Known Limitations & Roadmap
Platform support
| Platform | Status |
|---|---|
| Linux x64 | ✓ full support, prebuilt binaries |
| macOS x64 / arm64 | ✓ full support, prebuilt binaries |
| Windows x64 | ✓ full support, prebuilt binary + Scoop/Chocolatey/winget |
| Android arm64 (Termux) | ✗ broken on main since v2.2.0 — the V8 migration dropped rusty_v8 Android binaries. Workaround: the android-pre-v8 branch, pinned to the last pre-V8/QuickJS commit (see ANDROID_FALLBACK_HANDOFF.md on that branch) |
HTTP layer
RUDY detection (minBodyRateBps + bodyTimeoutMs) and adaptive auto-block
escalation (blockEscalationFactor up to maxBlockDurationSecs, reset
after strikeDecaySecs) are implemented — see
HTTP Performance for the mechanics. The shipped
default is still a fixed base of 100 req/s and 50 connections per source
IP; adaptivity adjusts the block penalty for repeat offenders, not the
per-IP token-bucket rate itself, unless adaptiveRateLimit is explicitly
enabled. Connection tracking is per source IP; trustedProxies opts a
reverse proxy in to X-Forwarded-For trust — an untrusted/unconfigured
proxy still collapses all clients onto its own IP for limiting purposes.
Full audit is not automatic on install
A malware scan already gates every downloaded tarball automatically during
3va install (same engine as 3va audit, aborts on high-severity
findings). The full 3va audit — OSV/CVE scan, and secrets detection via
--secrets — only runs when you explicitly call it. Run it yourself after
installing new dependencies.
Supply-chain detection gaps
npm provenance verification checks the Sigstore DSSE signature and in-toto
subject of registry attestations during install (opt-in strict mode:
--require-provenance), but does not yet validate the Fulcio certificate
chain to its root or Rekor inclusion proofs. Dependency-confusion
protection, typosquatting detection, tarball integrity (SHA-256/512), and
lifecycle-script blocking are implemented — see
Package Manager.
Bundler
--source-map and --split are not implemented for the real multi-file
bundling path (3va bundle) — only for a legacy single-file path reachable
via the library API, not the CLI. Tree shaking is not yet applied to the
multi-file graph either.
Dev server HMR
Full-page reload only, not granular per-module hot replacement.
package.json permissions section
3va permissions suggest/learn don’t yet write directly into
package.json — planned, but manual editing is required today.
Post-quantum TLS
Real in-handshake hybrid PQ-TLS (RFC 10024) covers one client code path,
tls.pqConnect(). There is no PQ-TLS server (3va has no TLS server
termination at all), and wss:///gRPC TLS remain classical. See
Post-Quantum Cryptography in the FAQ.
Node.js API compatibility
Self-reported estimates, not measured against an exhaustive conformance suite — directional, not exact.
| Module | Compatibility | Notes |
|---|---|---|
buffer, events, url, querystring | 100% | Complete |
process | 99% | Real memoryUsage/cpuUsage on Linux; complete EventEmitter |
fs | 98% | Complete FD API, opendir, mkdtemp; real watch via inotify (notify crate) |
path | 99% | relative, normalize, posix, win32 correct; missing real matchesGlob |
os | 99% | hostname, totalmem, freemem, uptime, real cpus(), networkInterfaces() |
zlib | 98% | Async + sync + real Transform streams; real brotli (brotli crate) |
http | 99% | Complete |
crypto | 97% | Modern algorithms, createSign/Verify, generateKeyPair, DiffieHellman; missing ECDH deriveBits/deriveKey and classic createECDH() |
child_process | 95% | Real exec/spawn/execSync/spawnSync; stdin piping |
https | 95% | Partial TLS |
net | 95% | Partial Unix sockets |
util | 95% | util.types with 30+ methods; missing parseArgs, styleText |
stream | 92% | Streams2 with real backpressure (highWaterMark, drain) |
Automatic polyfills: fetch, AbortController, TextEncoder, Performance.
Some crypto algorithms require an explicit permission flag.
Compatibility flags like --compat / --preset=node and breaking-change
markers like --legacy-security described in older planning docs were never
implemented — they don’t exist in the CLI. For the real breaking-change
history, see the repository’s docs/CHANGELOG.md; 3va codemod --from=1 --to=2 is a real, implemented migration command.
Test suite size
As of 2026-07-13, the workspace has 1,256 tests (unit + integration + doc),
0 failures — this count drifts on every PR, verify with
cargo test --workspace against current main before citing it elsewhere.