Roadmap & Known Issues
Current source-verified technical debt, known issues, and planned work.
This page documents current technical debt that is still visible in main.
Historical plans and removed experiments are not active roadmap items.
Known issues
Build OOM on next build
The next build bundling step sometimes exceeds the available memory budget on CI-grade machines. This is a pre-existing infrastructure issue, not related to any specific feature. Workaround: run NODE_OPTIONS=--max-old-space-size=4096 next build locally.
Status: Parked — needs infra fix before CI/CD pipeline can be automated.
OAuth discovery and client compatibility
OAuth metadata is served by App Router handlers using Better Auth OAuth
Provider helpers. The production issuer and MCP resource are intentionally
canonicalized to https://sheetbase.flonest.app.
Status: Working in the internal beta. Continue compatibility testing against supported MCP clients under Issue #95.
Proactive token refresh adds latency
lib/mcp-google.ts refreshes the Google OAuth token on every tool call if the accessTokenExpiresAt is within 5 minutes of expiry. This is correctness-first but adds an extra DB write + Google token endpoint call on every invocation near token expiry.
Status: Known tradeoff. Lazy refresh (let Sheets API return 401, then refresh) would reduce latency but add a retry round-trip. Not yet changed.
Search is exact-match only
search_rows works for fast existence checks and deduplication across tested
tables of roughly 1,000 rows by 17 columns. It supports exact strings, spaces,
slashes, misses, and multiple matches, but not fuzzy or contains matching.
Status: Use the read/analyze flow for dirty data until fuzzy search is designed as a separate feature.
Two pg.Pool instances
The codebase has two pg.Pool constructions — one in lib/db.ts (used by MCP
tools and schema cache) and one inside lib/auth.ts (used by better-auth).
@supabase/ssr uses the Supabase HTTP client; it does not create a Postgres
pool.
Status: Consolidation is the next planned refactor. Impact: unnecessary connection slots consumed in Supabase.
Planned work
Rate limiting
Rate limiting is enabled in lib/auth.ts: Better Auth uses the database-backed
rateLimit model, OAuth Provider endpoints have explicit limits, and API keys
allow 120 requests per minute.
Status: Enabled. Founder-preview traffic and logs should inform future tuning.
Apps Script runner removal
The Apps Script runner was removed from the MCP tool surface in favor of Google
Sheets REST batchUpdate and focused structural tools. getGoogleClients()
returns Sheets and Drive clients only.
Status: Removed. Do not plan HMAC rotation or Apps Script exposure unless a new GitHub issue explicitly reintroduces that architecture.
pg.Pool consolidation
Merge the two pg.Pool instances into a single shared pool exported from
lib/db.ts.
Target: Next refactor pass.
Security notes
These are not vulnerabilities — they are acknowledged constraints:
| Item | Status |
|---|---|
| Better Auth and API-key rate limits | Enabled; tune from founder-preview evidence |
| Apps Script execution | Removed from the MCP surface |
debug_auth tool was previously exposed | Removed |
Architecture constraints (by design)
These are deliberate decisions, not bugs:
| Constraint | Why |
|---|---|
transform_range never uses cache | Stale data + write-back = data corruption. Intentional. |
valueInputOption: RAW on transform_range writes | Prevents SQL output strings starting with = from being evaluated as formulas |
maxDuration: 60 on the transport route | Vercel serverless function limit. Long SQL queries or large sheet fetches may time out on very large datasets |
| Issue #84 automatic internal-beta release | In progress — every approved main merge uses one guarded GitHub Actions publisher |
ConsoleSpanExporter for OTel | Stdout-only traces for agent log visibility. No OTLP HTTP endpoint configured yet |