Current limitations

Taken directly from this repository's README.md.

Setup and hosting

• There is no hosted or managed coordination service yet. Your team runs a Supabase project (or a plain Postgres instance for local-only testing) and the service itself. This is the main setup cost.
• There is no production website deployed yet, so crosscode login has no default sign-in page to open and fails with WEB_URL_REQUIRED. Pass --web <url> or set CROSSCODE_WEB_URL, or use the headless --email/--password path, which needs neither.
• Billing is a placeholder: the plan and usage data model and its enforcement helpers exist, but no payment provider is wired up, so nothing is charged or actually limited.
• Workspace, membership, invite, and billing management is CLI- and API-only. There is no web UI for any of it, by decision — the website is landing, sign-up/sign-in, and docs.
• Deliberately not published to npm or any editor marketplace — the supported surface is the daemon + MCP server, run from a cloned checkout. Editors like VS Code and Cursor connect via MCP; there is no supported editor extension.

Operational hardening

• Production PostgreSQL role grants still need environment-specific deployment hardening. Retention is opt-in and admin-only (pnpm service:prune -- --older-than-days <n>); tables that cursor reconnect depends on are deliberately never pruned.
• Supabase refresh tokens go in the OS keychain when one is available (macOS Keychain, Linux Secret Service); otherwise, including on Windows, the mode-0600 Git-directory config file is used instead.

Analysis depth

• Binary files are shared base64-encoded and materialized byte-exactly, but any conflict involving one requires human approval, since hunk-level merge analysis is text-only.
• Renames are tracked as first-class rename changes; a rename that conflicts with pending work on either path, moves into or out of a critical path, or whose source has diverged locally always requires approval.
• Dependency-impact analysis for .ts/.tsx is a syntactic AST walk, not a type-checker-backed analysis.