{"schemaVersion":1,"reportPath":"/reports/ad907bed-ebee-4d14-b05d-059a3997b671","status":{"id":"ad907bed-ebee-4d14-b05d-059a3997b671","scanId":"bc81c680-c404-44bd-8dea-e78918a0f4df","invalidatedAt":null,"invalidationReason":null,"replacedBy":null,"snapshotAvailable":false,"policyAllowed":true,"createdAt":"2026-10-14T04:29:35.837Z","observationRevision":0,"previousScanId":null,"previousReportId":null,"current":true},"summary":{"id":"ad907bed-ebee-4d14-b05d-059a3997b671","scanId":"bc81c680-c404-44bd-8dea-e78918a0f4df","artifact":{"name":"@convex-dev/agent","version":"0.7.7","integrity":"sha512-NUGMRj0m+niZgpSTLSQZzKFTXxH0n4nPu10F7vVp1qpaGsSKCLSpMKYNnRbi3E6PvZJnCVpxdU8PYKo9GmHqcw==","tarballUrl":"https://registry.npmjs.org/@convex-dev/agent/-/agent-0.7.7.tgz"},"observedAt":"2026-10-14T04:29:31.730Z","classifiedAt":"2026-10-14T04:29:35.842Z","classifierRevision":"classifier_v3","matrix":{"id":"8b9775d8-5acc-4186-a456-b008ad7a2ffa","revision":"production_2db44d825b68aeb5839111e38b0ad23c","platform":"linux_amd64_glibc","harnessRevision":"load_v2","planRevision":"explicit_exports_v1","policyRevision":"runtime_limits_v2","images":[{"profileId":"node_24_21_0","kind":"node","version":"24.21.0","imageId":"sha256:12a6a4db05cc9f4f55fe7e4731983c5476658c748b722cac3332c4bfc986c2f1","builtAt":"2026-10-04T15:20:38.392Z","sourceImage":"node:24.21.0-bookworm-slim@sha256:5cbc7caba8c2c0f0bca675d1b61b9f2857e1cf1853c6164ee9dd409501a936e7","baseImage":"gcr.io/distroless/cc-debian13:nonroot@sha256:20afe6a70f2565277b704cc17289cb557f353a3619f6350f52a2317106598df4","supportImage":"node:26.10.0-bookworm-slim@sha256:0a992e1420e2d70611578f1844a6f10a9d11fe6bb535aabf72efe3007f13d79b","platform":"linux_amd64_glibc","recipeRevision":"runtime_image_v1"},{"profileId":"node_26_10_0","kind":"node","version":"26.10.0","imageId":"sha256:8cef3b37b8edb5af9da80cb7416bd2c8b35b87fea1bc72c9abbb204ee000bd9c","builtAt":"2026-10-04T15:20:47.161Z","sourceImage":"node:26.10.0-bookworm-slim@sha256:0a992e1420e2d70611578f1844a6f10a9d11fe6bb535aabf72efe3007f13d79b","baseImage":"gcr.io/distroless/cc-debian13:nonroot@sha256:20afe6a70f2565277b704cc17289cb557f353a3619f6350f52a2317106598df4","supportImage":"node:26.10.0-bookworm-slim@sha256:0a992e1420e2d70611578f1844a6f10a9d11fe6bb535aabf72efe3007f13d79b","platform":"linux_amd64_glibc","recipeRevision":"runtime_image_v1"},{"profileId":"bun_1_4_2","kind":"bun","version":"1.4.2","imageId":"sha256:6d19a3cc65d5015ba20193b7610af27ad603eed4ea29caf4dd4ccc04ad5ca7ef","builtAt":"2026-10-04T15:21:07.160Z","sourceImage":"oven/bun:1.4.2-debian@sha256:53710ce0f14eef8312521c586a7ae1d9aeab4011840f09f1966073b68fc2e2ab","baseImage":"gcr.io/distroless/cc-debian13:nonroot@sha256:20afe6a70f2565277b704cc17289cb557f353a3619f6350f52a2317106598df4","supportImage":"node:26.10.0-bookworm-slim@sha256:0a992e1420e2d70611578f1844a6f10a9d11fe6bb535aabf72efe3007f13d79b","platform":"linux_amd64_glibc","recipeRevision":"runtime_image_v1"},{"profileId":"deno_2_9_7","kind":"deno","version":"2.9.7","imageId":"sha256:1a5c5f412e04bff71a674b122f4216fac988b0fddc9d36be588224490adc292e","builtAt":"2026-10-04T15:21:22.570Z","sourceImage":"denoland/deno:debian-2.9.7@sha256:869d374bdaddda4fde029c492d7219199b0e821c2c53cca5357b3a6f5b9336fc","baseImage":"gcr.io/distroless/cc-debian13:nonroot@sha256:20afe6a70f2565277b704cc17289cb557f353a3619f6350f52a2317106598df4","supportImage":"node:26.10.0-bookworm-slim@sha256:0a992e1420e2d70611578f1844a6f10a9d11fe6bb535aabf72efe3007f13d79b","platform":"linux_amd64_glibc","recipeRevision":"runtime_image_v1"}]},"outcome":"inconclusive","evidenceLevel":"smoke_tested","coverageComplete":true,"limitations":["Only