Fix 23 MEDIUM audit findings

Sidecar + launcher:
- AdForge.command waits up to 10s on the restart_stale path for the old sidecar to release the port (nc -z probe). sleep 1 was too short on macOS with open file handles. (#41)
- local-sync.cjs binds server with an error listener that explicitly surfaces EADDRINUSE — closes the resolve-ports.cjs TOCTOU window so the user gets a clear message instead of a silent fail. (#42)
- extractMetadata now handles unquoted HTML5 attribute values via a per-attribute multi-arm regex — covers older CMS templates. (#59)

UI/UX:
- UndoToast now queues multiple events. Rapid double-delete no longer drops the first undo. (#43)
- Dashboard (app/page.tsx) renders a tile-grid skeleton during load instead of returning null. (#54)
- ServiceWorkerRegister listens for controllerchange and reloads once on update — fixes stale shell after deploy. (#55)
- History delete adds confirm() to match the brand-delete safety pattern. (#56)

Prompts + AI:
- audience-targeting "IF AN IMAGE IS ATTACHED" block is now conditional on input.audience_screenshot — AI no longer hallucinates screenshot data when the image was stripped due to non-vision provider. (#45)
- brand-extract dlog() wrapper + url-ingest dbg() gated to NODE_ENV !== "production" so raw page content + AI responses don't leak to production user DevTools. (#52)
- Gap-fill pairs objections + objection_handling: if one is missing, both regenerate, and the merge trims the longer to match the shorter so indices line up. (#63)
- Industry template path no longer setActiveBrainId on skeleton save — activation now happens on the user's explicit form save. (#62)

LLM providers:
- openai-compat + anthropic readError surfaces 429 Retry-After as a "Rate limit — retry in Ns" prefix so free-tier users on Groq/Cerebras/OpenRouter get a useful message. (#61)

Security / safety:
- Markdown escape() now also escapes " and ' (defense-in-depth for future tags with attributes). (#47)
- url-ingest normalize() throws on non-http(s) schemes so javascript: URIs can't be saved into brain.website_url. (#53)
- vercel.json adds X-Frame-Options: DENY + CSP frame-ancestors 'none' against clickjacking. (#51)
- local-sync.ts SYNC_URL switched to 127.0.0.1 (IPv6 resolution parity with url-ingest.ts). (#49)

SEO:
- public/robots.txt + app/sitemap.ts added. Crawlers now get the public evergreen routes; gated app routes (generators/optimizers/settings) are disallowed. (#50)

Verification: typecheck + 43/43 tests + next build all pass.

Author: IamRamgarhia

AdForge.command

@@ -94,7 +94,16 @@ fi
 if [ "$ACTION" = "restart_stale" ]; then
   echo "Stale sidecar on :$SYNC_PORT — asking it to quit before starting fresh..."
   curl -fsS -X POST --max-time 3 "http://127.0.0.1:$SYNC_PORT/quit" >/dev/null 2>&1 || true
-  sleep 1
+  # Poll until the port frees. sleep 1 is not enough on macOS with open file
+  # handles; the new sidecar would otherwise fail to bind. (Audit finding #41.)
+  DEADLINE=$(( $(date +%s) + 10 ))
+  while [ $(date +%s) -lt $DEADLINE ]; do
+    # nc -z returns 0 if port is OPEN. We want it CLOSED (free).
+    if ! nc -z 127.0.0.1 "$SYNC_PORT" >/dev/null 2>&1; then
+      break
+    fi
+    sleep 0.3
+  done
 fi
 
 if [ "$ACTION" = "shifted" ]; then

app/brand/new/page.tsx

@@ -30,6 +30,16 @@ const GAP_FILL_FIELDS = [
   "objections", "objection_handling",
 ] as const;
 
