Issues

todo/project (node) event-source Fanout: the store broadcast layer has zero subscribers in the running server → todo_upserted/requirement_upserted frames are never sent and open boards silently go stale

TYRMars/Jarvis#507 · opened

on Jul 22, 2026

workflow (node) definition.ts walkAgentSteps: assumes every non-agent step kind carries `steps` → an unknown/incomplete step kind from POST /v1/workflows throws TypeError as a 500 instead of a 400

TYRMars/Jarvis#506 · opened

on Jul 22, 2026

todo (node) todo.ts withTurnBudget: the per-turn todo.* mutation cap has no production call site → countMutation() is an unconditional free pass and MAX_MUTATIONS_PER_TURN is dead

TYRMars/Jarvis#505 · opened

on Jul 22, 2026

automation (node) task.ts recomputeNextRun: re-anchors with previousRun=undefined → PATCHing a completed `once` automation re-arms it and the runtime re-executes its prompt

TYRMars/Jarvis#504 · opened

on Jul 22, 2026

store (node) json-file.ts atomicWrite: fixed `<path>.tmp` shared by all writers of a target → concurrent writes to one id deterministically ENOENT on rename and the loser's turn is silently dropped

TYRMars/Jarvis#502 · opened

on Jul 22, 2026

store (node) json-file.ts JsonFileConversationStore.list: no shape guard or per-file try/catch → one foreign .json in the base dir throws TypeError and permanently 500s GET /v1/conversations

TYRMars/Jarvis#501 · opened

on Jul 22, 2026

store (node) types.ts ConversationStoreBase.save: overwrites the envelope with defaultMetadata() and the WS chat path uses it → every chat turn silently erases project_id and un-archives the conversation

TYRMars/Jarvis#500 · opened

on Jul 22, 2026

store (node) requirement-store.ts #projectDir: encodeId leaves `..` intact and it is joined as a directory component → a project_id of `..` writes requirement rows into the conversation dir and permanently 500s GET /v1/conversations

TYRMars/Jarvis#499 · opened

on Jul 22, 2026

jarvis-ios (swift) ChatViewModel.handle(.error): every WS error frame treated as turn-terminal, but the server uses it for non-terminal diagnostics → isStreaming/pendingApproval torn down mid-run

TYRMars/Jarvis#498 · opened

on Jul 22, 2026

jarvis-ios (swift) ChatSocket: task/continuation mutated from both the MainActor and the URLSession delegate queue with no isolation → over-release crash or a permanently-hung event stream on a lossy connection

TYRMars/Jarvis#497 · opened

on Jul 22, 2026

plugin (node) manager.ts #reattachOne: skills loop has no per-skill guard and runs before the MCP loop → one bad SKILL.md silently kills the plugin's MCP servers and sibling skills on restart

TYRMars/Jarvis#496 · opened

on Jul 22, 2026

core (node) agent.ts runStream: usage event stamped with the static config.model, not the routed model → under JARVIS_ROUTER_ENABLED all token usage is attributed and priced against the wrong model

TYRMars/Jarvis#495 · opened

on Jul 22, 2026

core (node) agent.ts isToolCallTurn: finish_reason "length" with a non-empty tool_calls array skips dispatch but still persists the message → conversation saved with unanswered tool_calls, every later turn/resume 400s permanently

TYRMars/Jarvis#494 · opened

on Jul 22, 2026

jarvis-desktop (electron) ServerManager.ensureServer: no already-running guard on the embedded branch → macOS dock-reactivate starts a second server and orphans the first (listener + MCP children + store handles)

TYRMars/Jarvis#493 · opened

on Jul 22, 2026

jarvis-ios (swift) ChatSocket/ChatViewModel: WS client still speaks the decommissioned Rust frame protocol (start_turn/configure/interrupt) → first message of every conversation is rejected and lost, and nothing is ever persisted

