Changelog

Swept slice components for unhandled errors on user-triggered async paths + floating promises, each adversarially verified (0 rejected). 6 real bugs fixed, all P3 but reachable: image-editor menu-bar + top-bar openImage/openFile awaited loadImage() with no try/catch — an undecodable picked image (corrupt, truncated, HEIC) rejected with an unhandled promise, no layer added, no feedback, AND the createObjectURL blob leaked; now wrapped with a catch that revokes the blob. image-editor removeBg() (both bars) called removeImageBackground() — which dynamically downloads an ONNX model + WASM on first run — with try/finally but NO catch, so an offline/unsupported first use escaped as an unhandled rejection (busy reset, but the error was lost with zero feedback); added the catch. notion-shell CodeBlock copy + NotionBlock copy-link awaited navigator.clipboard.writeText with no guard — rejects in an insecure context / when the document isn't focused / on denied permission, leaving an unhandled rejection and (for CodeBlock) the copied state never set; both guarded. These slices have no error-surface channel, so the fixes prevent the unhandled rejection / stuck state / blob leak (gate-permitted swallow). slices:check 70 ok + tsc green.

First defect sweep of the published packages (packages/cli + packages/mcp — bugs here ship to every npx rr / MCP user). 10 module groups audited, every finding adversarially verified; 8 candidates surfaced, 6 correctly rejected as unreachable/dev-only (dead removeSkill, conflict-gated compose accepted-set, curated-archive dna, quote-free sync-skills regex, gen-manifest write-ordering, self-inflicted init path). 2 real bugs fixed: (1) SECURITY — the MCP OAuth 2.1 consent page rendered the attacker-influenced redirect_uri inside an onclick JS-string sink (window.location='…'); its esc() HTML-encodes the apostrophe to &#39;, which the HTML parser decodes back to a literal ' before the JS runs, so a redirect_uri like https://localhost/'-alert(document.domain)-' (valid https URL, passes the protocol check) breaks out and executes arbitrary JS on the MCP origin when the victim clicks Deny — reflected XSS. The Deny button is now an <a href> (navigation context where HTML-escaping is correct), styled to match. (2) CLI — parseFlags consumed the next token as a value for EVERY --flag (no boolean notion), so `rr add my-slice --force ./apps/web` swallowed ./apps/web as the value of --force and silently installed into the cwd instead. Replaced with a value-flag allowlist (target/template/category/at/skills/features for cli.js; from/to/repo-root for the duplicate parser in migrate-load.mjs) so boolean flags before a positional no longer eat it. Verified: XSS render check + parseFlags behavioral check + CLI vitest 57 pass. CLI 1.14.0→1.14.1, MCP 1.2.3→1.2.4 (publish pending OTP).

Second deep a11y sweep (form controls without labels + click handlers on non-interactive elements), each finding adversarially verified, 0 rejected. FORM LABELS: 15 inputs/textareas that exposed only a placeholder (not an accessible name) got aria-labels — landing-sections newsletter, vector-search, data-table filter, comments reply, assistant composer + the agent/skill/automation Field forms, browser omnibar, ai-chat + ai-router chat fabs, user-management members search, reel-editor + image-editor AI panels, image-editor properties panel (11 transform/stroke/brush fields whose visible <Label> had no htmlFor), app-store create form, file-explorer rename. KEYBOARD ACCESS: controls that were click-only (no role/tabIndex/onKeyDown) and thus unusable by keyboard or screen-reader users got proper key handling — code-editor + browser tab strips (role=tab + Enter/Space → select), media-studio + image-editor layer rows (role=button + guarded Enter/Space → select), and file-explorer's list-view row was converted from a bare <div> to a <Button> mirroring its own grid branch (native keyboard access, layout unchanged). One control skipped: skill-form's "Allowed tools" wraps a custom ToolPicker (not a labelable input). slices:check 70 ok + tsc green.