+// Gated console.log — kept in development for the ingest debug story, but
+// stripped in production so raw AI responses don't end up in user DevTools.
+// (Audit finding #52.)
+function dlog(...args: unknown[]) {
+  if (process.env.NODE_ENV !== "production") {
+    // eslint-disable-next-line no-console
+    console.log(...args);
+  }
+}
+
 function isEmptyField(v: unknown): boolean {
   if (v == null) return true;
   if (Array.isArray(v)) return v.length === 0;
@@ -184,8 +194,8 @@ function Inner() {
       }
       setQuickStatus("② Reading page metadata (title, OG tags, social links, schema)…");
       const deterministic = deterministicFillFromMetadata(r.metadata, r.url);
-      console.log("[adforge:brand-extract] deterministic fill:", deterministic);
-      console.log("[adforge:brand-extract] raw metadata:", r.metadata);
+      dlog("[adforge:brand-extract] deterministic fill:", deterministic);
+      dlog("[adforge:brand-extract] raw metadata:", r.metadata);
       const sourceLabel = `${r.url} (via ${
         r.source === "sidecar" ? "local sidecar" :
         r.source === "allorigins" ? "AllOrigins fallback" :
@@ -209,12 +219,12 @@ function Inner() {
         maxTokens: 3000,
         temperature: 0.7,
       });
-      console.log("[adforge:brand-extract] raw AI response text:", res.text);
+      dlog("[adforge:brand-extract] raw AI response text:", res.text);
       const cost = estimateCostUsd(res.providerId, res.modelId, res.usage);
       addUsage(cost, res.usage?.input_tokens ?? 0, res.usage?.output_tokens ?? 0);
       window.dispatchEvent(new Event("ados:usage"));
       const parsed = tryParseJson<any>(res.text) ?? {};
-      console.log("[adforge:brand-extract] parsed AI JSON (pass 1):", parsed);
+      dlog("[adforge:brand-extract] parsed AI JSON (pass 1):", parsed);
       const fallback = new URL(r.url).hostname.replace(/^www\./, "");
 
       // Pass 2 — gap-fill. Any inference field still empty gets a focused
@@ -226,7 +236,11 @@ function Inner() {
         if (typeof v === "string" && !v.trim()) continue;
         merged1[k] = v;
       }
-      const missing = GAP_FILL_FIELDS.filter((f) => isEmptyField(merged1[f]));
+      const missing: string[] = GAP_FILL_FIELDS.filter((f) => isEmptyField(merged1[f]));
+      // objections and objection_handling are paired arrays — if one is missing
+      // we must regenerate both together so the indices line up. (Audit finding #63.)
+      if (missing.includes("objections") && !missing.includes("objection_handling")) missing.push("objection_handling");
+      if (missing.includes("objection_handling") && !missing.includes("objections")) missing.push("objections");
       if (missing.length) {
         setQuickStatus(`④ Filling gaps — ${missing.length} field${missing.length === 1 ? "" : "s"} still empty. Re-asking AI to infer from content…`);
         try {
@@ -242,19 +256,27 @@ function Inner() {
             maxTokens: 2000,
             temperature: 0.8,
           });
-          console.log("[adforge:brand-extract] raw AI response text (gap-fill):", gapRes.text);
+          dlog("[adforge:brand-extract] raw AI response text (gap-fill):", gapRes.text);
           const gapCost = estimateCostUsd(gapRes.providerId, gapRes.modelId, gapRes.usage);
           addUsage(gapCost, gapRes.usage?.input_tokens ?? 0, gapRes.usage?.output_tokens ?? 0);
           window.dispatchEvent(new Event("ados:usage"));
           const gapParsed = tryParseJson<any>(gapRes.text) ?? {};
-          console.log("[adforge:brand-extract] parsed AI JSON (gap-fill):", gapParsed);
+          dlog("[adforge:brand-extract] parsed AI JSON (gap-fill):", gapParsed);
           // Coerce each gap-fill value to the BrandBrain schema's expected type.
           // The model often returns "Instagram, LinkedIn" (string) for an array
           // field; without coercion, brain.platforms.join(...) downstream throws.
           for (const f of missing) {
             const coerced = coerceFieldValue(f, gapParsed[f]);
             if (!isEmptyField(coerced)) parsed[f] = coerced;
           }
+          // Trim the longer of objections / objection_handling so indices match.
+          const objs: unknown = parsed.objections;
+          const handles: unknown = parsed.objection_handling;
+          if (Array.isArray(objs) && Array.isArray(handles)) {
+            const len = Math.min(objs.length, handles.length);
+            parsed.objections = objs.slice(0, len);
+            parsed.objection_handling = handles.slice(0, len);
+          }
         } catch (gapErr) {
           console.warn("[adforge:brand-extract] gap-fill pass failed:", gapErr);
         }
@@ -287,12 +309,12 @@ function Inner() {
         maxTokens: 3000,
         temperature: 0.4,
       });
-      console.log("[adforge:brand-extract] raw AI response text (paste):", res.text);
+      dlog("[adforge:brand-extract] raw AI response text (paste):", res.text);
       const cost = estimateCostUsd(res.providerId, res.modelId, res.usage);
       addUsage(cost, res.usage?.input_tokens ?? 0, res.usage?.output_tokens ?? 0);
       window.dispatchEvent(new Event("ados:usage"));
       const parsed = tryParseJson<any>(res.text) ?? {};
-      console.log("[adforge:brand-extract] parsed AI JSON (paste):", parsed);
+      dlog("[adforge:brand-extract] parsed AI JSON (paste):", parsed);
       if (!parsed.business_name && !Object.keys(parsed).length) {
         setQuickStatus("AI returned no usable JSON. Check DevTools [adforge:brand-extract] logs and try again, or fall back to Method 3 / 4.");
         return;
@@ -326,12 +348,12 @@ function Inner() {
         maxTokens: 3000,
         temperature: 0.4,
       });
-      console.log("[adforge:brand-extract] raw AI response text (google):", res.text);
+      dlog("[adforge:brand-extract] raw AI response text (google):", res.text);
       const cost = estimateCostUsd(res.providerId, res.modelId, res.usage);
       addUsage(cost, res.usage?.input_tokens ?? 0, res.usage?.output_tokens ?? 0);
       window.dispatchEvent(new Event("ados:usage"));
       const parsed = tryParseJson<any>(res.text) ?? {};
-      console.log("[adforge:brand-extract] parsed AI JSON (google):", parsed);
+      dlog("[adforge:brand-extract] parsed AI JSON (google):", parsed);
       if (!parsed.business_name && !Object.keys(parsed).length) {
         setQuickStatus("AI returned no usable JSON from search results. Try a more specific query or fall back to Method 3 / 4.");
         return;
@@ -505,8 +527,11 @@ function Inner() {
                   key={t.slug}
                   onClick={async () => {
                     const b = t.apply({ business_name: "" });
+                    // Save the skeleton but DON'T activate it yet — if the user
+                    // abandons the form their other tools would all run against
+                    // an empty brain. Activation happens when BrandBrainForm's
+                    // own save action fires. (Audit finding #62.)
                     await saveBrain(b);
-                    setActiveBrainId(b.id);
                     window.dispatchEvent(new Event("ados:brains-changed"));
                     setEditing(b);
                   }}