TYRMars/Jarvis#492 · opened

on Jul 22, 2026

server/jarvis-app (node): JARVIS_PERMISSION_MODE is display-only — every non-WS agent path calls createAgent() with no approver → approval-gated shell.exec/fs.write run unconditionally under `ask` (and /v1/permissions* is permanently 503)

TYRMars/Jarvis#491 · opened

on Jul 22, 2026

tools (node) memory-tools.ts mergeIndexLine/removeIndexLine: unanchored `](slug.md)` substring match → memory.write/delete of one slug clobbers an unrelated entry whose summary embeds a .md link (data loss)

TYRMars/Jarvis#486 · opened

on Jul 21, 2026

tools (node) http.ts isPrivateIp: bare host.startsWith("fc"/"fd"/"fe80") matches DNS hostnames not just IPv6 literals → http.fetch SSRF guard blocks legit public sites (fcbarcelona.com, fdj.fr, …)

TYRMars/Jarvis#485 · opened

on Jul 21, 2026

1

ddns (node) runtime.ts #tick: public-IP detection is IPv4-only but record_type "AAAA" is advertised in the schema → every AAAA update pushes an IPv4 into an AAAA record and fails

TYRMars/Jarvis#484 · opened

on Jul 21, 2026

1

ddns (node) upnp.ts/runtime.ts: UPnP port mapping added with a permanent lease (NewLeaseDuration 0) is never removed on shutdown → external port stays forwarded to the LAN host indefinitely after Jarvis exits

TYRMars/Jarvis#483 · opened

on Jul 21, 2026

1

jarvis-web (node) DesktopStartupOverlay.onConfigureProvider: writes the settings target then assigns an identical hash → click is a no-op while already on Settings, and the orphaned sessionStorage key hijacks the next Settings visit

TYRMars/Jarvis#479 · opened

on Jul 20, 2026

jarvis-web (node) Composer.onKeyDown: bare Tab unconditionally preventDefault’d and cycles the permission mode regardless of textarea content → keyboard focus trap plus silent permission-mode changes mid-typing

TYRMars/Jarvis#478 · opened

on Jul 20, 2026

jarvis-web (node) AppChatPane.ComposerUtilityButtons: docs button uses window.location.href = "/docs" instead of router navigation → full reload drops the WS/stream, and lands on chat (or a dead file:// page) in the desktop shell

TYRMars/Jarvis#477 · opened

on Jul 20, 2026

llm (node) responses.ts refreshIfUnchanged: api-key auth turns every 401 into a fixed “cannot refresh” error before status/body is read → real upstream 401 diagnostics discarded and the response body leaked

TYRMars/Jarvis#476 · opened

on Jul 20, 2026

llm (node) openai.ts StreamAccumulator.#finalise: tool calls with no streamed `id` dropped while finish_reason stays "tool_calls" → turn ends with an empty assistant message and the tool never runs (Kimi/Ollama-style backends)

TYRMars/Jarvis#475 · opened

on Jul 20, 2026

Navigation Menu

Repository navigation

Issues

todo/project (node) event-source Fanout: the store broadcast layer has zero subscribers in the running server → todo_upserted/requirement_upserted frames are never sent and open boards silently go stale

workflow (node) definition.ts walkAgentSteps: assumes every non-agent step kind carries `steps` → an unknown/incomplete step kind from POST /v1/workflows throws TypeError as a 500 instead of a 400

todo (node) todo.ts withTurnBudget: the per-turn todo.* mutation cap has no production call site → countMutation() is an unconditional free pass and MAX_MUTATIONS_PER_TURN is dead

automation (node) task.ts recomputeNextRun: re-anchors with previousRun=undefined → PATCHing a completed `once` automation re-arms it and the runtime re-executes its prompt

store (node) json-file.ts atomicWrite: fixed `<path>.tmp` shared by all writers of a target → concurrent writes to one id deterministically ENOENT on rename and the loser's turn is silently dropped

store (node) json-file.ts JsonFileConversationStore.list: no shape guard or per-file try/catch → one foreign .json in the base dir throws TypeError and permanently 500s GET /v1/conversations

