# Reported issues for oss-autopilot

Pod holds 24 of 79 problems reported by people outside the maintainer team. Issues filed by the project's own owners, members and collaborators are excluded entirely — a maintainer's release checklist is not a warning to a prospective user.

Back to [oss-autopilot](/mcp/oss-autopilot).

## Most discussed

### feat: configurable per-repo extraction categories (extend beyond Code Style / Process / Architecture / Testing / Other)

## Summary

The `extract-learnings` MCP prompt produces a structured markdown document with five fixed categories: Code Style, Process, Architecture, Testing, Other. These five are baked into the prompt and produce uniform output across all repos.

This proposes making the category set extensible per repo — the user can declare additional or replacement categories for a specific repo, and the extraction prompt respects that taxonomy.

This is a real-but-bigger-scope change. The five defaults are

[Read the thread](https://github.com/costajohnt/oss-autopilot/issues/1284) · 2026-05-08 · closed · 1 comment

### fix: pr-compliance-checker references nonexistent `read` MCP/CLI; bundle fix with extract-to-core, guidelines integration, repo PR template lookup, and CI gate against future drift

## Summary

The `pr-compliance-checker` agent has two bugs and three improvements that share root causes. The bugs cause the agent to silently run on its slowest fallback code path. The improvements move it from "static scoring against generic best practices" to "scoring tuned to the target repo, using project data that already exists."

This is one issue because the fix surface overlaps. Resolving the broken `read` reference forces a touch on the agent's data-access layer, which is the same pla

[Read the thread](https://github.com/costajohnt/oss-autopilot/issues/1245) · 2026-05-07 · closed · 1 comment

### umbrella: 10 medium-priority audit findings (M1–M10)

## Summary

Umbrella for medium-priority findings from the 2026-04-28 audit. Each can be addressed in its own PR.

## Checklist

- [ ] **M1: 412-conflict merge path is last-write-wins for state.json** (\`gist-state-store.ts:405-429\`). After fetching the remote, the code re-applies all dirty cached files. Now that guidelines files are also dirty content, a concurrent maintainer update can be silently clobbered. Contradicts the optimistic-concurrency contract in \`state.ts:256-264\`. Fix: surface

[Read the thread](https://github.com/costajohnt/oss-autopilot/issues/1208) · 2026-05-04 · closed · 1 comment

### Add upper bound cap on search maxResults

## Problem

The `search [count]` CLI command validates that the count is a positive integer but imposes **no upper bound** (`cli-registry.ts` lines 121-127):

```typescript
const parsed = Number(count);
if (!Number.isFinite(parsed) || parsed < 1 || !Number.isInteger(parsed)) {
  throw new Error(`Invalid count "${count}". Must be a positive integer.`);
}
maxResults = parsed;  // No ceiling check
```

A user or MCP tool can request `maxResults=10000`. While GitHub caps individual search results at

[Read the thread](https://github.com/costajohnt/oss-autopilot/issues/553) · 2026-03-04 · closed · 1 comment

### Pin npx version in .mcp.json to prevent supply chain risk

## Problem

`.mcp.json` runs the MCP server via unpinned npx:

```json
{
  "mcpServers": {
    "oss-autopilot": {
      "command": "npx",
      "args": ["@oss-autopilot/mcp"]
    }
  }
}
```

Without a version pin, `npx` resolves to the **latest** published version when the package isn't locally cached. If the npm package were compromised (credential theft, rogue release), users would silently execute malicious code.

## Proposed Fix

Pin to the current version:

```json
"args": ["@oss-autopilot

[Read the thread](https://github.com/costajohnt/oss-autopilot/issues/551) · 2026-03-04 · closed · 1 comment

### Remove silent auto-pull in session-start.sh

## Problem

`hooks/session-start.sh` runs an unattended `git pull --ff-only` against the remote repository on every Claude Code session start (lines 13-17):

