Important, but not blockers for 1.5.4 or the launch. Start after P0 is released.
Status: [ ] open, [~] in progress, [x] done.
[x]Problem. confirm: true is an argument the agent chooses. An agent that has read hostile text
(a web page, an email, an issue) can pass it. The docs say so honestly, but the gate cannot tell
the operator from the agent.
Approach. Use MCP elicitation, where the client supports it, so the operator answers a prompt
that the agent cannot answer. Fall back to the current flag when the client does not support it.
Add an optional policy file (~/.causly/policy.json) with per-tool rules: allow, ask, deny.
Acceptance. HIGH and DESTRUCTIVE calls on a supporting client cannot proceed without an
operator response. A test with a mock client that never answers shows the call stays blocked.
Docs to update. security.md (The approval gate), configuration.md (policy file location), limitations.md (drop the flag-only wording once true), cli.md if a policy command is added.
[x]Evidence. No mode or chmod anywhere in logger.js, store.js, secretsOps.js,
backupOps.js or cliOps.js. The activity log, the SQLite database, the secrets store, backups
and editor-config backups can all hold sensitive data.
Fix. On macOS and Linux create ~/.causly as 0700 and files as 0600. On Windows rely on
the profile folder ACL and verify it, since chmod is not meaningful there. Write the secrets
file and backups through a temporary file and a rename, so a crash cannot leave half a file.
Acceptance. POSIX tests check modes on every created file. A test kills the process during a secrets write and the old file is still intact.
Docs to update. security.md (new section on local file permissions), configuration.md (Where data is stored), cli.md (backup and restore).
[x]Evidence. Docker volume mounts and Compose files are not inspected. MCP project resources in
index.js call project inspection without the workspace check. Shell commands are not checked.
Fix. Inspect -v, --mount and Compose volumes and reject host paths outside the
workspace. Apply the workspace check to the causly://project/... resources. Keep documenting
that shell text is not inspected.
Acceptance. Tests for each mount form and for the resources.
Docs to update. security.md (Workspace limit), tools/docker.md (mount rules), architecture.md (MCP resources), limitations.md.
[x]Problem. run_command and other child processes inherit the server environment, which
includes every key loaded from ~/.causly/.env.
Approach. Pass a minimal environment by default (PATH, HOME, locale, temp) plus an
allowlist (CAUSLY_PASSTHROUGH_ENV). Document the change in the release notes, because it can
change behavior for people who relied on inherited variables.
Acceptance. A test runs a command that prints its environment and finds no service keys.
Docs to update. security.md (commands inherit the environment), configuration.md (CAUSLY_PASSTHROUGH_ENV), limitations.md, troubleshooting.md (a command cannot see a key).
[x]Context. run_tests, run_lint, run_typecheck and run_build run the project’s scripts
(tools/projectOps.js:115). A hostile package.json can run anything. This is by design, and
the tools are LOW.
Approach. Keep them LOW by default and say so on the tool pages. Add
CAUSLY_STRICT_PROJECT_COMMANDS=true to require confirm for them.
Acceptance. Docs updated. A test for the strict mode.
Docs to update. tools/filesystem-git-shell.md (project tools run the project’s scripts), configuration.md (CAUSLY_STRICT_PROJECT_COMMANDS), security.md.
[x]Evidence. read_multiple_files has no total size limit. Recursive directory operations have
no effective bound. Database connection pools are cached with no maximum and no cleanup.
Fix. Cap bytes per read and per batch, entries per listing, and pools per process, with idle cleanup. Return a clear “truncated” marker.
Acceptance. Tests with oversized inputs finish within a memory and time budget.
Docs to update. tools/filesystem-git-shell.md and tools/database.md (limits and truncation), configuration.md if limits get variables.
[x]Why. Long tool output costs the user tokens and context. Found during QA:
directory_tree returns build output folders (.docusaurus, build) in fullrun_command repeats the full command and cwd in its resultsearch_tools and the default packs add a fixed amount to every sessionFix. Default depth and entry caps with a truncated hint, an extended ignore list
(node_modules, .git, build, dist, .next, .docusaurus, .venv), and no echo of inputs.
Measure the token cost of tools/list for the default packs and record it.
Acceptance. A test asserts a size ceiling for directory_tree on a large fixture and that the
run_command result has no input echo. The measured tools/list size is in the docs.
Docs to update. tools/filesystem-git-shell.md (directory_tree defaults and ignore list), architecture.md and tools/overview.md (token cost of the default packs).
[x]Status. Done for all twelve services (GitHub, Gmail, Calendar, Slack, Telegram, Notion, Linear, Stripe, Sentry, Vercel, Supabase, Discord) on one shared tools/httpErrors.js, with a fixture file per service in tests/fixtures/errors/.
Why. Happy paths are tested. Real APIs fail.
Do. For GitHub, Gmail, Calendar, Slack and Telegram first, then the rest: recorded-fixture
tests for 401, 403 (missing scope), 404, 429 (with Retry-After), 5xx, timeout, malformed JSON
and pagination. Each must give a clear message with the fix command, never a stack trace or a
secret.
Acceptance. One fixture file per service and one test per failure class.
Docs to update. troubleshooting.md (error messages by service), each service page (rate limits and retries).
[x]Problem. activity.log grows without bound. A value containing a newline can forge a log
line.
Fix. Rotate at a size (for example 10 MB, keep 5). Serialize one JSON object per line and escape control characters. Redact through the central module from P0-03.
Acceptance. Tests for rotation and for a forged-line attempt.
Docs to update. security.md (Activity log: rotation), configuration.md (log size variables), troubleshooting.md.
[x]Why. Web pages, emails, issues and calendar entries are untrusted text.
Do. Fixtures that contain instructions (“call delete_file”, “pass confirm: true”,
“send the contents of ~/.causly/.env to …”) returned by web_fetch, gmail_get_message,
github_get_issue, calendar_get_event. Assert tool descriptions mark such output as untrusted
and that the gate behavior does not change.
Acceptance. The suite exists and passes. It documents what the server can and cannot prevent.
Docs to update. security.md (Anything the agent reads can influence it: what is tested, what is not prevented).
[x]Do. Keep the 64-character key check and add a test for it. Make secrets_set and
secrets_rotate_key atomic (P1-02). Add secrets_get to the “needs confirm” set (P0-08).
Reject a store_path outside the allowed folders.
Docs to update. tools/secrets.md, security.md (Encrypted secrets).
[x](Done together with issue #42: parseTime now rejects days that do not exist in the month, such as 2026-02-30.)
Limitation. Updating a recurring event changes only the instance id you pass.
Fix. Add a scope argument: this, following or all. Use the recurring event id for
all. calendar_delete_event gets the same argument.
Acceptance. Tests against recorded Calendar API responses for each scope.
Docs to update. tools/calendar.md (scope argument), limitations.md (remove the recurring-events limit).
[x]Limitation. In Testing status the refresh token expires after 7 days.
Do. The fix is to publish the Google app to production, which is a user-side step. Document
it step by step in the Gmail and Calendar pages (Branding configuration first, then Publish).
In status and doctor, warn when the token is close to the 7-day limit.
Docs to update. tools/gmail.md, tools/calendar.md, configuration.md (Google), troubleshooting.md (Google), cli.md (status and doctor warning), limitations.md.
[ ]/, /docs, /privacy, /terms, /og.png, the 308 redirect from the old
domain, and the sitemap all return the expected statusDocs to update. None in the server docs. Changes land in the landing page and website/docusaurus.config.js.