app/history/page.tsx

@@ -348,6 +348,10 @@ function HistoryInner() {
                   <CopyButton text={a.output_text} />
                   <button
                     onClick={async () => {
+                      // Confirm dialog matches the brand-delete pattern in /brand —
+                      // single mis-click no longer triggers a delete. The 7-second
+                      // undo toast is the second safety net. (Audit finding #56.)
+                      if (!confirm(`Delete "${a.title.slice(0, 60)}"? You can undo from the toast for 7 seconds.`)) return;
                       await softDeleteAd(a.id);
                       refresh();
                       showUndoToast({

app/page.tsx

@@ -70,7 +70,20 @@ export default function Dashboard() {
     };
   }, [router]);
 
-  if (loading) return null;
+  // Skeleton instead of `return null` to avoid the blank-flash + layout shift
+  // when the user returns to the dashboard. (Audit finding #54.)
+  if (loading) {
+    return (
+      <div className="animate-pulse">
+        <div className="h-16 mb-6 border-b border-base-700/40" />
+        <div className="grid md:grid-cols-3 gap-3">
+          {[1, 2, 3, 4, 5, 6].map((i) => (
+            <div key={i} className="h-32 border border-base-700 bg-base-900/40" />
+          ))}
+        </div>
+      </div>
+    );
+  }
 
