Skip to content

ROADMAP.md

Latest commit

 

History

History
63 lines (49 loc) · 3.58 KB

ROADMAP.md

File metadata and controls

63 lines (49 loc) · 3.58 KB
Raw

Roadmap

This tracks where txio is headed, built directly from the open issue backlog on Txio-labs/txio. Priorities are labeled priority:critical / priority:high / priority:medium / priority:low on each issue — that's the source of truth; this file is a summary, not a separate plan.

Shipped

  • Unified CLI across Sui, Ethereum, Solana, Aptos, and Soroban (cli/), with a ChainAdapter trait so a new chain is one file + a factory registration.
  • Axum/MongoDB backend (backend/api/) serving auth, collections, workspaces, and SuiNS name resolution to both the CLI and the dashboard.
  • Next.js dashboard (frontend/) — Postman-style request builder, visual PTB builder, collection runner, AI console.
  • One-command local stack via docker-compose up.

Now — security hardening (blocking further feature work)

These are priority:critical and touch auth/execution paths directly:

  • #1 Account takeover via unauthenticated user-management endpoints
  • #2 Unauthenticated remote command execution via /terminal/execute

Next — high-priority fixes

  • #3 Registration doesn't reject duplicate emails
  • #4 OTP flow lacks rate limiting / brute-force protection
  • #5 AI chat proxy is unauthenticated and unthrottled (cost abuse)
  • #10 SSRF via user-controlled rpc_url on saved request execution
  • #11 JWT stored in localStorage, leaked in OAuth redirect URL
  • #18 CI never compiles or tests the Rust backend/CLI
  • #29 CLI is a fat client requiring DB creds; db subcommands are unauthenticated admin

Later — medium-priority hardening and correctness

CORS, container hardening, config/DB consistency, and a handful of stubbed features (ENS resolution, CLI profile/wallet/console commands) that are advertised but not implemented yet. Full list: issues #6, #7, #9, #12–#17, #19–#22, #25, #27.

Good first issues

Smaller, self-contained, and a good way to make a first contribution: #8 (wrong repo name in README/Cargo.toml), #23 (inconsistent network enums), #24 (lossy as f64 balance formatting), #26 (backend container runs as root), #28 (deprecated/duplicate Sui SDKs in frontend), #30 (OTP records never expire — add TTL index).

Exploratory

  • Finish the Electron desktop client (desktop/) to parity with the web dashboard.
  • Expand name resolution beyond .sui (ENS for .eth, equivalents for Aptos/Soroban).
  • Reconcile the AI console between the documented Groq backend and the Gemini-based flow described in the frontend docs.