```bash
MARKETPLACE_DIR="${HOME}/.claude/plugins/marketplaces/oss-autopilot"
if [ -d "${MARKETPLACE_DIR}/.git" ]; then
  (cd "${MARKETPLACE_DIR}" && git pull --ff-only) >/dev/null 2>&1 || true
fi
```

This silently fetches and executes new code from the remote without:
- User confirmation
- Integrity verification (no hash/signature check)
-

[Read the thread](https://github.com/costajohnt/oss-autopilot/issues/550) · 2026-03-04 · closed · 1 comment

### Add README.md for packages/mcp-server

## Problem

`@oss-autopilot/mcp` is published to npm at v1.0.2, but the `packages/mcp-server/` directory has no `README.md`. The npm package page is blank — this is a trust red flag for potential users evaluating the package.

The extensive MCP surface documentation exists in `docs/plans/2026-02-28-mcp-server-design.md` but is not surfaced in a user-facing README.

## Expected

A `packages/mcp-server/README.md` that covers:
- What the MCP server provides (21 tools, 5 resources, 3 prompts)
- Inst

[Read the thread](https://github.com/costajohnt/oss-autopilot/issues/549) · 2026-03-04 · closed · 1 comment

### security: add SRI to CDN scripts and auth to MCP HTTP mode

## Description

Two lower-severity security items:

### 1. External scripts without Subresource Integrity (Low)
**File:** \`packages/core/src/commands/dashboard-templates.ts:22-27\`
Chart.js loaded from \`cdn.jsdelivr.net\` without \`integrity\` attribute. If the CDN is compromised, malicious JS could be injected.
**Fix:** Add \`integrity\` and \`crossorigin\` attributes to the Chart.js script tag.

### 2. MCP HTTP server has no authentication (Medium)
**File:** \`packages/mcp-server/src/index.t

[Read the thread](https://github.com/costajohnt/oss-autopilot/issues/528) · 2026-03-04 · closed · 1 comment

## Most recent

### Encode maintainer-review conventions into the contribution workflow

## Problem

The tool's PR-review-response workflow doesn't currently encode the maintainer-review patterns that repeatedly show up across contribution sessions. These are patterns an agent should apply automatically when drafting a fix or responding to review feedback, not something a human has to remember to paste into context each time.

## Patterns to encode

1. **Minimize public API surface.** When fixing a reported bug, prefer fixing the behavior inside existing public APIs over adding new 

[Read the thread](https://github.com/costajohnt/oss-autopilot/issues/1567) · 2026-07-11 · closed · 0 comments

### Fence PR/issue titles and fork ref names on MCP prompt and resource surfaces

Severity: low (titles are short; but the MCP host LLM never sees the agents' injection-awareness blocks, so the agent-side mitigation does not apply on these surfaces)

Unfenced title paths where the consumer is an arbitrary MCP host LLM:
- prompts.ts:76 (`PR: ${data.pr.title}` in respond-to-pr), :168 (`### ${b.prTitle}` in extract-learnings), :48 (triage injects JSON.stringify(digest) with raw openPRs[].title). Bodies in the same prompts ARE fenced.
- resources.ts:108,175: fenceFetchedPR wraps 

[Read the thread](https://github.com/costajohnt/oss-autopilot/issues/1455) · 2026-06-12 · closed · 0 comments

### Runtime --json schema validation binds for a minority of commands; move has a schema that is not wired

Severity: medium

`move` exports MoveOutputSchema and its contract test validates goldens against it, but the registry's executeAction call passes no schema argument (cli-registry.ts:1358-1366), so the runtime validation path can never fire for move.

Broader: state, vet, vet-list, track, comments, shelve, unshelve, dismiss, undismiss, stats, startup, and all 5 guidelines subcommands hit the unvalidated `outputJson(data)` branch with no exported Zod schema; of 15 *.contract.test.ts files, only 5

[Read the thread](https://github.com/costajohnt/oss-autopilot/issues/1453) · 2026-06-12 · closed · 0 comments

### mcp-server test files are never typechecked: the tests-tsconfig gate is core-only

Severity: medium (same failure class the core tsconfig.tests.json gate fixed: fixtures with missing required fields compile silently)

packages/mcp-server/tsconfig.json:18 excludes `**/*.test.ts`; the typecheck script is plain `tsc --noEmit` (core chains `tsc --noEmit -p tsconfig.tests.json`). eslint additionally applies disableTypeChecked to all test files (eslint.config.js:166-178), so no type-aware tooling sees the 8 mcp-server test files at all. Dashboard is fine (its tsconfig includes src/*

