Reported issues for KIAgent
Pod holds 21 of 27 problems reported by people outside the maintainer team. Issues filed by the project's own owners, members and collaborators are excluded entirely — a maintainer's release checklist is not a warning to a prospective user.
Back to KIAgent.
Most discussed
net capability reaches the auth-free loopback MCP server
High · ✅ verified · from the architecture review (#46) · src/main/platform · src/main/marketplace
Evidence — host-surfaces.ts:172–193 · core/mcp/server.ts:170–192, :249, PORT_CANDIDATES = [7421, 7423–7425]
Why it matters — Renders query and db decorative for anyone holding the one capability every connector needs.
Fix — Mint a per-client bearer token for the loopback listener at boot; or block private-IP destinations in net.fetch and make loopback a separately cons
Read the thread · 2026-08-07 · closed · 2 comments
Channel allowlist and handler registration are not compile-enforced, despite a comment claiming they are
From a multi-agent architecture review (2026-07-10). Severity: high · Category: api-design · Verification: partially-confirmed (adversarially checked against the code; the recommendation below is the verifier-corrected version).
Problem
ipc.ts:355-356 says the INVOKE_CHANNELS/PUSH_CHANNELS allowlists "must stay in sync with the interfaces above; the satisfies clauses enforce it at compile time" — but as const satisfies readonly InvokeChannel[] (ipc.ts:412, 420) only rejects u
Read the thread · 2026-07-10 · closed · 2 comments
Outbound: attachment support for draft_message / draft_reply
Current state
The outbound layer ships a single MCP tool, draft_reply — replies stay within the originating thread (Gmail: users.messages.send with threadId + In-Reply-To/References from stored RFC Message-IDs; SMTP: same headers). There is no way to start a new email, and drafts are text-only.
Spec: docs/superpowers/specs/2026-07-23-unified-outbound-design.md.
Request 1: compose-new email tool
Already in the spec's approved tool scope (§ Tool scope: "reply + compose-new; c
Read the thread · 2026-07-27 · open · 1 comment
OAuth client secret crosses into the untrusted extension child via auth.oauth() and session.credentials()
From a multi-agent architecture review (2026-07-10). Severity: high · Category: correctness · Verification: confirmed (adversarially checked against the code; the recommendation below is the verifier-corrected version).
Problem
contracts.ts:507-510 promises "the extension never sees a client secret," but the Google credentials blob embeds clientId/clientSecret in the vault by design (src/main/sources/gmail/oauth.ts:91-94,151-170, 'exactly what Credentials.clientId/clientSec
Read the thread · 2026-07-10 · open · 1 comment
The stated contract (connectors-authoring-guide.md) documents a deleted architecture
From a multi-agent architecture review (2026-07-10). Severity: high · Category: docs · Verification: confirmed (adversarially checked against the code; the recommendation below is the verifier-corrected version).
Problem
docs/connectors-authoring-guide.md — the document positioned as the connector-authoring contract — is 100% stale. It instructs authors to implement Connector/ConnectorInstance from src/main/connectors/types.ts (guide line 18), register in `src/main/connec
Read the thread · 2026-07-10 · closed · 1 comment
No error taxonomy: every source failure is 5 blind retries then generic 'error'; 'needsReauth' is unreachable dead state
From a multi-agent architecture review (2026-07-10). Severity: high · Category: api-design · Verification: partially-confirmed (adversarially checked against the code; the recommendation below is the verifier-corrected version).
Problem
The engine treats every exception from pull()/reconcile() identically: exponential backoff, SOURCE_MAX_RETRIES=5, then status 'error' (engine.ts:50-52, 625-653). SyncStatus declares 'needsReauth' (contracts.ts:87) but nothing in the entire main
Read the thread · 2026-07-10 · closed · 1 comment
Loopback MCP server has no auth — any local process can reach every tool, including outbound
Deferred out of #47 by an explicit scoping decision, and filed now so it stops being a comment in a closed thread. #47 blocked the extension host's route to this port; nothing else about the port changed.
