fix: PR #194 review findings + CI fixes

[tomymaritano]

Summary

Post-merge fixes addressing all review findings from PR #194, plus CI failures and additional improvements.

Security

• Fix YAML frontmatter escaping (backslashes, control chars) — CodeQL critical
• Validate plugin IDs with regex + path traversal check
• Fix PowerShell path interpolation (separate args)
• Add 50MB size limit + tmpDir cleanup in finally for plugin install
• HTML-escape table cell content in clipboard export
• Validate installFromUrl slug matches manifest.id
• HTTPS-only validation in preload for plugin URLs
• Enforce minimum 100k PBKDF2 iterations in encryption service

CI Fixes

• Fix mcp-server TS2532 from noUncheckedIndexedAccess
• Restructure ESLint: type-aware rules only for src/ files in tsconfig projects (0 errors)
• ci.yml: add contents:read permission to label job

Accessibility

• aria-pressed on filter pills, useId() for modal, conditional toast role
• Auto-focus primary button in welcome dialog

UX

• Save indicator no longer flashes on note switch
• UpdateBanner shows error messages with retry
• SidebarFooter "Synced Xm ago" display
• Error toasts on failed plugin install/uninstall
• Marketplace API response validation

Code Quality

• Async clipboard handlers, Unicode-safe filenames
• CSS camelCase consistency, danger hover tokens via color-mix
• Stricter semver regex, .env.example formatting

Test plan

• pnpm typecheck — 17/17 pass
• pnpm test — 16/16 pass
• pnpm lint — 0 errors

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
readide	Error		Apr 23, 2026 4:00pm

[coderabbitai]

Warning

Rate limit exceeded

@tomymaritano has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 10 minutes and 7 seconds before requesting another review.

Your organization is not enrolled in usage-based pricing. Contact your admin to enable usage-based pricing to continue reviews beyond the rate limit, or try again in 10 minutes and 7 seconds.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: fa27c301-43a3-430b-852b-79e33401da6b

📥 Commits

Reviewing files that changed from the base of the PR and between 3484982 and 549339d.

⛔ Files ignored due to path filters (1)

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (19)

• .claude/settings.local.json
• .env.example
• apps/desktop/package.json
• apps/desktop/src/main/index.ts
• apps/desktop/src/renderer/components/NoteEditor.tsx
• apps/desktop/src/renderer/components/NoteListFilterBar.tsx
• apps/desktop/src/renderer/components/UpdateBanner.tsx
• apps/desktop/src/renderer/components/Welcome.tsx
• apps/desktop/src/renderer/components/sidebar/SidebarFooter.tsx
• apps/desktop/src/renderer/pages/settings/sections/PluginsSection.tsx
• apps/desktop/src/renderer/pages/settings/sections/Section.module.css
• apps/desktop/src/renderer/plugins/exportMarkdown.ts
• apps/desktop/src/renderer/ui/patterns/Modal.tsx
• apps/desktop/src/renderer/ui/primitives/Button.module.css
• apps/desktop/src/renderer/ui/primitives/Toast.tsx
• apps/web/components/landing/Hero.tsx
• apps/web/next-env.d.ts
• apps/web/tsconfig.json
• scripts/bump-version.js

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch develop

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 549339d469

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Move useId above early return

useId() is invoked only after if (!open) return null, which makes hook execution conditional on open. When the same Modal instance rerenders from closed to open, React can throw a hook order error ("Rendered more hooks than during the previous render"), so toggling visibility via the open prop can break at runtime.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Remove strict slug/id equality check in plugin install

This rejects downloads whenever manifest.id !== pluginSlug, but marketplace slug and plugin manifest id are not guaranteed to be the same identifier in this codebase (the UI already has slug/id reconciliation logic). As a result, valid marketplace bundles can be blocked from installation even though the existing id format and path traversal validations already protect filesystem safety.

Useful? React with 👍 / 👎.