   return (
     <div>

app/sitemap.ts

@@ -0,0 +1,45 @@
+import type { MetadataRoute } from "next";
+import { PLATFORM_HUBS } from "@/lib/platform-hubs";
+import { CONCEPTS } from "@/lib/learn-content";
+import { COURSES } from "@/lib/courses";
+
+const BASE = "https://adforge.dicecodes.com";
+
+// Surface only the public, evergreen routes to search engines. Gated app
+// routes (generators, optimizers, settings) sit behind ApiKeyGate and produce
+// near-empty pages for crawlers. (Audit finding #50.)
+export default function sitemap(): MetadataRoute.Sitemap {
+  const lastModified = new Date();
+  const fixed: MetadataRoute.Sitemap = [
+    { url: `${BASE}/`, lastModified, changeFrequency: "weekly", priority: 1.0 },
+    { url: `${BASE}/about`, lastModified, changeFrequency: "monthly", priority: 0.8 },
+    { url: `${BASE}/benchmarks`, lastModified, changeFrequency: "weekly", priority: 0.7 },
+    { url: `${BASE}/platforms`, lastModified, changeFrequency: "monthly", priority: 0.8 },
+    { url: `${BASE}/learn`, lastModified, changeFrequency: "monthly", priority: 0.7 },
+    { url: `${BASE}/learn/courses`, lastModified, changeFrequency: "monthly", priority: 0.7 },
+    { url: `${BASE}/learn/frameworks`, lastModified, changeFrequency: "monthly", priority: 0.6 },
+    { url: `${BASE}/launch-guide`, lastModified, changeFrequency: "monthly", priority: 0.7 },
+  ];
+  const platformPages: MetadataRoute.Sitemap = Object.keys(PLATFORM_HUBS).map((slug) => ({
+    url: `${BASE}/platforms/${slug}`,
+    lastModified,
+    changeFrequency: "monthly",
+    priority: 0.7,
+  }));
+  const conceptPages: MetadataRoute.Sitemap = CONCEPTS.map((c) => ({
+    url: `${BASE}/learn/${c.slug}`,
+    lastModified,
+    changeFrequency: "monthly",
+    priority: 0.5,
+  }));
+  const coursePages: MetadataRoute.Sitemap = COURSES.flatMap((c) => [
+    { url: `${BASE}/learn/courses/${c.slug}`, lastModified, changeFrequency: "monthly" as const, priority: 0.5 },
+    ...c.lessons.map((l) => ({
+      url: `${BASE}/learn/courses/${c.slug}/${l.slug}`,
+      lastModified,
+      changeFrequency: "monthly" as const,
+      priority: 0.4,
+    })),
+  ]);
+  return [...fixed, ...platformPages, ...conceptPages, ...coursePages];
+}

components/Markdown.tsx

@@ -7,10 +7,16 @@ import { memo } from "react";
  * Handles: # headers, **bold**, lists, code blocks. No HTML passthrough.
  */
 function escape(s: string): string {
+  // Quote escape included for defense-in-depth — currently renderInline only
+  // emits <strong>/<em>/<code> with no attributes, but any future tag with
+  // attributes (e.g. <a href>) would otherwise be vulnerable to attribute
+  // injection via `**foo" onmouseover="alert(1)**`. (Audit finding #47.)
   return s
     .replace(/&/g, "&amp;")
     .replace(/</g, "&lt;")
-    .replace(/>/g, "&gt;");
+    .replace(/>/g, "&gt;")
+    .replace(/"/g, "&quot;")
+    .replace(/'/g, "&#39;");
 }
 
 function renderInline(s: string): string {

components/ServiceWorkerRegister.tsx

@@ -7,7 +7,24 @@ export function ServiceWorkerRegister() {
     if (typeof window === "undefined") return;
     if (!("serviceWorker" in navigator)) return;
     if (process.env.NODE_ENV !== "production") return;
+
     navigator.serviceWorker.register("/sw.js").catch(() => {});
+
+    // When a new SW takes over (skipWaiting + claim fires after a deploy),
+    // reload the page so the shell HTML matches the new chunk URLs. Without
+    // this, users on the stale cached shell may see broken UI references for
+    // a session. (Audit finding #55.) Guarded against the first install on a
+    // fresh visit, where there was no previous controller.
+    let reloaded = false;
+    const onControllerChange = () => {
+      if (reloaded) return;
+      reloaded = true;
+      window.location.reload();
+    };
+    navigator.serviceWorker.addEventListener("controllerchange", onControllerChange);
+    return () => {
+      navigator.serviceWorker.removeEventListener("controllerchange", onControllerChange);
+    };
   }, []);
   return null;
 }