[Read the thread](https://github.com/costajohnt/oss-autopilot/issues/1450) · 2026-06-12 · closed · 0 comments

### MCP repair tools (config/setup/init/state-unlink) are bricked by hard gist-init errors

Severity: high (DA-verified)

`wrapTool` awaits `ensureGistInit()` before every tool body (packages/mcp-server/src/tools.ts:182). `ensureGistInit` (tools.ts:126-128) only soft-resolves `degraded`/`no-token`/`state-unreadable`; hard errors propagate. `ensureGistPersistence` → `getStateManagerAsync` rethrows `ConfigurationError` (state.ts:1076), and `GistPermissionError`/`GistCorruptError` both extend `ConfigurationError` (errors.ts:49,69; thrown at gist-state-store.ts:676,753). So the reject hits

[Read the thread](https://github.com/costajohnt/oss-autopilot/issues/1441) · 2026-06-12 · closed · 0 comments

### Gist mode: config set / setup / init mutations are never checkpointed and silently revert

Severity: high (DA-verified)

config.ts, setup.ts, and init.ts contain zero `checkpoint`/`maybeCheckpoint` calls (contrast move.ts:62, dismiss.ts:41, shelve.ts:51). `updateConfig` → `autoSave()`, and in gist mode `saveToDisk` writes only the local cache file. The CLI process exits immediately after, so the mutation is never pushed.

Bootstrap takes the Gist verbatim as source of truth (`fetchAndCache(gistId)`, gist-state-store.ts:223, 686-712 — no field-level merge, local cache read back only in

[Read the thread](https://github.com/costajohnt/oss-autopilot/issues/1440) · 2026-06-12 · closed · 0 comments

### MCP server never reloads state: one external CLI write bricks every MCP mutation via stale-mtime CAS

Severity: high (DA-verified)

`wrapTool` (packages/mcp-server/src/tools.ts:179-216) runs only `ensureGistInit()` then the tool body. No `reloadIfChanged`/`refreshFromGist` call exists anywhere in packages/mcp-server (grep). The only production reload sites are `save()`'s own `allowReloadAndLoseMutation` path and dashboard-server.ts (a different process).

Local mode (the default): a long-lived stdio MCP server holds `lastLoadedMtimeMs` from boot. Any CLI command in a terminal writes state.json a

[Read the thread](https://github.com/costajohnt/oss-autopilot/issues/1439) · 2026-06-12 · closed · 0 comments

### First-time Gist migration renames state.json, permanently dropping the migrating machine out of gist mode

Severity: critical (DA-verified, full static trace; not executed live)

`StateManager.createWithGist` (packages/core/src/core/state.ts:186-194): when `migrationResult.migrated`, it does `fs.renameSync(statePath, statePath + '.pre-gist-migration')`. In gist mode `save()` only ever writes `state-cache.json` (state.ts:327-342) and nothing ever recreates `state.json`.

`ensureGistPersistence` peeks `state.json` and returns `'local-mode'` on ENOENT (state.ts:1138). The surviving `~/.oss-autopilot/gis

[Read the thread](https://github.com/costajohnt/oss-autopilot/issues/1438) · 2026-06-12 · closed · 0 comments

### chore: verification-audit hardening batch — atomic list write, MCP verify-issue execution test, attentionBucket stamp test, freshShelved partition test, CLI display coverage

### Small hardening + test-gap items from the 2026-06-11 verification audit

1. **list-move-tier.ts uses bare \`fs.writeFileSync\`** on the curated list while sibling list-mark-done documents and implements tmp+rename for crash safety (and state-persistence has an atomic-write helper). Use the same atomic write.
2. **MCP \`verify-issue\` handler is never executed in tests** — tools-execution.test.ts mocks \`runVerifyIssue\` but no test calls the tool; a miswired \`wrapTool(runVet)\` would pass t

[Read the thread](https://github.com/costajohnt/oss-autopilot/issues/1421) · 2026-06-12 · closed · 0 comments

### security: lastMaintainerComment.body reaches agents unfenced and is missing from the documented exception list

### Problem

\`FetchedPR.lastMaintainerComment.body\` is a 200-char excerpt of the most recent non-user, non-bot comment (review-analysis.ts) — attacker-controllable on any public PR. It flows raw into agent-facing output via the \`daily\` MCP tool (\`digest.openPRs\`) and the \`oss://prs\` resource. The untrusted-content wiring (#1372/#1396) fences comment bodies in runComments / fetchPRCommentBundle / toDailyOutput's commentedIssues, but not this field, and workflows/reference.md's "NOT pre-fe

