Gotchas

Gotchas

Hard-won nuances for contributors. Read before large changes.

1. auth-backend/ is dead. Do not start it. Live governance is app/src/main/api/.

2. No Cloud Functions / no Blaze. Usage limits are cooperative. Rules cannot force clients to report usage.

3. app/.env is public. Build rejects secret-like keys. Provider OAuth secrets live in Firebase; user tokens in OS keystore.

4. Two TypeScript projects. Shared types only via ambient src/types/*.d.ts.

5. IPC triple must move together: api.d.ts + preload.ts + ipc.ts.

6. Chat streaming is event-based, not a single invoke round-trip.

7. Builtin skills default OFF; tools default ON unless disabled. Skill-attached tools can run even if globally disabled.

8. Google Calendar skill exists in code but connector is product-disabled (Google token endpoint wants a client secret). Outlook is the working OAuth example.

9. Risky tools need renderer confirm. Non-GET http_fetch escalates; generate_document always confirms.

10. Multi-agent soft-fail is subtle. After tools ran, don’t re-enter single-agent casually — side effects may already have happened (ipc.ts comments).

11. Project-coding disables multi-agent for that turn.

12. userData brand pin in main.ts — renaming the app display incorrectly can split profiles.

13. Chroma is optional at runtime. RAG soft-degrades; don’t assume vectors exist.

14. Stale comments may still mention Cloud Functions or NestJS connectors. Prefer firebase/README.md + current TS.

15. No MCP. Use tools/skills; don’t search for an MCP registry.

16. PDF skill/tool guides are slightly stale (NestJS, older tool lists, .js paths). This wiki + sources win.

17. Proxy ≠ full AnyLM agent. /v1 does not run tools/skills/RAG assembly like the desktop chat path.

18. Worker tool rounds (3) ≠ single-agent (15). Changing one doesn’t change the other automatically.

19. Shell tools: 15s timeout. Long builds need a different approach (external terminal / narrower tool).

20. Firestore id conventions (members = orgId__userId, etc.) are load-bearing for rules. Don’t “simplify” ids without rewriting rules.

21. Web .env.example: treat tokens as secrets; prefer empty placeholders.

22. Release tag must match app/package.json version or CI packaging will disagree with the tag.