# Reported issues for Claudexor

Pod holds 13 of 13 problems reported by people outside the maintainer team. Issues filed by the project's own owners, members and collaborators are excluded entirely — a maintainer's release checklist is not a warning to a prospective user.

Back to [Claudexor](/mcp/claudexor).

## Most discussed

### agy 429 classifier

The agy quota probe lacks a typed 429/Retry-After classifier; storms on the agy lane are
currently only bounded by the generic per-vendor pacer. Add the vendor-specific
classification (the claude oauth/usage parser is the shape to follow).

[Read the thread](https://github.com/razzant/claudexor/issues/240) · 2026-08-29 · open · outside contributor · 0 comments

### Redact raw-api diagnostics before Unicode-safe bounding

Raw-api's non-429 HTTP error path currently truncates a response body before redaction. A secret-like value that crosses the 500-code-unit boundary can leave an unredacted partial fragment in the persisted diagnostic. The HTTP 200 provider-error path introduced for #144 redacts first, but its JavaScript slice can split a valid surrogate pair at the boundary.

Use one redact-first diagnostic helper for these paths, then bound the redacted value without splitting a valid surrogate pair. Preserve t

[Read the thread](https://github.com/razzant/claudexor/issues/172) · 2026-08-14 · open · outside contributor · 0 comments

### Linux: delegated workspace_write run carries no attestable OS boundary, and a late cancel leaves unattributed live edits (transactional effect contract missing)

# Issue 2 — Linux `workspace_write` delegated runs: no OS boundary by design, but cancellation arrives only after live edits persist

**Suggested title:** Linux: delegated `workspace_write` run carries no attestable OS boundary, and a downstream containment cancel lands only after live workspace edits already persist

**Severity:** High — containment, integrity, provenance (engine half re-scoped; see status section)
**Status as of engine 3.3.15:** **OPEN — but split**: the engine behaves exactly

[Read the thread](https://github.com/razzant/claudexor/issues/160) · 2026-08-11 · open · outside contributor · 0 comments

### RawContextPacket budgeting ignores the selected model's context window

## Summary

Raw API patch-envelope candidates use a bounded `RawContextPacket`, but its default repository-content budget is a fixed estimated 200,000 tokens and is not derived from the selected model's context window.

The raw-api adapter already reads `context_length` / `context_window` from the provider's live model inventory and exposes it as `HarnessModel.context_window`, but that value does not participate in `RawContextPacket` construction.

Consequently, Claudexor can build a raw-api imp

[Read the thread](https://github.com/razzant/claudexor/issues/147) · 2026-08-08 · open · external user · 1 comment

### raw-api advertises project Plan/Review but those paths do not transport project content

## Summary

The generic raw-api/OpenRouter adapter advertises `plan: true` and `review: true`, and both intents survive capability gating, but the corresponding project-scoped execution paths do not transport the local files/evidence that their prompts require.

This creates a capability/transport mismatch:

```text
can reason over supplied text
!=
can read local files from cwd
!=
can reason over project files explicitly transported by Claudexor
```

`implement`/`synthesize` already handle this 

[Read the thread](https://github.com/razzant/claudexor/issues/137) · 2026-08-07 · open · external user · 1 comment

### Sandbox setup failure is not observable — stderr is only surfaced when `exitCode != 0`

**What happens**

`stderr` is captured but only reported when the child exits non-zero. A sandbox
that fails to initialise (and is then bypassed, or degrades) leaves no signal on
a zero-exit run.

**Why it matters here**

This is the diagnostic I needed and did not have. When my read-only audit agents
failed, the cause was environmental — `bwrap` blocked by an AppArmor
`unprivileged_userns` profile for uid 1000 — but the run surfaced nothing about
it. I found the cause by reproducing `bwrap` by 

[Read the thread](https://github.com/razzant/claudexor/issues/120) · 2026-08-06 · closed · external user · 2 comments

### `web: off` does not isolate the network, and the receipt says it was never attempted

**What happens**

With `web: off` and a `readonly` sandbox, the run still performed 213 network
requests. The receipt reported `attempted: false` for network access.

**Run**

`run-d0f14c8f646a` (config: `web: off`, sandbox: `readonly`).

