gokul/flex-led-wristband

TOOL_ISSUES.txt

CONFIRMED USER-FACING TOOL ISSUES — 22 OCTOBER 2026

The first two findings already have upstream reports. The third has a safe local reproduction; a targeted issue search did not find a matching report. No issue or PR was opened.

1. Segmented KiCad courtyards stop placement checking and autorouting.
Existing issue: https://github.com/tscircuit/core/issues/4772
Existing reproduction: https://github.com/tscircuit/core/pull/4792
Real input: KiCad JS102011SAQN switch footprint used by this board. `tsci convert` emitted 17 separate one/two-point courtyard outlines instead of the closed boundary represented by the connected F.CrtYd lines. Building the board failed with `DRC could not complete (placement): pcb_courtyard_outline_1: A ring must enclose a non-zero area`.
Board workaround: join the connected source vertices into one closed polygon. The courtyard repair did not alter pads or holes. Revision0.0.3 separately adjusts switch pad width to the manufacturer drawing. DRC stayed enabled. The corrected board routed and passed.
Versions: tscircuit 0.0.3003; core 0.0.2196; checks 0.0.262.

2. JLC search returns unrelated components and CLI import can import the wrong part.
Existing search issue: https://github.com/tscircuit/jlcsearch/issues/611
Related part resolution issue: https://github.com/tscircuit/parts-engine/issues/36
Reproduced using `tsci search --jlcpcb --json TTP223`: result C42401279 / HAOT10N65 / TO-220F, a different component from the requested touch IC. `tsci import --jlcpcb TTP223-BA6` imported HAOT10N65. The wrong imported file was excluded from the final package.
Direct API reproduction also returned the unrelated component:
https://jlcsearch.tscircuit.com/api/search?limit=10&q=TTP223
The same search sequence returned unrelated MOSFET/capacitor results for ATtiny402 and MCP73831.
Board workaround: explicit manufacturer part numbers and datasheet-based pin maps, known footprint geometry, no fuzzy supplier substitution. Verified local builds use --disable-parts-engine.
This confirms the service symptom, not a new diagnosis of its database internals.

Not reported as framework bugs: our initial footprint spelling, KiCad URL syntax, component placement, missing source attributes, sheet assignment, default manufacturing tolerances, and supplier rotation warnings. These were design/configuration or qualification matters.

3. An unhandled publishing timeout prints the Authorization bearer token.
Observed in @tscircuit/cli 0.1.2400 with Bun 1.3.14 when the final POST /package_releases/update timed out. Bun printed the TimeoutError.request object, including its Authorization header. The server had accepted ready_to_build even though the CLI exited 1.
Confirmed again with all network requests mocked and TSCIRCUIT_TOKEN=FAKE_PLACEHOLDER_TOKEN: the CLI output contains `authorization: Bearer FAKE_PLACEHOLDER_TOKEN`. No real token or registry write was used for that reproduction.
User impact: a normal failure log copied into a support ticket, CI log, or public issue can reveal a publishing credential. The actual credential is deliberately excluded from this report and package.
Suggested fix: catch the final publish/update error and render a bounded error message without the request or headers. Test with a fake token and simulated timeout; assert neither the token nor Authorization is emitted, and report that publication outcome requires checking. Review other uncaught registry paths as part of the same fix.
Do not publish raw logs containing credentials. Report credential-disclosure details through the project's private security channel where available. No public report has been filed here.