Reported issues for artsonia-mcp
Pod holds 7 of 7 problems reported by people outside the maintainer team. Issues filed by the project's own owners, members and collaborators are excluded entirely — a maintainer's release checklist is not a warning to a prospective user.
Back to artsonia-mcp.
Most discussed
Auto-review follow-ups for PR #116: fix: give each user its own session cache, and typecheck the tests
Tracking auto-review follow-ups for #116 (verdict: warn).
🟡 Nits
- src/session-cache.ts fileSegment() can still collide for different usernames whose special characters normalize to the same underscore run (e.g. 'alice+bob@example.com' and 'alice#bob@example.com' both become 'alice_bob_example.com'), causing those two users to share a cache file and fall back to cache-miss thrashing (not a security leak, since the boundTo check still rejects mis
Read the thread · 2026-08-27 · closed · external user · 0 comments
Auto-review follow-ups for PR #109: chore: declare a mint.yaml hosting manifest
Tracking auto-review follow-ups for #109 (verdict: fail).
🔴 Important
- mint.yaml egress.allow omits images.artsonia.com, which src/tools/download.ts:265,303 fetches directly (via artworkImageUrl in src/parse.ts:183), bypassing the transport layer entirely in both transport modes — risks breaking artsonia_download_artwork on a hosted/isolated-tier registration
Checklist regenerated from the auto-review of 2e3e1e5 ([run](https://github.com
Read the thread · 2026-08-25 · closed · external user · 1 comment
Auto-review follow-ups for PR #95: feat(download): return artwork inline when the server's disk is not the user's
Tracking auto-review follow-ups for #95 (verdict: warn).
🟡 Nits
- InlineDownloadIO's image buffer is per-instance, not per-invocation: two concurrent artsonia_download_artwork calls sharing the src/index.ts:22 singleton would interleave and one result would drain the other's images
- artsonia_download_artwork still reports dest and per-item file paths when io.persistsFiles is false (src/tools/download.ts:438,442), naming runner-disk paths tha
Read the thread · 2026-08-06 · closed · external user · 0 comments
Auto-review follow-ups for PR #80: ci: convert to chrischall/workflows reusable pipeline
Tracking auto-review follow-ups for #80 (verdict: fail).
🔴 Important
- ci.yml drops
npm run worker:testfrom the CI test-command, removing all CI coverage of the Worker connector suite (tests/worker.test.ts / src/worker.ts) since vitest.config.ts excludes that file fromnpm test
When addressing the review on #80, resolve each item and add Closes #<this issue> to the PR once everything is genuinely fixed; deferred items stay open here.
Read the thread · 2026-07-27 · closed · external user · 1 comment
Auto-review follow-ups for PR #69: ci: deploy the connector Worker on release
Tracking auto-review follow-ups for #69 (verdict: warn).
🟡 Nits
- release-please.yml deploy-connector job inherits workflow-level contents:write/pull-requests:write permissions instead of scoping to contents:read like the sibling deploy-connector.yml entry point does for the same reusable workflow call
When addressing the review on #69, resolve each item and add Closes #<this issue> to the PR once everything is genuinely fixed; deferred it
Read the thread · 2026-07-20 · closed · external user · 0 comments
Auto-review follow-ups for PR #59: feat: add hosted Cloudflare Worker connector
Tracking auto-review follow-ups for #59 (verdict: fail).
🔴 Important
- InlineDownloadIO.images accumulates across artsonia_download_artwork invocations (shared per-session instance never cleared in extraContent), leaking prior calls' image bytes into later results — src/tools/download-io-inline.ts
🟡 Nits
- Worker download summary reports index_file/metadata_count for .json/index.json writes that InlineDownloadIO silently drops — src/tool
Read the thread · 2026-07-14 · closed · external user · 0 comments
Auto-review follow-ups for PR #55: feat(skill): add artsonia curl access skill
Tracking auto-review follow-ups for #55 (verdict: warn).
🟡 Nits
- SKILL.md one-time setup:
JAR=~/.cache/artsonia-cookies.txt+: > "$JAR"fails on a fresh box without~/.cache; addmkdir -p ~/.cachefirst - SKILL.md login curl passes
$ARTSONIA_PASSWORDvia --data-urlencode, exposing it in curl's argv (visible via ps/proc to other local users) unlike the MCP's own server-side POST
When addressing the review on #55, resolve each
Read the thread · 2026-07-13 · closed · external user · 0 comments
Most recent
The remaining reports are on the project's issue tracker.