Issues

CLI SESSION_SCANNER re-reads entire session JSONL files every 3s → sustained high CPU in long-running sessions

#1841

· OutmanSay opened

on Sep 24, 2026

support opus5.5

#1838

· aicodex opened

on Sep 23, 2026

PRIVACY.md does not match the code: push content, analytics linkability, and the missing account-deletion path

#1833

· ethicnology-agent opened

on Sep 23, 2026

App: a mermaid code fence escapes its inline <script> in the mobile WebView; session file RPCs follow symlinks out of the workspace

#1832

· ethicnology-agent opened

on Sep 23, 2026

Server: bearer tokens never expire and revocation is a no-op; RPC method rooms are not bound to the socket's scope

#1831

· ethicnology-agent opened

on Sep 23, 2026

CLI: the workstation-side controls are weaker than they look — sandbox disables approval, the control server authenticates no peer, and access.key is world-readable

#1830

· ethicnology-agent opened

on Sep 23, 2026

Pairing: the pairing public key is treated as an authenticator, so anyone who sees the QR gets a permanent account token

#1829

· ethicnology-agent opened

on Sep 23, 2026

Claude path: tool results never reach the app (schema drops `result`, mapper never sets it)

#1823

· ByebyDoggy opened

on Sep 20, 2026

Group Tool Calls never groups tool calls: the setting collapses finished turns, and skips turns that end without an agent-text

#1822

· tieo opened

on Sep 20, 2026

CLI: image attachments are dropped when their message triggers a query restart

#1821

· chaehyun2 opened

on Sep 20, 2026

CLI: queued messages with different permission modes all run under the first one

#1820

· chaehyun2 opened

on Sep 20, 2026

CLI: picking Default can never leave a bypassing session

#1819

· chaehyun2 opened

on Sep 20, 2026

Navigation Menu

All issues

CLI SESSION_SCANNER re-reads entire session JSONL files every 3s → sustained high CPU in long-running sessions

support opus5.5

PRIVACY.md does not match the code: push content, analytics linkability, and the missing account-deletion path

App: a mermaid code fence escapes its inline <script> in the mobile WebView; session file RPCs follow symlinks out of the workspace

Server: bearer tokens never expire and revocation is a no-op; RPC method rooms are not bound to the socket's scope

CLI: the workstation-side controls are weaker than they look — sandbox disables approval, the control server authenticates no peer, and access.key is world-readable

Pairing: the pairing public key is treated as an authenticator, so anyone who sees the QR gets a permanent account token

Claude path: tool results never reach the app (schema drops `result`, mapper never sets it)

Group Tool Calls never groups tool calls: the setting collapses finished turns, and skips turns that end without an agent-text

CLI: image attachments are dropped when their message triggers a query restart

CLI: queued messages with different permission modes all run under the first one

CLI: picking Default can never leave a bypassing session

Search results