installation and loading were observed; functional correctness and package safety are not established.","Subpath batches share module caches and globals; root modes use separate fresh sandboxes.","Package-visible harness observations can be tampered with. They are not adversarial attestation.","Evidence applies to these exact artifacts, dependency snapshot, runtime images and Linux amd64/glibc policy.","Runtime error codes are captured observations and can also be thrown by package code."],"preparation":{"id":"7f4c7d79-61eb-49b0-8561-2323e38c84ae","outcome":"pass","failure":null,"profileRevision":"npm_11_19_0_linux_amd64_v2","snapshot":{"id":"8cbb8e58-3b8b-4482-a7fa-2967138f8287","generation":"9de46251-106c-44f7-81e2-9d9bc442218f","lockDigest":"02fbaf69c621cce2761d12807ab956b9670688d1e7318677b603b7fd5ba06868","treeDigest":"04b32ff66c6350eebcaf6cacbdab9356b78a9665f1d3214db6c47c2117ec892f","profileRevision":"npm_11_19_0_linux_amd64_v2","installerImage":"node:24.21.0-bookworm-slim@sha256:5cbc7caba8c2c0f0bca675d1b61b9f2857e1cf1853c6164ee9dd409501a936e7"},"installedCount":19,"omittedOptionalCount":25},"omissions":{"counts":{"pattern":0,"non_executable":1,"not_exported":1,"invalid_subpath":0,"coverage_limit":0},"samples":[{"subpath":"./package.json","reason":"non_executable"},{"subpath":"./_generated/component.js","reason":"not_exported"}]},"cells":[{"runId":"dd26e934-d945-484d-aeab-d81fd0a67b9f","profileId":"node_24_21_0","group":"root","mode":"esm","method":"fresh_root_v2","outcome":"pass","evidenceLevel":"smoke_tested","coverage":{"planned":1,"observed":1,"passed":1,"failed":0,"prerequisiteLimited":0,"isolationPassed":0,"isolationUnconfirmed":0,"interrupted":0,"untested":0,"complete":true},"durationMs":562.3029520008713,"failure":null},{"runId":"9f2e8331-acf5-4c64-9988-d80edbdc8ccf","profileId":"node_24_21_0","group":"root","mode":"commonjs","method":"fresh_root_v2","outcome":"pass","evidenceLevel":"smoke_tested","coverage":{"planned":1,"observed":1,"passed":1,"failed":0,"prerequisiteLimited":0,"isolationPassed":0,"isolationUnconfirmed":0,"interrupted":0,"untested":0,"complete":true},"durationMs":1067.6888700015843,"failure":null},{"runId":"ef7a0673-d4f0-4702-9c5a-e581881fbd1f","profileId":"node_24_21_0","group":"subpaths","mode":"esm","method":"sequential_batch_v2","outcome":"inconclusive","evidenceLevel":"smoke_tested","coverage":{"planned":5,"observed":5,"passed":3,"failed":2,"prerequisiteLimited":1,"isolationPassed":0,"isolationUnconfirmed":0,"interrupted":0,"untested":0,"complete":true},"durationMs":428.7954309992492,"failure":{"classification":"optional_peer_missing","phase":"module_resolution","origin":"prerequisite","retryable":false,"source":"captured_error_code","message":"Cannot find package 'react' imported from /workspace/node_modules/@convex-dev/agent/dist/react/index.js","optionalPeer":{"name":"react","range":"^18.3.1 || ^19.0.0"}}},{"runId":"1a6753db-12d7-4f70-bdd3-bd96aaeb10e5","profileId":"node_24_21_0","group":"subpaths","mode":"commonjs","method":"sequential_batch_v2","outcome":"inconclusive","evidenceLevel":"smoke_tested","coverage":{"planned":5,"observed":5,"passed":3,"failed":2,"prerequisiteLimited":1,"isolationPassed":0,"isolationUnconfirmed":0,"interrupted":0,"untested":0,"complete":true},"durationMs":463.0260470006615,"failure":{"classification":"optional_peer_missing","phase":"module_resolution","origin":"prerequisite","retryable":false,"source":"captured_error_code","message":"Cannot find