**Why it matters here**

I use `web: off` as the honest boundary for read-only audit agents: the point is
that an auditor's conclusions come from the provided artifacts, not from
whatever it can reach at run time. If the flag does not isolate, the audit is
not 

[Read the thread](https://github.com/razzant/claudexor/issues/118) · 2026-08-06 · open · external user · 1 comment

### Harness reporting `status: success` with zero executed steps

**What happens**

A run can finish with `status: success` while the harness executed nothing — no
tool calls, no MCP invocations, no assistant messages. The receipt is
indistinguishable from a run that did the work.

**Why it matters here**

I drive claudexor from an autonomous agent loop. A `success` verdict is the
signal my orchestration acts on: it closes the task window, writes the process
record, and moves to the next stage. A zero-execution `success` therefore
becomes a silently skipped st

[Read the thread](https://github.com/razzant/claudexor/issues/117) · 2026-08-06 · open · external user · 1 comment

## Most recent

### Reconcile live run status with durable event streams after daemon or MCP skew

During the same review, the desktop daemon process and its v3 control endpoint remained alive while MCP status temporarily reported daemon not running. Direct inspection then reported no such run for a still-growing durable event stream, and the run later produced a final Cursor report from its run directory. This makes a live run look absent and can invite an unsafe duplicate launch.\n\nPlease make list/status/inspect reconcile the authoritative run registry with durable run directories and eve

[Read the thread](https://github.com/razzant/claudexor/issues/235) · 2026-08-27 · open · outside contributor · 0 comments

### Preserve review work after recoverable tool and process failures

During the Ouroboros adaptive-timeout review on 2026-08-27, multiple Claude review runs exited with code 1 after recoverable tool failures. The concrete failures included Read requests above the 25k-token tool limit and shell commands using GNU timeout, which is absent on macOS. The run then ended with no terminal report even though the agent had already spent time and, in one case, paid usage.\n\nPlease classify these tool failures as recoverable, keep the run alive or produce a durable partial

[Read the thread](https://github.com/razzant/claudexor/issues/233) · 2026-08-27 · open · outside contributor · 0 comments

### Move direct Claude one-shot prompts from argv to stdin

Direct non-interactive createClaudeAdapter runs without an InteractionChannel still append spec.prompt to argv. A production-shaped prompt of about 1.76 MB can therefore fail with E2BIG before Claude starts, while normal daemon, app, and CLI agent flows use interaction-channel stdin and are unaffected.

Follow up narrowly by using Claude’s supported --input-format text mode and runCliHarness input for this one-shot branch, retaining interactive stream-json ownership and adding exact-byte and arg

[Read the thread](https://github.com/razzant/claudexor/issues/227) · 2026-08-25 · open · outside contributor · 0 comments

### Remote sign-in for daemon-hosted login modes (Claude, Cursor, Antigravity) requests client_pty and dead-ends

Traced in code while adding the Antigravity harness (#192); not reproduced live, so please treat this as a suspected defect rather than a confirmed one.

For a remote connection the app asks for the client_pty transport for every harness except Codex (AppModel+RemoteActions.swift, the transport line in startRemoteLogin). On the daemon side, startObservableLogin in packages/cli/src/setup-jobs.ts decides on daemonHosted purely from the login mode, so any url_disclosure or url_disclosure_with_input

[Read the thread](https://github.com/razzant/claudexor/issues/193) · 2026-08-16 · open · outside contributor · 0 comments

### Structured output: support declared JSON Schema dialects, especially draft 2020-12

## What happened

A standard JSON Schema that explicitly declares draft 2020-12 is rejected before the model runs. Removing only the `$schema` declaration makes the same structural schema work.

## Reproduce

`schema.json`:

```json
{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "type": "object",
  "required": ["ok"],
  "properties": {
    "ok": {"type": "boolean"}
  },
  "additionalProperties": false
}
```

```bash
claudexor ask "Return an object with ok=true." \
  --harness c

[Read the thread](https://github.com/razzant/claudexor/issues/30) · 2026-07-22 · closed · outside contributor · 0 comments

The remaining reports are on [the project's issue tracker](https://github.com/razzant/claudexor/issues).