What is there today
The loopback Streamable-HTTP MCP server has no authentication, by design. src/main/core/mcp/clients.ts:230 states the model outright:
const httpEntry = { type: 'http', url: opts.localUrl }; // no bearer — loopback bind IS the auth
`src/main/core/mcp/serv
Read the thread · 2026-08-07 · closed · 0 comments
Low-severity architecture review findings (10 items)
The ten low-severity findings from the architecture review (#46), collected here rather than as ten separate issues. None is urgent; each is small, specific, and independently fixable. Tick them off as they land.
Extension platform & marketplace
src/main/platform · src/main/marketplace
- Install commit is not crash-atomic
- Evidence — installer.ts:209–220 — rename data aside,
rmSyncdir, move staging, restore data - Why — A crash mid-sequence leaves no extension direct
- Evidence — installer.ts:209–220 — rename data aside,
Read the thread · 2026-08-07 · open · 0 comments
Most recent
The app's own log file grows unbounded
Medium · from the architecture review (#46) · .github · package.json · src/main/core/logs.ts
Evidence — logs.ts:35 — fs.appendFile with no size check, while mcp/activity.ts:61 has rotateIfOversized
Why it matters — An always-on indexer logs for months; logs:export then hands that entire file to a bug report. The rotation pattern already exists one directory away.
Fix — Apply the same size-capped rotation.
Read the thread · 2026-08-07 · open · 0 comments
digital_memory_info materializes 500 full documents on every call
Medium · from the architecture review (#46) · src/main/core/mcp · src/main/outbound
Evidence — digital-memory-info.ts:27, :72 · store.ts:565–570 (SELECT d.*) · instructions say "START by calling digital_memory_info"
Why it matters — Every conversation pays a fixed cost of 500 complete bodies across the bridge to derive type and language sets — the slowest first impression the product makes.
Fix — Three cheap aggregates, or cache keyed on max(changes.seq).
Read the thread · 2026-08-07 · open · 0 comments
No caps on batch arrays or payload sizes
Medium · from the architecture review (#46) · src/main/core/mcp · src/main/outbound
Evidence — get.ts:61–70 (ids unbounded) · query-sql.ts:50 (SELECT markdown … LIMIT 500 is legal) · search.ts:244–257 (queries unbounded)
Why it matters — A single call can return tens of MB through a desktop client's stdio pipe; thousands of ids become thousands of worker round trips.
Fix — Cap batch arrays with actionable errors, add max_chars with a truncated flag.
Read the thread · 2026-08-07 · open · 0 comments
The physical SQLite schema is a public API with no version or evolution story
Medium · from the architecture review (#46) · src/main/core/mcp · src/main/outbound
Evidence — tools/get-schema.ts + schema-doc.ts (whole physical layout published) · make-server.ts:24 (version hardcoded '0.1.0' at app 0.70.1)
Why it matters — Clients and users' saved prompts bind to table names; any rename is a silent breaking change with no detectable signal. The drift test keeps the doc honest but freezes the schema.
Fix — Publish stable SQL views as the documented su
Read the thread · 2026-08-07 · open · 0 comments
Models can create drafts but never discard them
Medium · from the architecture review (#46) · src/main/core/mcp · src/main/outbound
Evidence — outbox.ts:20 (OUTBOX_PENDING_CAP 20) · service.ts:291–295 ("create a new draft instead") · no discard tool exists
Why it matters — The instructed redraft-on-every-edit workflow burns cap slots; at 20 pending the account can't draft for up to 24h unless the user manually cancels each. Discard is the one outbound mutation that's inherently safe.
Fix — Add discard_draft — the CAS
Read the thread · 2026-08-07 · open · 0 comments
Chat mode lets any local process send email as the user
Medium · from the architecture review (#46) · src/main/core/mcp · src/main/outbound
Evidence — outbound/routes.ts:340–391 (/outbox/api, no auth beyond Host/Origin) · service.ts:656–704, :463 (default 30 sends/hour)
Why it matters — Once chat mode is enabled, curl suffices. The "user's consent observed in chat" invariant is enforced nowhere in code, and there is no UI signal at send time.