Two more verified passes. CALL-GRAPH (convex/** excluded from root tsc, so gate-invisible): swept every ctx.run*/scheduler call against its target validator. ai-chat chat action called api.aiConfig.get — a module that exists NOWHERE in the tree (a leftover from the source project's agencyAiConfig singleton, referenced only in that one file); on the ANTHROPIC_API_KEY-set path (the real use case, outside the try) it threw 'Could not find public function'. Removed the dead runQuery + now-unused api import, inlined the existing default system prompt. (Noted but deliberately NOT changed: seo slice's generate action references api.slices.auth.me / api.slices.seo.* — the whole action targets the consumer-side `slices.*` codegen namespace, not rr's `features.*`, so it's a consumer-composition contract, not an rr-repo bug.) A11Y depth (round 1 only scratched this, capped at 10): 5 more icon-only controls with no accessible name got aria-labels — code-editor tab close (dynamic label w/ unsaved state), assistant glyph picker (matching its sibling ColorPick), appshell window-overview reveal + dock app links, notion editor toggle block; and icon-picker's dialog-fallback DialogContent had no DialogTitle (Radix a11y violation + runtime warning) — added an sr-only title. slices:check 70 ok + tsc green.

Per-feature-dir security sweep across all 20 convex/features handlers, each finding adversarially verified. CORRECTNESS (these crashed at runtime and shipped broken to every consumer — convex/** is excluded from root tsc so neither typecheck nor the import-gate caught them): ai callModel, bookings calWebhook, and the whole newsletter broadcast fanout referenced internal.features.<x>.MUTATIONS/QUERIES.fn (plural) but every module file is mutation.ts / query.ts (singular), so the generated API node was undefined and each ctx.runMutation/runQuery threw 'Cannot read properties of undefined' — for ai, AFTER the paid generateText() spend; for bookings, on every Cal.com webhook; for newsletter, before a single email sent. Fixed plural→singular (7 refs) + the same typo in a testimonials operator doc-comment. SECURITY: user-management hierarchy linkTenant gated members.manage only on the parent tenant while childTenantId was an arbitrary string — a tenant admin could attach ANY victim tenant as a child and then read its members (getAccessMatrix) or inject a privileged invite (sendHierarchyInvite); now requires members.manage on BOTH ends. payment recordDokuPending patched an existing order's amount + let the caller hijack its checkoutUrl with no owner check; now blocks cross-owner patch (guest + owner re-creates still pass). activity get was a public query returning private rows by id, bypassing the slice's own public-only contract (listAll is internal, listPublic filters) — now returns null for non-public rows. Deliberately SKIPPED: pages-cms listAll draft-visibility (non-tenant/actor data on a documented copy-source public read where the consumer owns the auth model — same call left as-is for the library twin).

Multi-agent defect hunt (a11y / resource-leak / effect-correctness / null-safety / convex-correctness), each finding adversarially verified before fix. SECURITY (copy-source convex, inherited by every consumer via npx rr add): user-management mutations cancelInvite / resendInvite / removeTeam / addTeamMember / removeTeamMember all gated requirePermission on args.tenantId but then operated on a raw inviteId/teamId with no ownership match — a tenant-A admin could delete/rotate/mutate tenant-B invites, teams, and team memberships (cross-tenant IDOR). Each now loads the doc and verifies doc.tenantId === args.tenantId before touching it. comments.resolve only checked authentication, not ownership (unlike update/remove) — any signed-in user could toggle resolvedAt on any thread; now mirrors the c.actorId guard. A11Y: icon-only buttons with no accessible name got aria-labels — browser history close, assistant step reorder/delete, image-editor bold/italic + AI send, notion-database calendar prev/next-month + property rename/delete, media-viewer toolbar (IconBtn now forwards its tooltip label to aria-label). LEAK: image-picker UploadTab created a blob URL per pick and never revoked it — added a cleanup effect keyed on the preview URL. effect-correctness + null-safety dimensions came back clean. slices:check 70 ok + tsc green.