store (node) types.ts ConversationStoreBase.save: overwrites the envelope with defaultMetadata() and the WS chat path uses it → every chat turn silently erases project_id and un-archives the conversation

store (node) requirement-store.ts #projectDir: encodeId leaves `..` intact and it is joined as a directory component → a project_id of `..` writes requirement rows into the conversation dir and permanently 500s GET /v1/conversations

jarvis-ios (swift) ChatViewModel.handle(.error): every WS error frame treated as turn-terminal, but the server uses it for non-terminal diagnostics → isStreaming/pendingApproval torn down mid-run

jarvis-ios (swift) ChatSocket: task/continuation mutated from both the MainActor and the URLSession delegate queue with no isolation → over-release crash or a permanently-hung event stream on a lossy connection

plugin (node) manager.ts #reattachOne: skills loop has no per-skill guard and runs before the MCP loop → one bad SKILL.md silently kills the plugin's MCP servers and sibling skills on restart

core (node) agent.ts runStream: usage event stamped with the static config.model, not the routed model → under JARVIS_ROUTER_ENABLED all token usage is attributed and priced against the wrong model

core (node) agent.ts isToolCallTurn: finish_reason "length" with a non-empty tool_calls array skips dispatch but still persists the message → conversation saved with unanswered tool_calls, every later turn/resume 400s permanently

jarvis-desktop (electron) ServerManager.ensureServer: no already-running guard on the embedded branch → macOS dock-reactivate starts a second server and orphans the first (listener + MCP children + store handles)

jarvis-ios (swift) ChatSocket/ChatViewModel: WS client still speaks the decommissioned Rust frame protocol (start_turn/configure/interrupt) → first message of every conversation is rejected and lost, and nothing is ever persisted

server/jarvis-app (node): JARVIS_PERMISSION_MODE is display-only — every non-WS agent path calls createAgent() with no approver → approval-gated shell.exec/fs.write run unconditionally under `ask` (and /v1/permissions* is permanently 503)

tools (node) memory-tools.ts mergeIndexLine/removeIndexLine: unanchored `](slug.md)` substring match → memory.write/delete of one slug clobbers an unrelated entry whose summary embeds a .md link (data loss)

tools (node) http.ts isPrivateIp: bare host.startsWith("fc"/"fd"/"fe80") matches DNS hostnames not just IPv6 literals → http.fetch SSRF guard blocks legit public sites (fcbarcelona.com, fdj.fr, …)

ddns (node) runtime.ts #tick: public-IP detection is IPv4-only but record_type "AAAA" is advertised in the schema → every AAAA update pushes an IPv4 into an AAAA record and fails

ddns (node) upnp.ts/runtime.ts: UPnP port mapping added with a permanent lease (NewLeaseDuration 0) is never removed on shutdown → external port stays forwarded to the LAN host indefinitely after Jarvis exits

jarvis-web (node) DesktopStartupOverlay.onConfigureProvider: writes the settings target then assigns an identical hash → click is a no-op while already on Settings, and the orphaned sessionStorage key hijacks the next Settings visit

jarvis-web (node) Composer.onKeyDown: bare Tab unconditionally preventDefault’d and cycles the permission mode regardless of textarea content → keyboard focus trap plus silent permission-mode changes mid-typing

jarvis-web (node) AppChatPane.ComposerUtilityButtons: docs button uses window.location.href = "/docs" instead of router navigation → full reload drops the WS/stream, and lands on chat (or a dead file:// page) in the desktop shell

llm (node) responses.ts refreshIfUnchanged: api-key auth turns every 401 into a fixed “cannot refresh” error before status/body is read → real upstream 401 diagnostics discarded and the response body leaked

llm (node) openai.ts StreamAccumulator.#finalise: tool calls with no streamed `id` dropped while finish_reason stays "tool_calls" → turn ends with an empty assistant message and the tool never runs (Kimi/Ollama-style backends)