Severity
Medium.
What happens
handleExport has no try/catch and no error surface. SheetJS book_append_sheet throws for sheet names over 31 chars or containing : \ / ? * [ ] (the field is free text, e.g. "Q3: Accounts"), and the dynamic xlsx chunk import can fail offline — in all cases the promise rejects unhandled, the modal stays open (or closes with no file), and no message appears.
Evidence
src/ui/components/ExportModal.tsx:54-66
Suggested fix
Wrap handleExport in try/catch with a visible error; validate sheetName against Excel's rules.
Environment
Commit 74cf21b (main), WaveLink 0.6.0. Found in the 2026-08-31 adversarial audit (code-verified).
Severity
Medium.
What happens
handleExporthas no try/catch and no error surface. SheetJSbook_append_sheetthrows for sheet names over 31 chars or containing: \ / ? * [ ](the field is free text, e.g. "Q3: Accounts"), and the dynamicxlsxchunk import can fail offline — in all cases the promise rejects unhandled, the modal stays open (or closes with no file), and no message appears.Evidence
src/ui/components/ExportModal.tsx:54-66Suggested fix
Wrap
handleExportin try/catch with a visible error; validatesheetNameagainst Excel's rules.Environment
Commit
74cf21b(main), WaveLink 0.6.0. Found in the 2026-08-31 adversarial audit (code-verified).