pod
Other formats agents might prefer:
markdownjsonllms.txt

Agent? You probably want markdown or json, or Pod over MCP.

Reported issues for Trackly CLI

Pod holds 7 of 7 problems reported by people outside the maintainer team. Issues filed by the project's own owners, members and collaborators are excluded entirely — a maintainer's release checklist is not a warning to a prospective user.

Back to Trackly CLI.

Most discussed

[Analytics CLI-1] Forward MCP client name attribution

Part of https://github.com/trackly-app/close-ai/issues/1378

Goal

Forward bounded MCP client identity to the backend analytics envelope.

Scope

  • Capture an approved client_name from the MCP host/CLI boundary.
  • Forward it only on authenticated API calls governed by CA-4.
  • Avoid commands, arguments, prompts, and user content in analytics.

Acceptance criteria

  • Known clients map deterministically; unknown values normalize safely.
  • CLI, MCP, and mcp-hosted channels remain di

Read the thread · 2026-08-06 · open · 1 comment

Trackly Apply: verify clean public 0.8.1 installation

What to build

Verify the public Trackly Apply 0.8.1 / skill 4.2.1 distribution exactly as a new macOS user receives it after trackly-cli PR #80 lands.

This is an end-to-end release proof: npm and MCP Registry provenance, clean Codex/Claude installation, doctor compatibility, authenticated profile/resume readiness, and a non-submitting application smoke test against the production backend.

Acceptance criteria

  • trackly-cli@0.8.1 is available from npm with SLSA provenance.
  • [

Read the thread · 2026-07-25 · closed · 1 comment

MCP profile updates should require explicit confirmation for sensitive-storage revocation

Archived from Conductor workspace TracklyApp/yangon, .context/ce-code-review-pr-207.md residual follow-up.

Context:

  • iOS fixed the application-profile editor so destructive or backend-sensitive profile confirmations cannot be implied accidentally.
  • The shared MCP workflow still needs a parity check before destructive sensitive-storage revocation or confirmation-like profile changes.
  • This likely spans local trackly-cli MCP schemas/instructions and hosted MCP parity in close-ai; coordinate wi

Read the thread · 2026-07-18 · closed · 1 comment

Security: hono transitive vuln not patched for published-package consumers (overrides don't publish)

Problem

PR #51 added overrides: { "hono": "^4.12.25" } to fix the high-severity hono advisory (GHSA-xrhx-7g5j-rcj5 IP-restriction bypass + GHSA-3hrh-pfw6-9m5x cookie injection). This fixes the repo/CI install and the required npm audit check.

But overrides is NOT published (Codex P2 on PR #51): npm only applies overrides from the root project, and package-lock.json isn't in the published tarball. So consumers running npx trackly / installing trackly-cli as a dependen

Read the thread · 2026-06-20 · closed · 1 comment

Verify Trackly Agent Plugin marketplace approval and fresh Codex install

Why

The Trackly Agent Plugin marketplace package was still under external OpenAI review when the compatible-client launch work closed. The website correctly presents it as in review, but the approval and fresh-install verification must remain visible after the Conductor workspace is archived.

Trigger

When OpenAI approves or otherwise updates the marketplace submission.

Safe follow-up

  • Confirm the directory state is available before changing public copy.
  • From a fresh Codex/Chat

Read the thread · 2026-08-21 · open · 0 comments

Harden MCP_SCOPE_DEFINITIONS with exhaustive reference inventory

Context

The exact hosted contract verifier locks the MCP_SCOPE_DEFINITIONS initializer, derived supported-scope structures, function ASTs, whole-source digest, and merge provenance. It does not independently inventory every reference to MCP_SCOPE_DEFINITIONS.

This was explicitly dispositioned as non-blocking defense in depth during PR #102 and remains non-blocking after PR #106. Current shipped behavior and the OpenAI submission are not defective.

Trigger

Address during the next de

Read the thread · 2026-08-12 · open · 0 comments

Harden trackly mcp graceful shutdown (SIGTERM / stdin-close / EPIPE)

Context

trackly mcp is a long-lived process that talks to an AI client (Claude Code, Cursor, ChatGPT) over stdin/stdout. Its entire lifecycle handling today is (mcp/server.js:321):

async function startMcpServer() {
  const server = createServer();
  const transport = new StdioServerTransport();
  await server.connect(transport);   // connects, then just runs
  return server;
}

There is no explicit handling for the parent client going away — no SIGTERM handler, no `stdin

Read the thread · 2026-06-14 · closed · 0 comments

Most recent

The remaining reports are on the project's issue tracker.