Skip to main content

​
Known defects

Three things are broken in the product itself rather than in your setup. They are listed here so you do not spend time debugging them, and each is described honestly rather than dressed up as intended behaviour. The third one contradicts the product’s own local-first promise, so treat it as a bug to be fixed rather than a rule to work around.

​
Installation

A shell alias is not visible to a subprocess, so an agent that shells out will not see it. Use the PATH shim instead:
Run pnpm install && pnpm build from the repository root. The bundle is produced by the CLI package’s build step, not by pnpm install.
Claude Code derives the slash command from the installed directory name, so the bundle must be at ~/.claude/skills/myrqen/ or <repo>/.claude/skills/myrqen/.
A missing convenience integration does not mean the scanner is broken — myrqen auto works from any agent with shell access.

​
Running a scan

This is a bug, not intended behaviour. The product’s stated promise is that scanning is local-first and never blocked by the cloud, and in this one path it is.It triggers when all three are true:
  1. the device is linked,
  2. the repository has no existing workspace binding, and
  3. the API is unreachable — which, since the CLI’s default endpoint https://api.myrqen.cc is not deployed, is the normal case today.
Binding a new repository calls GET /api/v1/workspaces at apps/cli/src/session/binding.ts:46, and that call has no error handling around it, so session start throws and exits 1 before any local report exists. Nothing is written; there is no partial result to recover.A repository that already has a binding is unaffected: describeExisting treats the stored binding as authoritative and wraps its metadata lookup in a try/catch.Until it is fixed, two workarounds:
--sync no alone does not avoid it: the binding is resolved before the sync question is even considered.
That is the honest outcome when the application was not running, or when no agent settled the static pass’s candidates. Static reading cannot observe a response.Start the application, then have the agent verify or refute each candidate:
See Findings.
The output names the reason. The usual causes:
  • an extra top-level field, including id — the schema is additionalProperties: false and the CLI assigns ids;
  • a secret value that survived redaction;
  • no evidence entries;
  • a length or enum constraint from the schema.
Fix it and resubmit.
A resubmission merges as corroboration only when the summary matches the original word for word. To confirm an existing candidate, use finding verify — never a resubmission.
The origin is quarantined. It appeared only in project content that also tried to instruct the scanner, and a human approving a target that injected text authored is not meaningful consent.If the origin is genuinely part of the project, put it in the project’s configuration. A new session will pick it up as an ordinary candidate. Do not work around the quarantine.
Working as designed. Choose a non-destructive validation that demonstrates the same property, or record the finding as strong_evidence and explain in the report why safe validation was not possible. See Authorization and safety.
All three of logout, workspace --set, and workspace --detach are confirmation-gated, and confirmations default to deny in a non-interactive shell — which is what an agent gives them. They print “Left unchanged”. Run them in a real terminal.
Not a problem. Docker is optional and is never a user-facing prerequisite. Myrqen reports reduced coverage — “Isolated runtime checks are unavailable on this machine; other checks still run” — and carries on. Force that behaviour with MYRQEN_ASSUME_NO_ISOLATION=1.

​
Linking and accounts

The credential was revoked in the app. Run myrqen link again.
Use a recovery code at /recover, together with a new password. Ten codes are shown once at signup and that is the only recovery path — no email is ever sent.
There is no other recovery path. Local scanning and local reports are unaffected, since neither needs an account.
Being first does not make you an administrator. The role is granted only to the address in PLATFORM_ADMIN_EMAIL, and only at signup: apps/web/lib/auth-service.ts computes isPlatformAdmin = configuredPlatformAdminEmail() === email and nothing else ever sets it. With the variable unset, the deployment has no administrator at all.So: set PLATFORM_ADMIN_EMAIL before signing up, then create that account. An account that already exists is not promoted by setting the variable afterwards.Some copy elsewhere in the repository says the first account in a fresh deployment becomes the platform administrator. That is not what the code does.

​
Syncing and sharing

It does not ask a question that cannot succeed. One of these is true:
  • the device is not linked;
  • the repository is not bound to a workspace;
  • the plan’s cloud-report quota is exhausted (quota_blocked);
  • --sync no was passed;
  • the shell is non-interactive, in which case cloud.state is decision_required and the agent is expected to ask you, then run myrqen session sync-decision yes|no.
myrqen status shows which.
The scan still runs and still writes a full local report. Quota windows are UTC-anchored: the day resets at 06:00 UTC, the week at Monday 06:00 UTC. details carries resetsAt, and myrqen status prints the exact instants.After the reset:
The report passed its retention window, so its body and stored object were deleted and its share links stopped working. Retention is 21 days on free, 180 on pro, 365 on team.Your local files under .myrqen/reports/ are untouched — reopen the HTML.
Plaintext slugs are not stored, only a hash, so an existing link cannot be re-listed. Create a new share and copy the URL this time.
Check the principal rules. A viewer with no matching rule gets the share’s default policy, and if that policy allows no findings they see a report with no findings. The dashboard’s share panel previews exactly what each recipient receives before you create the link.

​
Self-hosting

Copy .env.example to .env at the repository root and set it. In production the root .env is deliberately not loaded, so the variable must be a real environment variable.
Required under NODE_ENV=production. Share links and session-cookie security are both derived from it, so a localhost fallback would hand out links nobody can open and cookies without Secure.
The filesystem driver is refused under NODE_ENV=production, because report bodies would live on one container’s disk — lost on the next deploy and invisible to other replicas. Set OBJECT_STORAGE_DRIVER=s3, or OBJECT_STORAGE_ALLOW_EPHEMERAL=true for a throwaway production-mode run.
Move the old key to REPORT_ENCRYPTION_KEY_PREVIOUS, which accepts retired keys for reads. Without that, nothing encrypted under the old key can be decrypted.
The response names every dependency it probed — database, event bus, object storage, encryption keyring — with a detail for the failing one. Gate traffic on ready and container restarts on health, never the reverse.
TRUSTED_PROXY_HOPS is unset, so there is no trustworthy client address and every request shares one bucket. Set it to the number of proxies in front of the app — Railway and most single-proxy platforms need 1.Separately, without REDIS_URL counters are process-local, so N replicas allow N times each limit.
All four of POLAR_ACCESS_TOKEN, POLAR_ENVIRONMENT, POLAR_WEBHOOK_SECRET, and POLAR_PRODUCTS are required together. A half-configured payment path takes money and grants nothing, so it is refused outright.
Most often the demonstration patch is still applied. Revert it and restart the fixture:

​
Getting more detail

doctor reports capability, not alarm: info is a missing convenience, and attention is reserved for something that actually blocks the product.