pkg/ingress/kube/gateway/istio/conversion.go (10 lines):
	- line 196: // TODO: implement rewrite, timeout, mirror, corspolicy, retries
	- line 662: // TODO: check if the service reference is valid
	- line 692: // TODO: the spec actually has a label match, not a string match. That is, *.com does not match *.apple.com
	- line 954: // We don't have a great way to do it. TODO: add a fault injection API for TCP?
	- line 978: // We don't have a great way to do it. TODO: add a fault injection API for TCP?
	- line 1176: // TODO: implement ReferencePolicy for cross namespace
	- line 1736: // TODO: we lose address if servers is empty due to an error
	- line 1780: // TODO: this only checks Service ready, we should also check Deployment ready?
	- line 1791: // TODO: should we always report both?
	- line 1894: // TODO: For now we are using Addresses. There has been some discussion of allowing inline


pkg/ingress/mcp/generator.go (7 lines):
	- line 72: // TODO: delta implement
	- line 90: // TODO: delta implement
	- line 108: // TODO: delta implement
	- line 126: // TODO: delta implement
	- line 144: // TODO: delta implement
	- line 162: // TODO: delta implement
	- line 179: // TODO: delta implement


pkg/ingress/config/ingress_config.go (3 lines):
	- line 664: // TODO Support other envoy filters
	- line 1142: // TODO: get resource name from config
	- line 1223: // TODO: get resource name from config


pkg/cert/certmgr.go (2 lines):
	- line 129: // TODO before sync email, maybe need to clean up cache and account
	- line 204: //TODO implement clean up domains


hgctl/pkg/helm/tpath/tree.go (2 lines):
	- line 83: // TODO: The case of deleting a list.list.node element is not currently supported.
	- line 388: // TODO `map[interface{}]interface{}` is used by tests in operator/cmd/mesh, we should add our own tests


plugins/wasm-go/extensions/ai-proxy/provider/provider.go (2 lines):
	- line 43: // TODO: 以下是一些非标准的API名称，需要进一步确认是否支持
	- line 342: // TODO: validate the domain, if not valid, set to default


hgctl/pkg/manifests/istiobase/templates/clusterrole.yaml (2 lines):
	- line 33: # TODO: should be on just */status but wildcard is not supported
	- line 106: resources: ["*"] # TODO: should be on just */status but wildcard is not supported


client/pkg/informers/externalversions/generic.gen.go (1 line):
	- line 51: // TODO extend this to unknown resources with a client pool


registry/nacos/mcpserver/watcher.go (1 line):
	- line 959: // TODO: This is a temporary implementation because of a bug in the nacos-go-sdk, which causes a block when stoping.


helm/core/values.yaml (1 line):
	- line 403: # TODO: the intent is to eventually have this enabled by default when security is used.


pkg/ingress/kube/annotations/ip_access_control.go (1 line):
	- line 85: // TODO: hardcode


plugins/wasm-go/extensions/ai-statistics/main.go (1 line):
	- line 89: // TODO: add more metrics in Gauge and Histogram format


hgctl/pkg/manifests/istiobase/templates/role.yaml (1 line):
	- line 24: # TODO lock this down to istio-ca-cert if not using the DNS cert mesh config


plugins/wasm-go/extensions/transformer/main.go (1 line):
	- line 251: // TODO: 增加检查某些字段比如oldKey&newKey未同时存在时的提示信息


plugins/wasm-go/extensions/ai-proxy/provider/deepseek.go (1 line):
	- line 16: // TODO: docs: https://api-docs.deepseek.com/api/create-chat-completion


pkg/ingress/kube/gateway/controller.go (1 line):
	- line 161: // TODO: implement


plugins/wasm-go/extensions/ai-proxy/config/config.go (1 line):
	- line 44: // TODO: For legacy config support. To be removed later.


pkg/ingress/kube/gateway/istio/conditions.go (1 line):
	- line 168: // TODO: will we fight over other controllers doing similar (but not identical) ordering?


plugins/wasm-go/extensions/ai-history/main.go (1 line):
	- line 350: // TODO: compatible with other providers


plugins/wasm-go/extensions/ai-cache/main.go (1 line):
	- line 84: // TODO: It may be necessary to support stream mode determination for different LLM providers.


plugins/wasm-go/extensions/ai-proxy/provider/cohere.go (1 line):
	- line 16: // TODO: support more capabilities, upgrade to v2, docs: https://docs.cohere.com/v2/reference/chat


plugins/wasm-go/extensions/ai-proxy/provider/azure.go (1 line):
	- line 27: // TODO: azure's pattern is the same as openai, just need to handle the prefix, can be done in TransformRequestHeaders to support general capabilities


plugins/wasm-go/extensions/de-graphql/config/degraphql_config.go (1 line):
	- line 149: // TODO validate variable type and blank


plugins/wasm-go/extensions/oidc/main.go (1 line):
	- line 67: // TODO: remove this verifier after envoy support send request during parseConfig


hgctl/pkg/plugin/types/schema.go (1 line):
	- line 216: // TODO: Add more tags (now supported yaml, minimum, maximum, ...)


helm/core/templates/controller-clusterrole.yaml (1 line):
	- line 33: resources: ["*"] # TODO: should be on just */status but wildcard is not supported


pkg/ingress/kube/annotations/local_rate_limit.go (1 line):
	- line 92: // TODO: hardcode


plugins/wasm-go/extensions/ai-cache/util.go (1 line):
	- line 127: // TODO: Temporarily store the tool_calls value in the context for processing


plugins/wasm-go/extensions/ai-proxy/provider/deepl.go (1 line):
	- line 94: // TODO: Support default host through configuration


helm/core/templates/controller-role.yaml (1 line):
	- line 12: # TODO lock this down to istio-ca-cert if not using the DNS cert mesh config


plugins/golang-filter/mcp-session/handler/rate_limit_handler.go (1 line):
	- line 71: // TODO: needs to be refactored, rate limit should be registered as a request hook in MCP server