The Grand Tour (P0–P7) lands and replaces the old multi-taxonomy catalog. rr is now a pure slice picker ("printilan") plus ONE curated showcase: /tour walks every slice in context across six Acts — I Marketing, II OS & App Shell, III Media, IV AI, V Content, VI Platform/Auth & Commerce — driven by lib/content/tour.ts, with a per-Act rail on the index and a deep-linkable page at /tour/<id>. The content slice (Act V) gains pages-cms, the generalized CMS extracted from the retired OS-template admin surfaces. The /layouts + /templates catalog is decommissioned: lib/content/layouts.ts data is emptied, /layouts + /templates (plus the old /preview/<os-template> full-app and per-section demos) 308-redirect to /tour, and ~871 demo files under app/preview/** + components/templates/** were deleted. The 8 OS demos stay live EXTERNALLY at demo-*.rahmanef.com, served from their own Vercel dev-lab repos via the untouched proxy.ts host rewriter. Finisher pass adds a /tour smoke test to the Playwright e2e suite, rewrites the prose docs that still described /layouts + the T1–T5 OS templates as live (README, STRUCTURE, PROGRESS, eject-spec, subdomain-routing), and deletes the per-template playbook set under docs/templates/ in favour of one docs/tour.md pointer. validate:all stays green.

Final track of the 2026-06-11 audit. These functions are copy-source (never on rr's own backend — deploy allowlist keeps them off), but every consumer inherits them via npx rr add. ai-router 0.5.0: callModel was the one paid-AI action with a non-null-asserted OPENROUTER_API_KEY and no guard — now key-guarded like its sibling aiChat ({ ok:false, notice } when unset; success is { ok:true, text }), with documented rate-limit wiring (ai: prefix consume) left to composition to avoid a hard peer coupling. doku-payment 0.4.0: getPaymentStatus proxied DOKU's status API for ANY orderId — cross-tenant order probing plus upstream creds burn. It now requires the order to exist locally first (owned orders → caller must be the owner; guest orders → the unguessable orderId stays the capability, same rule as getOrderByOrderId); unknown/unauthorized/unconfigured all return null. activity 0.3.0: listAll returned private-visibility rows as a public query — now an internalQuery the consumer wraps in their own auth-gated query, the same pattern as the slice's mutations. notion-shell: KaTeX parse errors echo the user's TeX source — the error span is now HTML-escaped before dangerouslySetInnerHTML (self-XSS hygiene). Plus the durable catalog fix: all 50 drifted lib/content/slices.ts versions synced to slice.json (report-slices-drift now reads zero), with gen-manifest already sourcing versions from slice.json directly.

Track B of the 2026-06-11 audit. Compatibility notes in the command panel now tell the user what to DO: every warning carries an action line (incompatible → drop the slice or re-pick the template; warn → wire manually after scaffolding) plus a View-slice link to the docs page. An incompatible pair escalates the whole box to blocker-red — it was rendering as a soft amber note while the emitted command was broken. Project form: the emitted command always uses a sanitized app name, so typing 'My App!' silently scaffolded 'my-app-' — the form now shows the actual folder name when it differs, and flags malformed owner emails (aria-invalid + inline error) before they land in a scaffold. Pre-push vitest gate also retries once now: a known environmental flake exits 1 with all 468 tests green (~1/4 of hook runs); a real failure stays red on both runs.

Track C continued (docs/audit-2026-06-11.md). CLI: every tiged clone now goes through cloneWithRetry — one silent retry on transient network errors, then an actionable message (ENOTFOUND → check connectivity; 404/ENOENT → verify slug + repo is public) instead of a raw git stack trace. MCP 1.2.3: rr_get / rr_get_slice return structured not_found payloads ({ error, message, didYouMean, try }) so a calling LLM can branch and recover instead of echoing a string; the whole tool dispatcher is try/catch-wrapped (a throwing handler — e.g. bad workflow kind — becomes a tool error, not a dead stdio server); tool descriptions rewritten with explicit use-when guidance disambiguating the three composers (init vs add vs compose_app) and rr_get vs rr_get_slice; stray kitab terminology dropped. Two real bugs found while smoking it: the data-loader preferred an installed rahman-resources over the sibling monorepo CLI — a stale 0.9.2 snapshot (8 slices) silently shadowed the 68-slice source of truth in local dev (now sibling-first); and gen-manifest took versions from the hand-curated catalog, shipping stale versions in the distributed manifest — it now reads each slice.json (the version SSOT) directly. report-slices-drift pairing fixed (entry-window matching): true catalog drift is 50/68, previously misattributed.