Severity
Medium — a universal editing shortcut is broken in every input.
What happens
toggle-undo is registered globally on ctrl+z, and ShortcutRegistry.handleKeydown never checks whether the event target is an input/textarea/contenteditable — it calls preventDefault() and fires the handler. Verified live against the packaged 0.6.0 bundle: pressing Ctrl+Z while typing in the SOQL editor opens the Undo History panel and suppresses native text undo. Same risk applies to any user-rebound shortcut without modifiers.
Evidence
src/ui/utils/shortcuts.ts:100-109 (no target check)src/ui/app/AppRoot.tsx:219-222 (ctrl+z registration), :230
Suggested fix
In handleKeydown, ignore events whose target is an editable element unless the binding uses a safe modifier combo; consider moving undo-panel to a non-conflicting default (e.g. ctrl+shift+z).
Environment
Commit 74cf21b (main), WaveLink 0.6.0. Found in the 2026-08-31 adversarial audit (live harness + code verified).
Severity
Medium — a universal editing shortcut is broken in every input.
What happens
toggle-undois registered globally onctrl+z, andShortcutRegistry.handleKeydownnever checks whether the event target is an input/textarea/contenteditable — it callspreventDefault()and fires the handler. Verified live against the packaged 0.6.0 bundle: pressing Ctrl+Z while typing in the SOQL editor opens the Undo History panel and suppresses native text undo. Same risk applies to any user-rebound shortcut without modifiers.Evidence
src/ui/utils/shortcuts.ts:100-109(no target check)src/ui/app/AppRoot.tsx:219-222(ctrl+z registration),:230Suggested fix
In
handleKeydown, ignore events whose target is an editable element unless the binding uses a safe modifier combo; consider moving undo-panel to a non-conflicting default (e.g. ctrl+shift+z).Environment
Commit
74cf21b(main), WaveLink 0.6.0. Found in the 2026-08-31 adversarial audit (live harness + code verified).