[Read the thread](https://github.com/costajohnt/oss-autopilot/issues/1420) · 2026-06-12 · closed · 0 comments

### bug: MCP gist init still silently degrades to local writes on transient failures — the #1368 retry path is dead code

### Problem

The #1368 fix replaced the pre-await boolean with a memoized promise that clears on rejection so the next tool call retries. But neither failure mode the fix's own comment cites ("one transient failure (token fetch, network) permanently skipped Gist init") ever rejects:

- `getGitHubTokenAsync` (packages/core/src/core/auth.ts) latches `tokenFetchAttempted = true` before the try, catches all errors, and returns `null`. `ensureGistPersistence(null)` is `if (!token) return` — it RESOLV

[Read the thread](https://github.com/costajohnt/oss-autopilot/issues/1415) · 2026-06-12 · closed · 0 comments

### test(flake): mcp-server HTTP transport tests collide with ephemeral ports (EADDRINUSE)

Observed on a PR matrix run (Node 22 ubuntu, coverage step): `index.test.ts > MCP server HTTP transport > GET /mcp returns 405` failed with `listen EADDRINUSE: 127.0.0.1:59382`. The suite's `randomPort()` returns `10000 + random(50000)` with no availability check, which overlaps the Linux ephemeral range (32768-60999), so a collision with any OS-assigned socket on a busy runner kills the spawned server.

Fix direction: have the spawn helper retry with a fresh port on an EADDRINUSE exit (bounded,

[Read the thread](https://github.com/costajohnt/oss-autopilot/issues/1402) · 2026-06-11 · closed · 0 comments

### feat(guidelines): add a 'guidelines list' subcommand backed by listGuidelinesRepos()

Surfaced while fixing #1376: the /oss-guidelines command needs to enumerate repos with stored guidelines, but no CLI path exists. `state --show --json` carries only persistence/gistId/lastRunAt, `guidelines view` requires a repo, and `StateManager.listGuidelinesRepos()` is consumed only by the MCP resources (`oss://repo/{owner}/{repo}/guidelines`). The command doc now enumerates via MCP resources with an ask-the-user fallback, which is awkward for the CLI story.

Proposal: `guidelines list --jso

[Read the thread](https://github.com/costajohnt/oss-autopilot/issues/1393) · 2026-06-11 · closed · 0 comments

### docs: broken CLI references in oss-guidelines.md, setup-oss.md, and workflows/reference.md

## What

Several plugin prompt files reference CLI subcommands or flags that do not exist in the registry, so the documented flows error as written. Verified against `packages/core/src/cli-registry.ts` and `packages/mcp-server/src/tools.ts`.

1. `commands/oss-guidelines.md:24` runs `cli.bundle.cjs guidelines list --json`. There is no `guidelines list` subcommand (only `view`, `store`, `reset`, `fetch-corpus`). The offered MCP fallback (`guidelines-get`) requires a `repo` argument and cannot enum

[Read the thread](https://github.com/costajohnt/oss-autopilot/issues/1376) · 2026-06-11 · closed · 0 comments

### test: agents-contract REGISTERED_MCP_TOOLS mirror is missing `features`

## What

The hand-mirrored `REGISTERED_MCP_TOOLS` set in `packages/core/src/agents-contract.test.ts` (~lines 39-69, 29 entries) is missing `features`, which is registered in `packages/mcp-server/src/tools.ts` (~line 190). The CI grep counts 30.

## Impact

Latent today (no agent currently references the `features` tool), but the moment any agent's frontmatter or body references it, the contract test falsely fails it as unregistered. The comment says the duplication avoids a cross-package import,

[Read the thread](https://github.com/costajohnt/oss-autopilot/issues/1374) · 2026-06-11 · closed · 0 comments

### security: wrapUntrustedContent fence is never called at runtime; injection defense is prompt-advisory only

## What

`wrapUntrustedContent` (`packages/core/src/core/untrusted-content.ts`), the escape-proof `<github-content>` fence with its own round-trip test and 100+ payload corpus (`prompt-injection-corpus.test.ts`), is never invoked in any runtime path. The only non-test references are the definition, the `core/index.ts` export barrel, and `.d.ts` output.

Meanwhile the actual data paths emit raw GitHub-authored text into agent-facing JSON:

- `packages/core/src/commands/comments.ts:134,139,145` (`

[Read the thread](https://github.com/costajohnt/oss-autopilot/issues/1372) · 2026-06-11 · closed · 0 comments

The remaining reports are on [the project's issue tracker](https://github.com/costajohnt/oss-autopilot/issues).