package 'react' imported from /workspace/node_modules/@convex-dev/agent/dist/react/index.js","optionalPeer":{"name":"react","range":"^18.3.1 || ^19.0.0"}}},{"runId":"2eb076a3-7480-4997-b413-7835d90af916","profileId":"node_26_10_0","group":"root","mode":"esm","method":"fresh_root_v2","outcome":"pass","evidenceLevel":"smoke_tested","coverage":{"planned":1,"observed":1,"passed":1,"failed":0,"prerequisiteLimited":0,"isolationPassed":0,"isolationUnconfirmed":0,"interrupted":0,"untested":0,"complete":true},"durationMs":523.1265730001032,"failure":null},{"runId":"58021b57-d9f3-4230-b98a-897c95652133","profileId":"node_26_10_0","group":"root","mode":"commonjs","method":"fresh_root_v2","outcome":"pass","evidenceLevel":"smoke_tested","coverage":{"planned":1,"observed":1,"passed":1,"failed":0,"prerequisiteLimited":0,"isolationPassed":0,"isolationUnconfirmed":0,"interrupted":0,"untested":0,"complete":true},"durationMs":520.7597240004689,"failure":null},{"runId":"73b13f1a-044c-41af-bf07-0f1b934051e1","profileId":"node_26_10_0","group":"subpaths","mode":"esm","method":"sequential_batch_v2","outcome":"inconclusive","evidenceLevel":"smoke_tested","coverage":{"planned":5,"observed":5,"passed":3,"failed":2,"prerequisiteLimited":1,"isolationPassed":0,"isolationUnconfirmed":0,"interrupted":0,"untested":0,"complete":true},"durationMs":731.0354680009186,"failure":{"classification":"optional_peer_missing","phase":"module_resolution","origin":"prerequisite","retryable":false,"source":"captured_error_code","message":"Cannot find package 'react' imported from /workspace/node_modules/@convex-dev/agent/dist/react/index.js","optionalPeer":{"name":"react","range":"^18.3.1 || ^19.0.0"}}},{"runId":"de9191b8-850b-4faa-9d0f-db9b4dfe9a55","profileId":"node_26_10_0","group":"subpaths","mode":"commonjs","method":"sequential_batch_v2","outcome":"inconclusive","evidenceLevel":"smoke_tested","coverage":{"planned":5,"observed":5,"passed":3,"failed":2,"prerequisiteLimited":1,"isolationPassed":0,"isolationUnconfirmed":0,"interrupted":0,"untested":0,"complete":true},"durationMs":345.735178001225,"failure":{"classification":"optional_peer_missing","phase":"module_resolution","origin":"prerequisite","retryable":false,"source":"captured_error_code","message":"Cannot find package 'react' imported from /workspace/node_modules/@convex-dev/agent/dist/react/index.js","optionalPeer":{"name":"react","range":"^18.3.1 || ^19.0.0"}}},{"runId":"f3e912c0-bfd6-4f2f-afce-5a7b1b557343","profileId":"bun_1_4_2","group":"root","mode":"esm","method":"fresh_root_v2","outcome":"pass","evidenceLevel":"smoke_tested","coverage":{"planned":1,"observed":1,"passed":1,"failed":0,"prerequisiteLimited":0,"isolationPassed":0,"isolationUnconfirmed":0,"interrupted":0,"untested":0,"complete":true},"durationMs":637.0827929992229,"failure":null},{"runId":"7785ac95-dd48-4d19-acf7-a0628e3b62a8","profileId":"bun_1_4_2","group":"root","mode":"commonjs","method":"fresh_root_v2","outcome":"pass","evidenceLevel":"smoke_tested","coverage":{"planned":1,"observed":1,"passed":1,"failed":0,"prerequisiteLimited":0,"isolationPassed":0,"isolationUnconfirmed":0,"interrupted":0,"untested":0,"complete":true},"durationMs":625.4386470001191,"failure":null},{"runId":"0854c0d6-fb80-4615-92a7-22dd77403a2b","profileId":"bun_1_4_2","group":"subpaths","mode":"esm","method":"sequential_batch_v2","outcome":"partial","evidenceLevel":"smoke_tested","coverage":{"planned":5,"observed":5,"passed":3,"failed":2,"prerequisiteLimited":0,"isolationPassed":0,"isolationUnconfirmed":0,"interrupted":0,"untested":0,"complete":true},"durationMs":627.6635469999164,"failure":{"classification":"esm_import_failed","phase":"module_evaluation","origin":"package","retryable":false,"source":"harness_observation","message":"The runtime reported a loading failure without a captured error message. Its cause is unknown."