All issues

Search results

allow_private_destination should not be a dataflow-writable port

Status: Open.

#830 In workglow-dev/libs;

· sroussey opened on Aug 17, 2026

WebhookTrigger: the one trigger kind #237 named that @workglow/triggers did not ship

Status: Open.

#826 In workglow-dev/libs;

· sroussey opened on Aug 17, 2026

FileGrepTask: give the filesystem surface a distinct path input port instead of overloading url

Status: Open.

#825 In workglow-dev/libs;

· sroussey opened on Aug 17, 2026

context.own() lets an owned child exceed its parent's entitlement declaration

Status: Open.

#824 In workglow-dev/libs;

· sroussey opened on Aug 17, 2026

FileLoaderTask.server reads an arbitrary filesystem path with no root, no realpath and no entitlement

Status: Open.

#823 In workglow-dev/libs;

· sroussey opened on Aug 17, 2026

FsFolderTabularStorage.putBulk races on duplicate primary keys, so last-write-wins is not honored

Status: Open.

#809 In workglow-dev/libs;

· sroussey opened on Aug 15, 2026

Eight pre-existing findings from a review sweep (none branch-caused)

Status: Open.

#807 In workglow-dev/libs;

· sroussey opened on Aug 15, 2026

Queued fetch cannot stream bytes from an out-of-process worker

Status: Open.

#806 In workglow-dev/libs;

· sroussey opened on Aug 15, 2026

TurboQuant's packed codec has no IVectorStorage path — no backend can accept a TurboQuantizeResult

Status: Open.

#798 In workglow-dev/libs;

· sroussey opened on Aug 15, 2026

VectorQuantizeTask's linear int8 path discards three of its eight bits (divides by ‖v‖₂, not max|v|)

Status: Open.

#796 In workglow-dev/libs;

· sroussey opened on Aug 15, 2026

SafeFetch's DNS-rebinding connection pin is a silent no-op under Bun

Status: Open.

#789 In workglow-dev/libs;

· sroussey opened on Aug 15, 2026

Connection-scoped multi-repo transactions: let sibling storages join one BEGIN instead of throwing ConnectionReentryError

Status: Open.

#708 In workglow-dev/libs;

· sroussey opened on Aug 6, 2026