Known limitations (v0.3.2)

1. An app that loads .env itself gets a reference, not a value. geslar run --env-file/-e resolves geslar:// references only into the child process's environment — it doesn't rewrite files on disk. If your app has its own dotenv-loading library, point it at the resolved environment via geslar run -- your-app (same pattern as op run), not at a .env file containing raw geslar:// references.
2. No offline mode. v1 requires network access for every command that touches the vault (no local cache). Fully local-only access is a later phase, not yet scoped.
3. Unattended CI still needs a human in the loop to provision it. Agent profiles (since v0.2.0) are scoped, machine-usable credentials — but creating one requires a human session with a fresh TOTP code (recovery codes aren't accepted), and the resulting token lives on whichever machine ran agent create. There's no org-owned service-account identity yet that a team could provision and rotate without a person's own 2FA in the loop — that's a later milestone.
4. A spawned child's environment variables are readable by other processes owned by the same OS user — this is standard OS behavior (the same is true of op run and any tool that sets child env vars), not something geslar run can change. If that's not an acceptable boundary for your threat model, isolate the process (container, dedicated CI runner user, etc.).
5. Opt-in, guarantee-lowering flags (--return-stdout-tail, --allow-secret-read) are planned but not implemented yet. When they land, they'll require explicit opt-in and get a distinct audit log entry — normal read/run never captures or echoes a resolved value except through the one designated channel (read's stdout, or -o <file>).
6. The KDF is PBKDF2-SHA256 at 600,000 iterations (current OWASP minimum). Migrating to Argon2id is a decision that spans the whole platform (browser extension, console, mobile, CLI) together, not something the CLI can change unilaterally — tracked as a future platform-wide item.
7. Alpine / musl-libc / busybox: neither install path works out of the box today. See Install for the verified specifics (busybox env rejects the CLI's shebang flag; the standalone binary is glibc-only and doesn't run under musl even with gcompat). Run geslar from a non-Alpine base if you're containerized.
8. Under an agent profile, the family/company/work semantic vault-address tokens don't resolve. GET /v1/orgs isn't on the agent bearer allowlist, so org type isn't available under agent context — addressing a granted vault directly by its own name is unaffected.
9. geslar agent list shows vault names from a local cache saved at agent create time, not from the server — GET /v1/agents intentionally reports only a count (scoped_vault_count), never names or ids. A profile created on a different machine still shows an accurate count, status, and expiry, just without vault names.