Fix — OS notification on every chat-mode send, a lower default cap, and bind `send_dra
Read the thread · 2026-08-07 · open · 0 comments
get_related returns raw internal rows — full bodies, no limit, different wire shape
High · from the architecture review (#46) · src/main/core/mcp · src/main/outbound
Evidence — tools/get-related.ts:35–37 (return query.children(id)) · store.ts:447–453 (unbounded SELECT *) · registry.ts:119 (stringified into one block)
Why it matters — Instructions tell models to expand every thread this way; a 200-message thread returns 200 complete bodies plus internal fields in camelCase, inconsistent with the snake_case contract search and get preserve.
Fix — Project
Read the thread · 2026-08-07 · open · 0 comments
query_sql is unbounded and runs synchronously on the Electron main thread
High · from the architecture review (#46) · src/main/core/mcp · src/main/outbound
Evidence — tools/query-sql.ts:47–50 · raw-sql.ts:46 (in-process handle) · main.ts:638 (startMcp runs in main)
Why it matters — The 500-row cap bounds output, not work. A recursive CTE freezes the entire main process — UI, IPC, every other MCP session — with no interrupt path, triggerable accidentally by any connected LLM.
Fix — Run off-thread in a killable worker with a wall-clock timeout (be
Read the thread · 2026-08-07 · open · 0 comments
Event bus is one global namespace shared by all extensions
Medium · from the architecture review (#46) · src/main/platform · src/main/marketplace
Evidence — host-surfaces.ts:26–44 (subs keyed by event name only; _from ignored), :250–262
Why it matters — Any extension with events can subscribe to and spoof any other's events — an eavesdropping surface between mutually untrusting authors.
Fix — Auto-namespace emissions as <extensionId>:<name>; require subscribers to name the publisher.
Read the thread · 2026-08-07 · open · 0 comments
No post-activation liveness supervision; callTool has no timeout
High · from the architecture review (#46) · src/main/platform · src/main/marketplace
Evidence — host-process.ts:224–251 (timeouts are handshake-only), :332–336 (unbounded) vs extension-platform.ts:401–408 (sender path is wrapped in 60s)
Why it matters — A hung tool call wedges the MCP request forever. The codebase's own comment explains why the sender path needed this; identical reasoning applies to tools and every source-proxy call.
Fix — Default per-call deadline in `cre
Read the thread · 2026-08-07 · open · 0 comments
Update integrity is skipped in exactly the case the pin exists for
High · from the architecture review (#46) · src/main/platform · src/main/marketplace
Evidence — installer.ts:155–169 (comparison requires prior.version === manifest.version) · :97 (any github: or https: ref accepted)
Why it matters — A new version re-pins whatever bytes arrive, from whatever ref, with no signature or publisher continuity check. Trust rests entirely on GitHub account control.
Fix — Pin the publisher (owner/repo) and refuse owner changes on update; mediu
Read the thread · 2026-08-07 · open · 0 comments
No sandbox — capabilities gate the RPC surface, not the extension's reach
High · from the architecture review (#46) · src/main/platform · src/main/marketplace
Evidence — extension-host-entry.ts:124 (createRequire) · transport.ts:116–119 (no permission flags) · :73–79 (inherits process.env)
Why it matters — A manifest declaring only query can read the SQLite file off disk and POST it anywhere without touching a gated namespace.
Fix — Decide the threat model explicitly. If untrusted: Node's permission model (--permission --allow-fs-read) or
Read the thread · 2026-08-07 · open · 0 comments
Architecture review: index, themes, and sequencing (58 findings)
Deep architecture review of the whole tree. Six agents each read one subsystem in parallel, briefed with the open issues in their area and asked for net-new structural findings with file:line evidence. 58 findings: 21 high, 27 medium, 10 low. Read-only — no files were changed.
This issue is the index and the connective tissue. Each high and medium finding is its own issue (#47-#92); the ten low-severity ones are collected in #93.
The shape of it
Code quality is high, and highest where
Read the thread · 2026-08-07 · open · 0 comments
The remaining reports are on the project's issue tracker.