}},{"runId":"769bd01f-009b-4412-8c41-bd68b2f828d3","profileId":"bun_1_4_2","group":"subpaths","mode":"commonjs","method":"sequential_batch_v2","outcome":"partial","evidenceLevel":"smoke_tested","coverage":{"planned":5,"observed":5,"passed":3,"failed":2,"prerequisiteLimited":0,"isolationPassed":0,"isolationUnconfirmed":0,"interrupted":0,"untested":0,"complete":true},"durationMs":342.0878229998052,"failure":{"classification":"commonjs_require_failed","phase":"module_evaluation","origin":"package","retryable":false,"source":"harness_observation","message":"The runtime reported a loading failure without a captured error message. Its cause is unknown."}},{"runId":"4fe19b85-3c39-4076-b673-45a62056cff1","profileId":"deno_2_9_7","group":"root","mode":"esm","method":"fresh_root_v2","outcome":"pass","evidenceLevel":"smoke_tested","coverage":{"planned":1,"observed":1,"passed":1,"failed":0,"prerequisiteLimited":0,"isolationPassed":0,"isolationUnconfirmed":0,"interrupted":0,"untested":0,"complete":true},"durationMs":869.6739290002733,"failure":null},{"runId":"49700dbc-7b5a-41d0-a570-89caa1f5833e","profileId":"deno_2_9_7","group":"root","mode":"commonjs","method":"fresh_root_v2","outcome":"pass","evidenceLevel":"smoke_tested","coverage":{"planned":1,"observed":1,"passed":1,"failed":0,"prerequisiteLimited":0,"isolationPassed":0,"isolationUnconfirmed":0,"interrupted":0,"untested":0,"complete":true},"durationMs":623.0480709988624,"failure":null},{"runId":"a46e9b2c-1ff5-46fd-a256-f5e4e632172f","profileId":"deno_2_9_7","group":"subpaths","mode":"esm","method":"sequential_batch_v2","outcome":"inconclusive","evidenceLevel":"smoke_tested","coverage":{"planned":5,"observed":5,"passed":3,"failed":2,"prerequisiteLimited":1,"isolationPassed":0,"isolationUnconfirmed":0,"interrupted":0,"untested":0,"complete":true},"durationMs":517.8299580011517,"failure":{"classification":"optional_peer_missing","phase":"module_resolution","origin":"prerequisite","retryable":false,"source":"captured_error_code","message":"Could not find package 'react' from referrer 'file:///workspace/node_modules/@convex-dev/agent/dist/react/index.js'.","optionalPeer":{"name":"react","range":"^18.3.1 || ^19.0.0"}}},{"runId":"2fa3cae8-59c3-4a2b-8005-8060f6ffd43a","profileId":"deno_2_9_7","group":"subpaths","mode":"commonjs","method":"sequential_batch_v2","outcome":"inconclusive","evidenceLevel":"smoke_tested","coverage":{"planned":5,"observed":5,"passed":3,"failed":2,"prerequisiteLimited":1,"isolationPassed":0,"isolationUnconfirmed":0,"interrupted":0,"untested":0,"complete":true},"durationMs":422.81994900107384,"failure":{"classification":"optional_peer_missing","phase":"module_resolution","origin":"prerequisite","retryable":false,"source":"captured_error_code","message":"Could not find package 'react' from referrer 'file:///workspace/node_modules/@convex-dev/agent/dist/react/index.js'.","optionalPeer":{"name":"react","range":"^18.3.1 || ^19.0.0"}}}],"runtimes":[{"profileId":"node_24_21_0","outcome":"inconclusive"},{"profileId":"node_26_10_0","outcome":"inconclusive"},{"profileId":"bun_1_4_2","outcome":"partial"},{"profileId":"deno_2_9_7","outcome":"inconclusive"}],"missingOptionalPeers":[{"name":"react","range":"^18.3.1 || ^19.0.0"}],"missingOptionalPeersTruncated":false}}