# Reported issues for witness

Pod holds 6 of 6 problems reported by people outside the maintainer team. Issues filed by the project's own owners, members and collaborators are excluded entirely — a maintainer's release checklist is not a warning to a prospective user.

Back to [witness](/mcp/witness).

## Most discussed

### OpenCode install on Windows (plugin spawns the bash shim; needs exec-form + %LOCALAPPDATA% like PR #9)

## Summary

`witness install claude` now works on Windows (PR #9: exec-form hooks, `%LOCALAPPDATA%` copy, PATH, embedded prompts). `witness install opencode` does **not** yet — it's still tied to the bash shim, which Windows has no guaranteed shell to run. This issue scopes the fix so it's ready to pick up.

Deferred deliberately: the OpenCode-on-Windows user population is currently ~0 (maintainer uses Claude Code; v0.1.0 had no downloads). Build when a real user or the OpenCode owner needs it.

[Read the thread](https://github.com/IngTian/witness/issues/10) · 2026-07-05 · closed · 4 comments

### Full-history distillation is slow (serial mining) + heavy CPU/memory; add parallel mining + one-shot backfill

## Problem

A user wanting "valid observations on day 1" must distill their whole backlog at once, and it's slow + resource-heavy. Root cause, measured:

- **Backfill cost is dominated by SERIAL LLM calls.** The mine loop (`internal/distill/worker.go:113`) is a plain nested `for session { for lens { mine() } }` with **zero parallelism**. Benchmarked on the CC path (this Bedrock account, representative ~3.2K-token session):
  - **Haiku 4.5: ~33s/session** · **Bedrock default (Opus-tier): ~57–85s/

[Read the thread](https://github.com/IngTian/witness/issues/22) · 2026-07-12 · closed · 3 comments

### security: harden the ingestion + MCP-serve path for UNTRUSTED input (defense-in-depth; deferred, feature-first)

Tracking issue for the security hardening witness needs **once #44 ingests untrusted third-party record streams** (library/service mode). Deliberately DEFERRED — building the feature first, security as a fast-follow. Filed so the research (below) isn't lost.

## The load-bearing truth
**Indirect prompt injection is UNSOLVED** — inherent to how LLMs work (Microsoft MSRC Jul-2025; OWASP LLM01:2025, both explicit). So every control here is **risk-reduction + impact-containment, never prevention.** 

[Read the thread](https://github.com/IngTian/witness/issues/98) · 2026-07-18 · closed · 1 comment

### test: strengthen MCP fake-store assertions from #73-C1 (get_profile content + record/delete/search coverage)

Two minor test-quality findings from the #96 (#73-C1) adversarial review. **Not defects** — the refactor is behavior-preserving (79/79 methods + every SQL query verbatim, verified) — just weak new tests worth tightening. ~10 lines.

Both in `internal/mcp/fakestore_test.go`:

1. **`get_profile` assertion is partially vacuous (minor).** `TestServerRunsAgainstFakeStore`'s only content check is `!ok || tc.Text == ""`, which ALSO passes on the server's not-found fallback branch (`server.go` returns a

[Read the thread](https://github.com/IngTian/witness/issues/97) · 2026-07-18 · closed · 1 comment

### Standalone Unix install (download-and-run, no checkout) via extract-in-place — leverage the #9 embed

## Summary

The embed work in #9 (`//go:embed prompts` + `bundle.Dir` exe-relative asset resolution) already makes a built witness binary **self-contained on every platform** — a bare binary + the model runs `doctor`, `capture`, `profile`, `mcp`, and distillation with no checkout, no shim, and no env vars (verified on macOS: `doctor`/`lens list` from an unrelated cwd with only the binary + a sibling `assets/`).

The one thing still missing on Unix: **`witness install claude` from a standalone bi

[Read the thread](https://github.com/IngTian/witness/issues/11) · 2026-07-05 · closed · 1 comment

### cleanup: tighten install/lens/npm command surface — install=mechanism, seed+interactivity separate (post-#44-slice1a)

## Summary

Follow-up cleanup to #99 (slice 1a, which makes `default` an ordinary lens). Now that per-lens runner+model (#75) exists and `default` is no longer special, the **install / lens / npm command surface has accreted redundant paths and a mechanism↔UX confusion**. This issue tightens the surface along one principle:

> **`install` = mechanism. Content-seeding + interactivity = separate concerns.**

Grounded in a researched read of how npm-distributed CLI *tools* (not libraries) handle se

[Read the thread](https://github.com/IngTian/witness/issues/102) · 2026-07-19 · closed · 0 comments

## Most recent

The remaining reports are on [the project's issue tracker](https://github.com/IngTian/witness/issues).