components/UndoToast.tsx

@@ -20,28 +20,33 @@ export function showUndoToast(detail: UndoEvent) {
 }
 
 export function UndoToast() {
-  const [evt, setEvt] = useState<UndoEvent | null>(null);
+  // Queue of pending undo events. A rapid double-delete used to silently drop
+  // the first one because we only held a single slot. Now the second event
+  // joins the queue and surfaces when the first dismisses / times out.
+  // (Audit finding #43.)
+  const [queue, setQueue] = useState<UndoEvent[]>([]);
   const [remaining, setRemaining] = useState(0);
   const tickRef = useRef<ReturnType<typeof setInterval> | null>(null);
+  const evt = queue[0] ?? null;
 
   useEffect(() => {
     const onUndo = (e: CustomEvent<UndoEvent>) => {
-      setEvt(e.detail);
-      setRemaining(e.detail.timeoutMs ?? 7000);
+      setQueue((q) => [...q, e.detail]);
     };
     window.addEventListener("ados:undo", onUndo);
     return () => window.removeEventListener("ados:undo", onUndo);
   }, []);
 
   useEffect(() => {
-    if (!evt) return;
+    if (!evt) { setRemaining(0); return; }
+    setRemaining(evt.timeoutMs ?? 7000);
     if (tickRef.current) clearInterval(tickRef.current);
     tickRef.current = setInterval(() => {
       setRemaining((r) => {
         const next = r - 100;
         if (next <= 0) {
           if (tickRef.current) clearInterval(tickRef.current);
-          setEvt(null);
+          setQueue((q) => q.slice(1));
           return 0;
         }
         return next;
@@ -64,13 +69,13 @@ export function UndoToast() {
           <button
             onClick={async () => {
               await evt.undo();
-              setEvt(null);
+              setQueue((q) => q.slice(1));
             }}
             className="flex items-center gap-1.5 text-[12px] font-semibold uppercase tracking-wide text-live hover:bg-live/10 px-2 py-1"
           >
             <Undo2 size={12} /> Undo
           </button>
-          <button onClick={() => setEvt(null)} className="text-ink-faint hover:text-ink" aria-label="Dismiss">
+          <button onClick={() => setQueue((q) => q.slice(1))} className="text-ink-faint hover:text-ink" aria-label="Dismiss">
             <X size={14} />
           </button>
         </div>

lib/local-sync.ts

@@ -11,7 +11,10 @@
  * API keys are NOT synced by default (security). Toggle in Settings to include.
  */
 
-const SYNC_URL = "http://localhost:3006";
+// 127.0.0.1 instead of "localhost" so IPv6-preferring systems (some Windows
+// configs) don't resolve to ::1 while the sidecar listens on 127.0.0.1 only.
+// Matches url-ingest.ts. (Audit finding #49.)
+const SYNC_URL = "http://127.0.0.1:3006";
 const SYNC_DEBOUNCE_MS = 1500;
 const LS_INCLUDE_KEYS = "ados.sync_include_keys";
 const LS_LAST_SYNC = "ados.sync_last_at";

lib/prompts/audience-targeting.ts

@@ -10,6 +10,10 @@ export interface AudienceTargetingInput {
   current_aov_or_ltv?: string;
   existing_audiences?: string;
   best_creator_audience?: string;
+  /** Screenshot of the Audiences tab — when present, vision-capable providers
+   *  read it. When absent, the "IF AN IMAGE IS ATTACHED" block is stripped so
+   *  the AI doesn't hallucinate audience data. (Audit finding #45.) */
+  audience_screenshot?: unknown;
 }
 
 import { RETARGETING_MATRIX, MANDATORY_EXCLUSIONS } from "./common-rules";
@@ -43,12 +47,12 @@ INPUT — audiences currently running (name · monthly spend · CPA, one per lin
 ${input.existing_audiences || "(none provided — treat the plan as a fresh launch)"}
 """
 
-IF AN IMAGE IS ATTACHED:
-The user has dropped a screenshot of their Audiences tab (Meta Ads Manager / Google Audiences /
+${input.audience_screenshot ? `IMAGE ATTACHED:
+The user dropped a screenshot of their Audiences tab (Meta Ads Manager / Google Audiences /
 LinkedIn). Extract for each visible row: audience name, audience size, spend, impressions, CPA,
 CVR. When typed fields and image conflict, trust the image. When metrics only appear in the image,
 USE the image values. Cite "(from screenshot)" in audience_diagnosis when image-derived data drives
-a tier or budget recommendation.
+a tier or budget recommendation.` : ``}
 
 PHASE 1 — ANALYZE THE EXISTING SETUP:
 For each audience already running: