-line bar, and contains logic \u2014 a file this long is usually several responsibilities in one module."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"lib/runner.js"},"region":{"startLine":1}}}],"partialFingerprints":{"codehealthFindingId/v1":"a6d20015755e34e2b4deec423b5c533ded6b0297bde0a22895014f3474fbaddb"}},{"ruleId":"R3","level":"warning","message":{"text":"test-tap/api.js: 427 lines of code: test-tap/api.js has 427 significant lines (blank lines excluded), over the 400-line bar, and contains logic \u2014 a file this long is usually several responsibilities in one module."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"test-tap/api.js"},"region":{"startLine":1}}}],"partialFingerprints":{"codehealthFindingId/v1":"1867106da2d980a32c40850c8b49b392b62cb4d4617df271408998c1a5b78c6c"}},{"ruleId":"R3","level":"warning","message":{"text":"test-tap/test-try-commit.js: 426 lines of code: test-tap/test-try-commit.js has 426 significant lines (blank lines excluded), over the 400-line bar, and contains logic \u2014 a file this long is usually several responsibilities in one module."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"test-tap/test-try-commit.js"},"region":{"startLine":1}}}],"partialFingerprints":{"codehealthFindingId/v1":"ce738236b6df74bd646d48c42e758a61b0581a5defe3a71c86dd778ac6586fd6"}},{"ruleId":"R4","level":"warning","message":{"text":"This test file cannot be loaded: test/config/loader.js:10 imports \u0027../../test-tap/fixture/load-config\u0027, which names no file in this repository \u2014 and no rule in its .gitignore chain could cover one, so no build writes it either. The import throws as the runner collects this file, so none of its test cases run and nothing it was written to verify is verified. Restore the missing module or delete the test. It is excluded from the reachability measured above, because a file that cannot load reaches nothing."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"test/config/loader.js"},"region":{"startLine":10}}}],"partialFingerprints":{"codehealthFindingId/v1":"4b8ce7c7ef36e80b7c249ed30d7c13f0671fe62d52c325c7888b6fc2bff8b9b6"}},{"ruleId":"R4","level":"warning","message":{"text":"No test reaches this file: No test imports this module directly or transitively. Import reachability cannot see a test that executes a file by path instead of importing it, nor one that drives it through a running browser by navigating to a URL \u2014 if neither does, no test reaches this one."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"lib/plugin-support/shared-worker-loader.js"},"region":{"startLine":1}}}],"partialFingerprints":{"codehealthFindingId/v1":"f2ba4bc14ce50059bbedbd9fc0c57baffea4fb4ad2d2b3522dd26342f8fea209"}},{"ruleId":"R4","level":"warning","message":{"text":"No test reaches this file: No test imports this module directly or transitively. Import reachability cannot see a test that executes a file by path instead of importing it, nor one that drives it through a running browser by navigating to a URL \u2014 if neither does, no test reaches this one."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"lib/eslint-plugin-helper-worker.js"},"region":{"startLine":1}}}],"partialFingerprints":{"codehealthFindingId/v1":"712b65a0e0c083f6f5b279718ec6875527b027de29cc4a504d170b105c05593b"}},{"ruleId":"R6","level":"warning","message":{"text":"The declared test suite includes a file that cannot be loaded: This repository declares test tooling, and the \u2713 above records that declaration \u2014 but test/config/loader.js cannot be loaded at all: it imports a module that names no file in this repository, so the runner throws while collecting it and none of its cases execute. The wiring is present and the suite it points at does not run as written, which is why the tooling tick must not be read as a statement that the tests pass. Fix the unloadable file(s) \u2014 each one is reported with its failing import under Test Coverage \u2014 then the declared script exercises what it claims to."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"test/config/loader.js"},"region":{"startLine":10}}}],"partialFingerprints":{"codehealthFindingId/v1":"e2e0fb161cecffb9e70d18492ed2b11ca273aad46cc22f53230e8455be801256"}},{"ruleId":"R8","level":"warning","message":{"text":"Unused dependency \u0027resolve-cwd\u0027: Declared in the root package.json but never imported anywhere in that package or its workspace members \u2014 no static import reaches it. Usually that is dead weight and attack surface, but two shapes are indistinguishable from source and are NOT dead: an optional or native peer that another dependency loads dynamically at runtime, and a package a build, docs or test step installs and invokes separately. Confirm which of the three this is before removing it."},"locations":[],"partialFingerprints":{"codehealthFindingId/v1":"79d0c57b5ead1bc651262eff5b9e97b1fa0b5d27198f3de4daf11b83c9f2b902"}},{"ruleId":"X10","level":"note","message":{"text":"Duplicated predicate: \u0060!this.failFastEnabled \u0026\u0026 fileStats.remainingTests \u003E 0\u0060 appears character-identically in 2 files \u2014 lib/reporters/default.js, lib/reporters/tap.js. It is one line, so the duplication detector\u0027s token window never sees it; the copies drift when only one is corrected. Give the condition a name and one home."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"lib/reporters/default.js"},"region":{"startLine":349}}}],"partialFingerprints":{"codehealthFindingId/v1":"e4d295c93fb8d4546dbb4ae111cab13ad992e06de01e529785dd2232630c8425"}},{"ruleId":"X3","level":"warning","message":{"text":"Swallowed exception (empty catch): \u0060.catch(noop)\u0060 handles the rejection by doing nothing \u2014 the failure is discarded with no log and no rethrow, and the chain carries on as if the work succeeded. Log it through whatever this codebase already uses to report problems, hand it to a caller that can (\u0060next(error)\u0060, a returned rejection), or don\u0027t catch it."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"lib/assert.js"},"region":{"startLine":407}}}],"partialFingerprints":{"codehealthFindingId/v1":"091ce4d051f614376236b5949688451d4e36a5de63ca8a1c44387556d7c4d19a"}},{"ruleId":"X3","level":"warning","message":{"text":"Swallowed exception (empty catch): An empty catch block silently discards the error \u2014 failures vanish with no log and no rethrow. Log it, handle it, or don\u0027t catch it."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"lib/assert.js"},"region":{"startLine":448}}}],"partialFingerprints":{"codehealthFindingId/v1":"842a71b2c21432534dc278b2df110924dcaa2b3a9bfde76e6dc98838b116364f"}},{"ruleId":"X3","level":"warning","message":{"text":"Swallowed exception (empty catch): An empty catch block silently discards the error \u2014 failures vanish with no log and no rethrow. Log it, handle it, or don\u0027t catch it."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"lib/assert.js"},"region":{"startLine":465}}}],"partialFingerprints":{"codehealthFindingId/v1":"73f7805dc078a33b372223871271646801cc62b5bae4fc98dca3c0deca83f06b"}},{"ruleId":"X3","level":"warning","message":{"text":"Swallowed exception (empty catch): An empty catch block silently discards the error \u2014 failures vanish with no log and no rethrow. Log it, handle it, or don\u0027t catch it."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"lib/assert.js"},"region":{"startLine":560}}}],"partialFingerprints":{"codehealthFindingId/v1":"5a0b28a8135f15504086ad99aef4e8685283b1fd56923cc3a3349bcefff8449c"}},{"ruleId":"X3","level":"warning","message":{"text":"Swallowed exception (empty catch): An empty catch block silently discards the error \u2014 failures vanish with no log and no rethrow. Log it, handle it, or don\u0027t catch it."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"lib/cli.js"},"region":{"startLine":121}}}],"partialFingerprints":{"codehealthFindingId/v1":"d7f7d33bf2d4bea2cfb5248d02b4c42319cc0d4580e255fa0cdaccada0caadf2"}},{"ruleId":"X3","level":"warning","message":{"text":"Swallowed exception (empty catch): An empty catch block silently discards the error \u2014 failures vanish with no log and no rethrow. Log it, handle it, or don\u0027t catch it."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"lib/load-config.js"},"region":{"startLine":55}}}],"partialFingerprints":{"codehealthFindingId/v1":"7df61ab4546a4d66a2352253ab0de313bcacda7d6dff1a593151957f9246ad15"}},{"ruleId":"X3","level":"warning","message":{"text":"Swallowed exception (empty catch): An empty catch block silently discards the error \u2014 failures vanish with no log and no rethrow. Log it, handle it, or don\u0027t catch it."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"lib/scheduler.js"},"region":{"startLine":26}}}],"partialFingerprints":{"codehealthFindingId/v1":"2f0db848f75ea40a4e6f1df9feab22d345c9aac40935e891181b04d29c4300d1"}},{"ruleId":"X3","level":"warning","message":{"text":"Swallowed exception (empty catch): An empty catch block silently discards the error \u2014 failures vanish with no log and no rethrow. Log it, handle it, or don\u0027t catch it."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"lib/reporters/tap.js"},"region":{"startLine":33}}}],"partialFingerprints":{"codehealthFindingId/v1":"5bdd8af6de3c98e180289db58ca47febfa64e7f9b7acf1d73decd1a06c801334"}},{"ruleId":"X3","level":"warning","message":{"text":"Swallowed exception (empty catch): An empty catch block silently discards the error \u2014 failures vanish with no log and no rethrow. Log it, handle it, or don\u0027t catch it."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"lib/plugin-support/shared-workers.js"},"region":{"startLine":131}}}],"partialFingerprints":{"codehealthFindingId/v1":"761325f34f5242b641f9c7935621a21579061991904a0582effb4ffbc68c2871"}}],"taxonomies":[{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d","organization":"MITRE","informationUri":"https://cwe.mitre.org/","isComprehensive":false,"shortDescription":{"text":"The MITRE Common Weakness Enumeration (CWE)."},"taxa":[{"id":"CWE-1333","guid":"11a336ce-63de-c45c-845e-29ca1e8df13d","name":"CWE-1333","shortDescription":{"text":"CWE-1333"},"helpUri":"https://cwe.mitre.org/data/definitions/1333.html"},{"id":"CWE-1357","guid":"e4d2e772-757e-0a5c-bd7d-77052949d866","name":"Reliance on Insufficiently Trustworthy Component","shortDescription":{"text":"Reliance on Insufficiently Trustworthy Component"},"helpUri":"https://cwe.mitre.org/data/definitions/1357.html"},{"id":"CWE-1395","guid":"800e09e7-c11a-8654-9fa6-86f398995fed","name":"Dependency on Vulnerable Third-Party Component","shortDescription":{"text":"Dependency on Vulnerable Third-Party Component"},"helpUri":"https://cwe.mitre.org/data/definitions/1395.html"},{"id":"CWE-259","guid":"ae9ad959-fbb6-9d5e-892d-3dca66da0b69","name":"Use of Hard-coded Password","shortDescription":{"text":"Use of Hard-coded