# Reported issues for KIAgent

Pod holds 21 of 27 problems reported by people outside the maintainer team. Issues filed by the project's own owners, members and collaborators are excluded entirely — a maintainer's release checklist is not a warning to a prospective user.

Back to [KIAgent](/mcp/kiagent).

## Most discussed

### `net` capability reaches the auth-free loopback MCP server

**High** · ✅ **verified** · from the architecture review (#46) · `src/main/platform · src/main/marketplace`

**Evidence** — host-surfaces.ts:172–193 · core/mcp/server.ts:170–192, :249, PORT_CANDIDATES = [7421, 7423–7425]

**Why it matters** — Renders `query` and `db` decorative for anyone holding the one capability every connector needs.

**Fix** — Mint a per-client bearer token for the loopback listener at boot; or block private-IP destinations in `net.fetch` and make loopback a separately cons

[Read the thread](https://github.com/edjafarov/kiagent-core/issues/47) · 2026-08-07 · closed · 2 comments

### Channel allowlist and handler registration are not compile-enforced, despite a comment claiming they are

*From a multi-agent architecture review (2026-07-10). Severity: **high** · Category: **api-design** · Verification: **partially-confirmed** (adversarially checked against the code; the recommendation below is the verifier-corrected version).*

## Problem
ipc.ts:355-356 says the INVOKE_CHANNELS/PUSH_CHANNELS allowlists "must stay in sync with the interfaces above; the satisfies clauses enforce it at compile time" — but `as const satisfies readonly InvokeChannel[]` (ipc.ts:412, 420) only rejects u

[Read the thread](https://github.com/edjafarov/kiagent-core/issues/23) · 2026-07-10 · closed · 2 comments

### Outbound: attachment support for draft_message / draft_reply

## Current state

The outbound layer ships a single MCP tool, `draft_reply` — replies stay within the originating thread (Gmail: `users.messages.send` with `threadId` + `In-Reply-To`/`References` from stored RFC Message-IDs; SMTP: same headers). There is no way to start a new email, and drafts are text-only.

Spec: `docs/superpowers/specs/2026-07-23-unified-outbound-design.md`.

## Request 1: compose-new email tool

Already in the spec's approved tool scope (§ Tool scope: "reply + compose-new; c

[Read the thread](https://github.com/edjafarov/kiagent-core/issues/41) · 2026-07-27 · open · 1 comment

### OAuth client secret crosses into the untrusted extension child via auth.oauth() and session.credentials()

*From a multi-agent architecture review (2026-07-10). Severity: **high** · Category: **correctness** · Verification: **confirmed** (adversarially checked against the code; the recommendation below is the verifier-corrected version).*

## Problem
contracts.ts:507-510 promises "the extension never sees a client secret," but the Google credentials blob embeds `clientId`/`clientSecret` in the vault by design (src/main/sources/gmail/oauth.ts:91-94,151-170, 'exactly what Credentials.clientId/clientSec

[Read the thread](https://github.com/edjafarov/kiagent-core/issues/28) · 2026-07-10 · open · 1 comment

### The stated contract (connectors-authoring-guide.md) documents a deleted architecture

*From a multi-agent architecture review (2026-07-10). Severity: **high** · Category: **docs** · Verification: **confirmed** (adversarially checked against the code; the recommendation below is the verifier-corrected version).*

## Problem
docs/connectors-authoring-guide.md — the document positioned as the connector-authoring contract — is 100% stale. It instructs authors to implement `Connector`/`ConnectorInstance` from `src/main/connectors/types.ts` (guide line 18), register in `src/main/connec

[Read the thread](https://github.com/edjafarov/kiagent-core/issues/27) · 2026-07-10 · closed · 1 comment

### No error taxonomy: every source failure is 5 blind retries then generic 'error'; 'needsReauth' is unreachable dead state

*From a multi-agent architecture review (2026-07-10). Severity: **high** · Category: **api-design** · Verification: **partially-confirmed** (adversarially checked against the code; the recommendation below is the verifier-corrected version).*

## Problem
The engine treats every exception from pull()/reconcile() identically: exponential backoff, SOURCE_MAX_RETRIES=5, then status 'error' (engine.ts:50-52, 625-653). SyncStatus declares 'needsReauth' (contracts.ts:87) but nothing in the entire main 

[Read the thread](https://github.com/edjafarov/kiagent-core/issues/24) · 2026-07-10 · closed · 1 comment

### Loopback MCP server has no auth — any local process can reach every tool, including outbound

*Deferred out of #47 by an explicit scoping decision, and filed now so it stops being a comment in a closed thread. #47 blocked the extension host's route to this port; nothing else about the port changed.*

## What is there today

The loopback Streamable-HTTP MCP server has no authentication, by design. `src/main/core/mcp/clients.ts:230` states the model outright:

```ts
const httpEntry = { type: 'http', url: opts.localUrl }; // no bearer — loopback bind IS the auth
```

`src/main/core/mcp/serv

[Read the thread](https://github.com/edjafarov/kiagent-core/issues/94) · 2026-08-07 · closed · 0 comments

### Low-severity architecture review findings (10 items)

The ten low-severity findings from the architecture review (#46), collected here rather than as ten separate issues. None is urgent; each is small, specific, and independently fixable. Tick them off as they land.

