All issues

Search results

server/scan: theokit dev parses every route file with the TypeScript AST twice per request — the route scanner did not get the mtime cache the agent scanner got

enhancementNew feature or requestNew feature or request

Status: Open.

#417 In usetheokit/theokit;

· usetheodev opened on Aug 21, 2026

cli/generate: theo generate resource scaffolds five DB-backed CRUD methods as .policy('public'), so the new route-policy gate passes on a table open to the internet

bugSomething isn't workingSomething isn't working

Status: Open.

#416 In usetheokit/theokit;

· usetheodev opened on Aug 21, 2026

server/agent: createAgentSubjectResolver documents a MUST no caller can honour — createContext receives an IncomingMessage the plugin bracket already drained

documentationImprovements or additions to documentationImprovements or additions to documentation

Status: Open.

#415 In usetheokit/theokit;

· usetheodev opened on Aug 21, 2026

agents/bridge: after a denied HITL approval, the next call of the same tool is suppressed on the wire and its result is emitted under the denied approval's id

bugSomething isn't workingSomething isn't working

Status: Open.

#414 In usetheokit/theokit;

· usetheodev opened on Aug 21, 2026

release.yml: publishing has been failing with E404 since 2026-08-20; theokit is stuck at 0.48.14 on npm

Status: Open.

#413 In usetheokit/theokit;

· usetheodev opened on Aug 21, 2026

adapters: the HTML document is served by the platform's static host on 4 targets, so it carries none of the security headers the API responses now carry

Status: Open.

#412 In usetheokit/theokit;

· usetheodev opened on Aug 21, 2026

adapters/vercel: the emitted function is a SyntaxError — every Vercel deploy since #382 ships an API that cannot load

Status: Open.

#411 In usetheokit/theokit;

· usetheodev opened on Aug 21, 2026

adapters: the six generated entries build executeRoute's context from 8 of 12 fields, so csrf mode, disallowed, plugins, serialization and trace context silently revert to defaults on every deploy target

Status: Open.

#410 In usetheokit/theokit;

· usetheodev opened on Aug 21, 2026

config: security.cors is read only by the dev server — a deployed app silently serves no CORS headers on any of the 7 production targets

Status: Open.

#409 In usetheokit/theokit;

· usetheodev opened on Aug 21, 2026

create-theokit: the scaffold's .env.example documents LLM_MODEL, which nothing in the framework reads

bugSomething isn't workingSomething isn't working

Status: Open.

#408 In usetheokit/theokit;

· usetheodev opened on Aug 20, 2026

server/agent: a local model cannot run — the provider registry has no keyless entry, so ollama/* demands an unrelated cloud key and the error names the wrong action

bugSomething isn't workingSomething isn't working

Status: Open.

#407 In usetheokit/theokit;

· usetheodev opened on Aug 20, 2026

observability: the span attribute 'agent' is the module's absolute filesystem path on one route and a quoted label on another, so grouping breaks and the server's paths reach the telemetry backend

bugSomething isn't workingSomething isn't working

Status: Open.

#406 In usetheokit/theokit;

· usetheodev opened on Aug 20, 2026