Password"},"helpUri":"https://cwe.mitre.org/data/definitions/259.html"},{"id":"CWE-353","guid":"09d7e902-d4ee-f05d-ae6c-0a1554d0c18f","name":"Missing Support for Integrity Check","shortDescription":{"text":"Missing Support for Integrity Check"},"helpUri":"https://cwe.mitre.org/data/definitions/353.html"},{"id":"CWE-494","guid":"b8a65e0d-e459-4a55-a931-fc1136482375","name":"Download of Code Without Integrity Check","shortDescription":{"text":"Download of Code Without Integrity Check"},"helpUri":"https://cwe.mitre.org/data/definitions/494.html"},{"id":"CWE-506","guid":"401d6455-56e3-0552-9a39-f77461673e3f","name":"Embedded Malicious Code","shortDescription":{"text":"Embedded Malicious Code"},"helpUri":"https://cwe.mitre.org/data/definitions/506.html"},{"id":"CWE-522","guid":"71fb233e-ce6a-ae57-9419-ef8373540b09","name":"Insufficiently Protected Credentials","shortDescription":{"text":"Insufficiently Protected Credentials"},"helpUri":"https://cwe.mitre.org/data/definitions/522.html"},{"id":"CWE-540","guid":"1a9db5db-e5bb-ae5d-935a-d1b4e9ee080b","name":"Inclusion of Sensitive Information in Source Code","shortDescription":{"text":"Inclusion of Sensitive Information in Source Code"},"helpUri":"https://cwe.mitre.org/data/definitions/540.html"},{"id":"CWE-77","guid":"332c8ade-6612-9f56-a06b-d8d90b1a8750","name":"Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)","shortDescription":{"text":"Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)"},"helpUri":"https://cwe.mitre.org/data/definitions/77.html"},{"id":"CWE-78","guid":"2e31ceaf-c7ae-2e5e-9661-cfb1362789cf","name":"Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)","shortDescription":{"text":"Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"},"helpUri":"https://cwe.mitre.org/data/definitions/78.html"},{"id":"CWE-79","guid":"fd45580b-e8c4-fc5e-8c2f-aa8fab0b4dbf","name":"Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)","shortDescription":{"text":"Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"},"helpUri":"https://cwe.mitre.org/data/definitions/79.html"},{"id":"CWE-798","guid":"5e8f057d-fee3-995a-a0cb-9fc5b0d174d1","name":"Use of Hard-coded Credentials","shortDescription":{"text":"Use of Hard-coded Credentials"},"helpUri":"https://cwe.mitre.org/data/definitions/798.html"},{"id":"CWE-829","guid":"13c33925-97fb-5a5e-b40c-56d328b8a4d7","name":"Inclusion of Functionality from Untrusted Control Sphere","shortDescription":{"text":"Inclusion of Functionality from Untrusted Control Sphere"},"helpUri":"https://cwe.mitre.org/data/definitions/829.html"},{"id":"CWE-89","guid":"6d08fdad-37eb-c150-bbf0-d7d946863407","name":"Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)","shortDescription":{"text":"Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)"},"helpUri":"https://cwe.mitre.org/data/definitions/89.html"},{"id":"CWE-937","guid":"16f316ae-415c-b354-a59b-1f7905f756e9","name":"Using Components with Known Vulnerabilities","shortDescription":{"text":"Using Components with Known Vulnerabilities"},"helpUri":"https://cwe.mitre.org/data/definitions/937.html"},{"id":"CWE-94","guid":"75e7f50c-6c2f-dd52-bf40-bf6c52b861fd","name":"Improper Control of Generation of Code (\u0027Code Injection\u0027)","shortDescription":{"text":"Improper Control of Generation of Code (\u0027Code Injection\u0027)"},"helpUri":"https://cwe.mitre.org/data/definitions/94.html"}]},{"name":"OWASP Top 10","guid":"7d1f0c2e-4b6a-4e39-9a51-0b2e8c3d5f61","version":"2025","organization":"OWASP Foundation","informationUri":"https://top10.owasp.org/2025/","isComprehensive":false,"shortDescription":{"text":"The OWASP Top 10:2025 web application security risks."