Reported issues for artsonia-mcp

Pod holds 7 of 7 problems reported by people outside the maintainer team. Issues filed by the project's own owners, members and collaborators are excluded entirely — a maintainer's release checklist is not a warning to a prospective user.

Back to artsonia-mcp.

Most discussed

Auto-review follow-ups for PR #116: fix: give each user its own session cache, and typecheck the tests

Tracking auto-review follow-ups for #116 (verdict: warn).

🟡 Nits

• src/session-cache.ts fileSegment() can still collide for different usernames whose special characters normalize to the same underscore run (e.g. 'alice+bob@example.com' and 'alice#bob@example.com' both become 'alice_bob_example.com'), causing those two users to share a cache file and fall back to cache-miss thrashing (not a security leak, since the boundTo check still rejects mis

Read the thread · 2026-08-27 · closed · external user · 0 comments

Auto-review follow-ups for PR #109: chore: declare a mint.yaml hosting manifest

Tracking auto-review follow-ups for #109 (verdict: fail).

🔴 Important

• mint.yaml egress.allow omits images.artsonia.com, which src/tools/download.ts:265,303 fetches directly (via artworkImageUrl in src/parse.ts:183), bypassing the transport layer entirely in both transport modes — risks breaking artsonia_download_artwork on a hosted/isolated-tier registration

Checklist regenerated from the auto-review of 2e3e1e5 ([run](https://github.com

Read the thread · 2026-08-25 · closed · external user · 1 comment

Auto-review follow-ups for PR #95: feat(download): return artwork inline when the server's disk is not the user's

Tracking auto-review follow-ups for #95 (verdict: warn).

🟡 Nits

• InlineDownloadIO's image buffer is per-instance, not per-invocation: two concurrent artsonia_download_artwork calls sharing the src/index.ts:22 singleton would interleave and one result would drain the other's images
• artsonia_download_artwork still reports dest and per-item file paths when io.persistsFiles is false (src/tools/download.ts:438,442), naming runner-disk paths tha

Read the thread · 2026-08-06 · closed · external user · 0 comments

Auto-review follow-ups for PR #80: ci: convert to chrischall/workflows reusable pipeline

Tracking auto-review follow-ups for #80 (verdict: fail).

🔴 Important

• ci.yml drops npm run worker:test from the CI test-command, removing all CI coverage of the Worker connector suite (tests/worker.test.ts / src/worker.ts) since vitest.config.ts excludes that file from npm test

When addressing the review on #80, resolve each item and add Closes #<this issue> to the PR once everything is genuinely fixed; deferred items stay open here.

Read the thread · 2026-07-27 · closed · external user · 1 comment

Auto-review follow-ups for PR #69: ci: deploy the connector Worker on release

Tracking auto-review follow-ups for #69 (verdict: warn).

🟡 Nits

• release-please.yml deploy-connector job inherits workflow-level contents:write/pull-requests:write permissions instead of scoping to contents:read like the sibling deploy-connector.yml entry point does for the same reusable workflow call

When addressing the review on #69, resolve each item and add Closes #<this issue> to the PR once everything is genuinely fixed; deferred it

Read the thread · 2026-07-20 · closed · external user · 0 comments

Auto-review follow-ups for PR #59: feat: add hosted Cloudflare Worker connector

Tracking auto-review follow-ups for #59 (verdict: fail).

🔴 Important

• InlineDownloadIO.images accumulates across artsonia_download_artwork invocations (shared per-session instance never cleared in extraContent), leaking prior calls' image bytes into later results — src/tools/download-io-inline.ts

🟡 Nits

• Worker download summary reports index_file/metadata_count for .json/index.json writes that InlineDownloadIO silently drops — src/tool

Read the thread · 2026-07-14 · closed · external user · 0 comments

Auto-review follow-ups for PR #55: feat(skill): add artsonia curl access skill

Tracking auto-review follow-ups for #55 (verdict: warn).

🟡 Nits

• SKILL.md one-time setup: JAR=~/.cache/artsonia-cookies.txt + : > "$JAR" fails on a fresh box without ~/.cache; add mkdir -p ~/.cache first
• SKILL.md login curl passes $ARTSONIA_PASSWORD via --data-urlencode, exposing it in curl's argv (visible via ps/proc to other local users) unlike the MCP's own server-side POST

When addressing the review on #55, resolve each

Read the thread · 2026-07-13 · closed · external user · 0 comments

Most recent

The remaining reports are on the project's issue tracker.