Merging two green branches erased a HIGH-severity fix from package.json

Take the two counting errors together, because they point in opposite directions and only one of them is dangerous. The inflated scan came from a shape error: `version` was nested inside the package object instead of sitting alongside it, and OSV's batch endpoint ignored the field it did not recognise and returned every advisory ever filed against each name ^[10]. Against a true count of three ^[11], 121 of the 124 reported rows were spurious, 97.6 percent of the output ^[1], while the real exposure was about 1 percent of the 290 packages scanned ^[2]. What surfaced it was the agent flagging `[email protected]` carrying ten advisories as implausible for a package that is usually clean, then cross-checking the batch endpoint against the single-query endpoint ^[9][10]. An over-report is embarrassing and self-correcting. The manifest scan that returned "you're clean" did not error at all ^[7], and that is the failure a security tool cannot afford.

The review pass makes the asymmetry hard to miss. According to Singh's writeup, Qodo found five distinct bugs in the scanner, and every one of them shortens the answer: npm aliases, where `"foo": "npm:[email protected]"` installs bar at `node_modules/foo`, so deriving the package name from the path queries something that is not installed ^[17]; an unfollowed `next_page_token`, since OSV paginates past 1,000 vulnerabilities ^[18]; workspace link entries with no version, and a root entry whose empty path yields an empty package name ^[19]; and pairing queries with results using `zip()`, which drops the unmatched ones and then prints a clean summary ^[20]. None throws ^[21]. The change he made in response is the right one: the scanner refuses to continue when the response does not match what it asked for ^[21].

The merge case is the one I would put in a runbook. Git saw two insertions in different places and reported no conflict; the merged file had two `overrides` keys, JSON keeps the last, and a HIGH-severity ReDoS fix vanished behind passing tests and a clean diff ^[14]. Last-key-wins is doing exactly what the spec says, which helps nobody here. For that to bite you, three things have to hold: two workers editing the same manifest on sibling branches, a merge that treats distinct insertions as non-conflicting, and a suite that stays green with the override absent. All three held, across 75 tests ^[13][14]. Change any of them and the shape changes, not the class, because a per-branch gate is measuring the wrong artifact ^[15].

The runtime came out of this better than the dashboard did. Told to open a PR, the agent narrated an attempt to invoke the CLI directly, "bypassing the Code Mode restriction", then reported the CLI blocked too, because the module enforces that destructive tools go only through the approval flow ^[23]. Two routes tried, both refused, with the control living in the runtime rather than in instructions ^[23][24]. The board that was supposed to show the operator that state is what lied ^[22]. Moving the scanner into a Skill so the agent runs tested code instead of following prose is the same instinct applied one layer up ^[16].