},"taxa":[{"id":"A01:2025","guid":"df693558-c822-0452-8f7b-4d53cb6bcc59","name":"Broken Access Control","shortDescription":{"text":"Broken Access Control"},"helpUri":"https://top10.owasp.org/2025/A01_2025-Broken_Access_Control/"},{"id":"A02:2025","guid":"668dee9e-41bc-6354-97d0-fdf8f40c50c1","name":"Security Misconfiguration","shortDescription":{"text":"Security Misconfiguration"},"helpUri":"https://top10.owasp.org/2025/A02_2025-Security_Misconfiguration/"},{"id":"A03:2025","guid":"168e227c-7735-2e57-bc6e-997affe644c5","name":"Software Supply Chain Failures","shortDescription":{"text":"Software Supply Chain Failures"},"helpUri":"https://top10.owasp.org/2025/A03_2025-Software_Supply_Chain_Failures/"},{"id":"A05:2025","guid":"87e86033-3231-8458-8e4a-5cb82743553a","name":"Injection","shortDescription":{"text":"Injection"},"helpUri":"https://top10.owasp.org/2025/A05_2025-Injection/"},{"id":"A06:2025","guid":"491554d7-b8e4-9652-91a9-53700dc92ece","name":"Insecure Design","shortDescription":{"text":"Insecure Design"},"helpUri":"https://top10.owasp.org/2025/A06_2025-Insecure_Design/"},{"id":"A07:2025","guid":"334ddd78-539d-d35c-83dd-253647eb7eaf","name":"Authentication Failures","shortDescription":{"text":"Authentication Failures"},"helpUri":"https://top10.owasp.org/2025/A07_2025-Authentication_Failures/"},{"id":"A08:2025","guid":"84b0c297-710e-9a5f-9335-936ecb260c36","name":"Software or Data Integrity Failures","shortDescription":{"text":"Software or Data Integrity Failures"},"helpUri":"https://top10.owasp.org/2025/A08_2025-Software_or_Data_Integrity_Failures/"}]},{"name":"OWASP Top 10 CI/CD Security Risks","guid":"3c9b2a6e-5d14-4f7b-8e02-6a1d9c4b7f35","organization":"OWASP Foundation","informationUri":"https://owasp.org/www-project-top-10-ci-cd-security-risks/","isComprehensive":false,"shortDescription":{"text":"The OWASP Top 10 CI/CD Security Risks."},"taxa":[{"id":"CICD-SEC-3","guid":"458c83a6-ebf7-cf55-8cc3-b4d949bbf271","name":"Dependency Chain Abuse","shortDescription":{"text":"Dependency Chain Abuse"},"helpUri":"https://owasp.github.io/www-project-top-10-ci-cd-security-risks/CICD-SEC-03-Dependency-Chain-Abuse"},{"id":"CICD-SEC-6","guid":"f2ee2486-b260-2952-a41f-6b67fa713940","name":"Insufficient Credential Hygiene","shortDescription":{"text":"Insufficient Credential Hygiene"},"helpUri":"https://owasp.github.io/www-project-top-10-ci-cd-security-risks/CICD-SEC-06-Insufficient-Credential-Hygiene"},{"id":"CICD-SEC-8","guid":"b6b2dacf-a168-4957-876e-a8c73ee00eb0","name":"Ungoverned Usage of 3rd Party Services","shortDescription":{"text":"Ungoverned Usage of 3rd Party Services"},"helpUri":"https://owasp.github.io/www-project-top-10-ci-cd-security-risks/CICD-SEC-08-Ungoverned-Usage-of-3rd-Party-Services"},{"id":"CICD-SEC-9","guid":"b3d36727-0395-5b51-94c4-5e173d62eab3","name":"Improper Artifact Integrity Validation","shortDescription":{"text":"Improper Artifact Integrity Validation"},"helpUri":"https://owasp.github.io/www-project-top-10-ci-cd-security-risks/CICD-SEC-09-Improper-Artifact-Integrity-Validation"}]}],"properties":{"codehealthPublication":{"public":true,"notice":"This is the PUBLIC form of this artifact. Findings are listed in full, but the details of SECURITY findings \u2014 which rule fired, in which file, on which line, and how to fix it \u2014 are deliberately withheld, and any secret-scanner results are excluded entirely. Where detail is absent here it was REMOVED FOR PUBLICATION; it is not missing from the analysis. The complete artifact is available from the repository owner.","securityFindingsRedacted":25,"secretScannerRunsExcluded":0}},"redactionTokens":["A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."]}]}