### Extension platform & marketplace
`src/main/platform · src/main/marketplace`

- [ ] **Install commit is not crash-atomic**
  - *Evidence* — installer.ts:209–220 — rename data aside, `rmSync` dir, move staging, restore data
  - *Why* — A crash mid-sequence leaves no extension direct

[Read the thread](https://github.com/edjafarov/kiagent-core/issues/93) · 2026-08-07 · open · 0 comments

## Most recent

### The app's own log file grows unbounded

**Medium** · from the architecture review (#46) · `.github · package.json · src/main/core/logs.ts`

**Evidence** — logs.ts:35 — `fs.appendFile` with no size check, while mcp/activity.ts:61 has `rotateIfOversized`

**Why it matters** — An always-on indexer logs for months; `logs:export` then hands that entire file to a bug report. The rotation pattern already exists one directory away.

**Fix** — Apply the same size-capped rotation.

[Read the thread](https://github.com/edjafarov/kiagent-core/issues/85) · 2026-08-07 · open · 0 comments

### `digital_memory_info` materializes 500 full documents on every call

**Medium** · from the architecture review (#46) · `src/main/core/mcp · src/main/outbound`

**Evidence** — digital-memory-info.ts:27, :72 · store.ts:565–570 (`SELECT d.*`) · instructions say "START by calling digital_memory_info"

**Why it matters** — Every conversation pays a fixed cost of 500 complete bodies across the bridge to derive type and language sets — the slowest first impression the product makes.

**Fix** — Three cheap aggregates, or cache keyed on `max(changes.seq)`.

[Read the thread](https://github.com/edjafarov/kiagent-core/issues/81) · 2026-08-07 · open · 0 comments

### No caps on batch arrays or payload sizes

**Medium** · from the architecture review (#46) · `src/main/core/mcp · src/main/outbound`

**Evidence** — get.ts:61–70 (`ids` unbounded) · query-sql.ts:50 (`SELECT markdown … LIMIT 500` is legal) · search.ts:244–257 (`queries` unbounded)

**Why it matters** — A single call can return tens of MB through a desktop client's stdio pipe; thousands of ids become thousands of worker round trips.

**Fix** — Cap batch arrays with actionable errors, add `max_chars` with a truncated flag.

[Read the thread](https://github.com/edjafarov/kiagent-core/issues/80) · 2026-08-07 · open · 0 comments

### The physical SQLite schema is a public API with no version or evolution story

**Medium** · from the architecture review (#46) · `src/main/core/mcp · src/main/outbound`

**Evidence** — tools/get-schema.ts + schema-doc.ts (whole physical layout published) · make-server.ts:24 (version hardcoded `'0.1.0'` at app 0.70.1)

**Why it matters** — Clients and users' saved prompts bind to table names; any rename is a silent breaking change with no detectable signal. The drift test keeps the doc honest but freezes the schema.

**Fix** — Publish stable SQL _views_ as the documented su

[Read the thread](https://github.com/edjafarov/kiagent-core/issues/79) · 2026-08-07 · open · 0 comments

### Models can create drafts but never discard them

**Medium** · from the architecture review (#46) · `src/main/core/mcp · src/main/outbound`

**Evidence** — outbox.ts:20 (`OUTBOX_PENDING_CAP` 20) · service.ts:291–295 ("create a new draft instead") · no discard tool exists

**Why it matters** — The instructed redraft-on-every-edit workflow burns cap slots; at 20 pending the account can't draft for up to 24h unless the user manually cancels each. Discard is the one outbound mutation that's inherently safe.

**Fix** — Add `discard_draft` — the CAS 

[Read the thread](https://github.com/edjafarov/kiagent-core/issues/78) · 2026-08-07 · open · 0 comments

### Chat mode lets any local process send email as the user

**Medium** · from the architecture review (#46) · `src/main/core/mcp · src/main/outbound`

**Evidence** — outbound/routes.ts:340–391 (`/outbox/api`, no auth beyond Host/Origin) · service.ts:656–704, :463 (default 30 sends/hour)

**Why it matters** — Once chat mode is enabled, curl suffices. The "user's consent observed in chat" invariant is enforced nowhere in code, and there is no UI signal at send time.

