Reported issues for Drafto

Pod holds 9 of 9 problems reported by people outside the maintainer team. Issues filed by the project's own owners, members and collaborators are excluded entirely — a maintainer's release checklist is not a warning to a prospective user.

Back to Drafto.

Most discussed

feat(dark-factory): let the implement + watch stages see screenshots

What

The dark-factory planner can now fetch and view screenshots (PR #554 added a host-validated bundle.screenshots field plus a tightly-scoped fetch+Read tool in scripts/factory-plan-prompt.md). The implement and watch stages still cannot: buildFactoryImplementBundle / buildFactoryWatchBundle in scripts/lib/factory-bundle.mjs don't surface screenshots, and scripts/factory-prompt.md (the implementer prompt) has no screenshot-fetch tool.

So when the planner writes

Read the thread · 2026-06-29 · closed · 5 comments

feat: notebook delete & rename via MCP

What

The Drafto MCP server exposes note-level tools (create/read/update/trash/move) and can create + list notebooks, but it cannot delete or rename a notebook. This gap surfaced during the Evernote re-import cleanup: trashing a notebook's notes via MCP leaves an empty notebook shell that can only be removed in the web UI, and a "(fixed)" notebook can't be renamed back to its original name from MCP. Add rename_notebook and delete_notebook MCP tools so an agent can fully manage no

Read the thread · 2026-06-14 · closed · 2 comments

chore: type RPC Functions and Block/Json boundary, drop url-polyfill any

What

The repo's "strict TypeScript — no any" rule is being evaded at three boundaries. (1) packages/shared/src/types/database.ts:215 declares Functions: Record<string, never>, so RPC calls bypass the type system entirely: apps/web/src/app/api/notes/search/route.ts:31-36 calls supabase.rpc("search_notes" as never, { search_query: q } as never) and asserts a hand-written result type — if a migration changes the search_notes signature (it already changed once, in `supabase/migratio

Read the thread · 2026-06-12 · open · 0 comments

fix: use constant-time comparison for cron and webhook shared secrets

What

Two privileged web API endpoints compare caller-supplied shared secrets with plain string equality, which short-circuits on the first differing byte instead of running in constant time. apps/web/src/app/api/cron/cleanup-trash/route.ts:11 checks authHeader === Bearer ${cronSecret} `` to authorize a bulk-deletion RPC, and apps/web/src/app/api/webhooks/new-signup/route.ts:54-56 checks providedSecret !== env.WEBHOOK_SECRET to authorize a service-role-backed webhook. This is inco

Read the thread · 2026-06-12 · open · 0 comments

fix: wrong status codes and false-success paths in web API routes

What

Several web API routes return the wrong HTTP status or a wrong result, which misleads clients and pollutes monitoring. In apps/web/src/app/api/notes/[id]/route.ts, PATCH accepts body.notebook_id (line 111) and body.content completely unvalidated and then maps every database error — RLS rejection, malformed UUID, FK violation, bad jsonb — to a blanket 404 (errorResponse("Failed to update note", 404) at lines 132–134), conflating 400/403/404/500. DELETE in the same file (line

Read the thread · 2026-06-12 · open · 0 comments

chore(web): route MCP auth through createAdminClient, drop inline client

What

apps/web/src/lib/api/mcp-auth.ts hand-rolls the RLS-bypassing service-role Supabase client instead of using the centralized factory in apps/web/src/lib/supabase/admin.ts. Evidence: mcp-auth.ts:1 imports createClient from @supabase/supabase-js directly, and mcp-auth.ts:42-45 constructs a client with the exact options of createAdminClient (admin.ts:26-35), hard-coding the "x-drafto-client": "web-mcp" header that admin.ts:18 explicitly documents as an intended `clientT

Read the thread · 2026-06-12 · open · 0 comments

fix: make MCP search_notes match full-text promise and escape wildcards

What

The MCP tool search_notes is registered in apps/web/src/app/api/mcp/route.ts:45 with the description "Full-text search across all notes (titles, content, and notebook names)", but the handler in apps/web/src/lib/api/mcp-tools.ts:93-102 only runs .ilike("title", pattern) — note content and notebook names are never searched (the comment at line 93-94 explains the web search_notes RPC can't be reused because it is security invoker and relies on auth.uid(), which is unset for

Read the thread · 2026-06-12 · open · 0 comments

fix: unreliable fire-and-forget DB writes; note GET mutates updated_at

What

Two API code paths issue Supabase writes as dangling promises that are never awaited, so on Vercel serverless the function can freeze as soon as the response is returned and the writes silently complete only sometimes. In apps/web/src/app/api/notes/[id]/route.ts:52-61, the GET handler persists TipTap→BlockNote-repaired content via an unawaited .then() (supabase.from("notes").update({ content: converted ... }).eq("id", id)...then(...)) while the response is returned at line 79 — s

Read the thread · 2026-06-12 · open · 0 comments

Most recent

fix: markdown-converter round-trip corrupts note content via MCP

What

The MCP server's read-modify-write flow (readNote returns blockNoteToMarkdown(blocks); updateNote persists markdownToBlockNote(contentMarkdown) at apps/web/src/lib/api/mcp-tools.ts:163) silently corrupts canonical note content because the round-trip in packages/shared/src/editor/markdown-converter.ts is lossy in four execution-verified ways. (1) Nesting is flattened: markdownToBlockNote computes the indent but discards it — markdown-converter.ts:236 reads `const { conte

Read the thread · 2026-06-12 · open · 0 comments

The remaining reports are on the project's issue tracker.