current limitations

what crosscode deliberately leaves out, and where its edges are.

deliberate boundaries

• identity is github-only. verifying that an invitee can read the repository is something only github can answer, so invite redemption needs a github token to check repo access with.
• crosscode never touches your working tree around a commit. if a teammate pushes work you were both holding uncommitted, git can stop your pull with "your local changes would be overwritten by merge" even when the content is byte-identical. crosscode tells your agent rather than checking files out for you, and the agent can clear the way itself.

privacy and hosting

• there is no end-to-end encryption. files are encrypted in transit and at rest under keys the service manages, so someone with production access could read the files you sync. the privacy page lists exactly what is stored. e2e was built once and removed: it cost a device-pairing ceremony, a keyring, rotation, and recovery paths, for a product whose durable artifact is a git repository you already have.
• hosted only. there is no supported self-hosted deployment of the coordination service. the software is mit licensed, so you may run your own, but it is not a supported configuration.
• the hosted service is free. there is no billing, no payment provider, and nothing chargeable.
• workspaces, invites, and projects are cli and api only. there is no web app for syncing and there will not be one. this site is a landing page, sign-in, and docs.
• deliberately no editor extension. mcp is the only integration contract, so editors connect the same way agents do.

behaviour worth knowing

• three-way convergence is proven for three peers, in a unit test over the merge engine and again with three real daemons, watchers, sockets, and git.
• under sustained typing, a hot file defers up to 20 times before the incoming change is written anyway. the user's bytes are backed up to refs/crosscode/backup first, so nothing is lost.
• binaries are never merged, so concurrent binary edits are always a conflict.
• a file with an unsaved editor buffer, or one an agent is part-way through editing, is protected by the ten-second quiet rule: nothing is written to a path you touched that recently.
• untracked files are never sent, and the denylist drops credential-shaped paths before capture rather than filtering later, so secrets stay out of sync.