**Fix** — OS notification on every chat-mode send, a lower default cap, and bind `send_dra

[Read the thread](https://github.com/edjafarov/kiagent-core/issues/77) · 2026-08-07 · open · 0 comments

### `get_related` returns raw internal rows — full bodies, no limit, different wire shape

**High** · from the architecture review (#46) · `src/main/core/mcp · src/main/outbound`

**Evidence** — tools/get-related.ts:35–37 (`return query.children(id)`) · store.ts:447–453 (unbounded `SELECT *`) · registry.ts:119 (stringified into one block)

**Why it matters** — Instructions tell models to expand every thread this way; a 200-message thread returns 200 complete bodies plus internal fields in camelCase, inconsistent with the snake_case contract search and get preserve.

**Fix** — Project 

[Read the thread](https://github.com/edjafarov/kiagent-core/issues/76) · 2026-08-07 · open · 0 comments

### `query_sql` is unbounded and runs synchronously on the Electron main thread

**High** · from the architecture review (#46) · `src/main/core/mcp · src/main/outbound`

**Evidence** — tools/query-sql.ts:47–50 · raw-sql.ts:46 (in-process handle) · main.ts:638 (`startMcp` runs in main)

**Why it matters** — The 500-row cap bounds output, not work. A recursive CTE freezes the entire main process — UI, IPC, every other MCP session — with no interrupt path, triggerable accidentally by any connected LLM.

**Fix** — Run off-thread in a killable worker with a wall-clock timeout (be

[Read the thread](https://github.com/edjafarov/kiagent-core/issues/75) · 2026-08-07 · open · 0 comments

### Event bus is one global namespace shared by all extensions

**Medium** · from the architecture review (#46) · `src/main/platform · src/main/marketplace`

**Evidence** — host-surfaces.ts:26–44 (`subs` keyed by event name only; `_from` ignored), :250–262

**Why it matters** — Any extension with `events` can subscribe to and spoof any other's events — an eavesdropping surface between mutually untrusting authors.

**Fix** — Auto-namespace emissions as `<extensionId>:<name>`; require subscribers to name the publisher.

[Read the thread](https://github.com/edjafarov/kiagent-core/issues/55) · 2026-08-07 · open · 0 comments

### No post-activation liveness supervision; `callTool` has no timeout

**High** · from the architecture review (#46) · `src/main/platform · src/main/marketplace`

**Evidence** — host-process.ts:224–251 (timeouts are handshake-only), :332–336 (unbounded) vs extension-platform.ts:401–408 (sender path _is_ wrapped in 60s)

**Why it matters** — A hung tool call wedges the MCP request forever. The codebase's own comment explains why the sender path needed this; identical reasoning applies to tools and every source-proxy call.

**Fix** — Default per-call deadline in `cre

[Read the thread](https://github.com/edjafarov/kiagent-core/issues/52) · 2026-08-07 · open · 0 comments

### Update integrity is skipped in exactly the case the pin exists for

**High** · from the architecture review (#46) · `src/main/platform · src/main/marketplace`

**Evidence** — installer.ts:155–169 (comparison requires `prior.version === manifest.version`) · :97 (any `github:` or `https:` ref accepted)

**Why it matters** — A new version re-pins whatever bytes arrive, from whatever ref, with no signature or publisher continuity check. Trust rests entirely on GitHub account control.

**Fix** — Pin the publisher (owner/repo) and refuse owner changes on update; mediu

[Read the thread](https://github.com/edjafarov/kiagent-core/issues/51) · 2026-08-07 · open · 0 comments

### No sandbox — capabilities gate the RPC surface, not the extension's reach

**High** · from the architecture review (#46) · `src/main/platform · src/main/marketplace`

**Evidence** — extension-host-entry.ts:124 (`createRequire`) · transport.ts:116–119 (no permission flags) · :73–79 (inherits `process.env`)

**Why it matters** — A manifest declaring only `query` can read the SQLite file off disk and POST it anywhere without touching a gated namespace.

**Fix** — Decide the threat model explicitly. If untrusted: Node's permission model (`--permission --allow-fs-read`) or 

[Read the thread](https://github.com/edjafarov/kiagent-core/issues/49) · 2026-08-07 · open · 0 comments

### Architecture review: index, themes, and sequencing (58 findings)

Deep architecture review of the whole tree. Six agents each read one subsystem in parallel, briefed with the open issues in their area and asked for **net-new structural findings with file:line evidence**. 58 findings: 21 high, 27 medium, 10 low. Read-only — no files were changed.

This issue is the index and the connective tissue. Each high and medium finding is its own issue (#47-#92); the ten low-severity ones are collected in #93.

## The shape of it

Code quality is high, and highest where 

[Read the thread](https://github.com/edjafarov/kiagent-core/issues/46) · 2026-08-07 · open · 0 comments

The remaining reports are on [the project's issue tracker](https://github.com/edjafarov/kiagent-core/issues).