fix: real bugs found in audit pass

Followed up the audit with concrete fixes for what was actually broken:

1. BLOCKER — desktop & Android releases shipped with empty Supabase env.
   .github/workflows/main.yml passed GH_TOKEN to all four platform build
   steps but never VITE_SUPABASE_URL / VITE_SUPABASE_ANON_KEY. Result:
   the bundled app called createClient("", "") and isSupabaseConfigured
   returned false, so the installed desktop app had no cloud features at
   all and Account/Workspaces showed "sign in" with no working sign-in.
   Now passed on Win / Mac / Linux / Android.

2. captureStore.loadItems() was only called by CapturePage's useEffect.
   Quick Capture (Ctrl+Shift+S from anywhere) and the command palette
   read the same store. If the user used those before visiting the Saved
   tab, the store was [] in memory while localStorage had content —
   making it look like Saved messages were silently failing. App.tsx
   now pre-loads captureStore + flowsStore at boot.

3. MarkdownRenderer (used by AI chat for assistant replies) wrote raw
   markdown HTML through dangerouslySetInnerHTML without sanitization.
   renderMarkdown escapes inline text but inline HTML in the input would
   leak through. Now wrapped with DOMPurify (same config as the public
   note share page).

4. package.json bumped to 3.2.1 — tagging this immediately so the next
   release build picks up #1.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Author: AzizX-coder

.github/workflows/main.yml

@@ -40,6 +40,13 @@ jobs:
           npx electron-builder --win --config.directories.output=release
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          # Bake Supabase + tldraw env vars into the desktop bundle so the
+          # installed app actually connects to the cloud. Without these, the
+          # built app shows "Sign in" but isSupabaseConfigured is false.
+          VITE_SUPABASE_URL: ${{ secrets.VITE_SUPABASE_URL }}
+          VITE_SUPABASE_ANON_KEY: ${{ secrets.VITE_SUPABASE_ANON_KEY }}
+          VITE_TLDRAW_LICENSE_KEY: ${{ secrets.VITE_TLDRAW_LICENSE_KEY }}
+          VITE_OPENROUTER_API_KEY: ${{ secrets.VITE_OPENROUTER_API_KEY }}
 
       - name: Generate SHA-256 checksums
         shell: pwsh
@@ -84,6 +91,10 @@ jobs:
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           CSC_IDENTITY_AUTO_DISCOVERY: "false"
+          VITE_SUPABASE_URL: ${{ secrets.VITE_SUPABASE_URL }}
+          VITE_SUPABASE_ANON_KEY: ${{ secrets.VITE_SUPABASE_ANON_KEY }}
+          VITE_TLDRAW_LICENSE_KEY: ${{ secrets.VITE_TLDRAW_LICENSE_KEY }}
+          VITE_OPENROUTER_API_KEY: ${{ secrets.VITE_OPENROUTER_API_KEY }}
 
       - name: Generate SHA-256 checksums
         run: |
@@ -122,6 +133,10 @@ jobs:
           npx electron-builder --linux --config.directories.output=release
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          VITE_SUPABASE_URL: ${{ secrets.VITE_SUPABASE_URL }}
+          VITE_SUPABASE_ANON_KEY: ${{ secrets.VITE_SUPABASE_ANON_KEY }}
+          VITE_TLDRAW_LICENSE_KEY: ${{ secrets.VITE_TLDRAW_LICENSE_KEY }}
+          VITE_OPENROUTER_API_KEY: ${{ secrets.VITE_OPENROUTER_API_KEY }}
 
       - name: Generate SHA-256 checksums
         run: |
@@ -164,6 +179,11 @@ jobs:
 
       - name: Build web app
         run: npx vite build
+        env:
+          VITE_SUPABASE_URL: ${{ secrets.VITE_SUPABASE_URL }}
+          VITE_SUPABASE_ANON_KEY: ${{ secrets.VITE_SUPABASE_ANON_KEY }}
+          VITE_TLDRAW_LICENSE_KEY: ${{ secrets.VITE_TLDRAW_LICENSE_KEY }}
+          VITE_OPENROUTER_API_KEY: ${{ secrets.VITE_OPENROUTER_API_KEY }}
 
       - name: Add & sync Capacitor Android platform
         run: |

package.json

@@ -1,6 +1,6 @@
 {
   "name": "delay",
-  "version": "3.2.0",
+  "version": "3.2.1",
   "description": "Notes, tasks, calendar & AI — beautifully organized.",
   "author": "AzizX-coder",
   "license": "Apache-2.0",

src/App.tsx

@@ -122,6 +122,13 @@ export default function App() {
     async function init() {
       await initSettings();
       await initTheme();
+      // Pre-load stores whose page might not be visited but whose data
+      // we still need warm (Quick Capture modal writes to captureStore, the
+      // command palette searches its items, etc.). Without this, opening
+      // QuickCapture before ever visiting the Saved page silently writes
+      // into an empty in-memory list and the user thinks Saved is broken.
+      try { (await import("@/stores/captureStore")).useCaptureStore.getState().loadItems(); } catch {}
+      try { (await import("@/stores/flowsStore")).useFlowsStore.getState().loadFlows(); } catch {}
       setReady(true);
       const timer = setTimeout(() => setShowSplash(false), 600);
       return () => clearTimeout(timer);

src/components/ui/MarkdownRenderer.tsx

@@ -1,12 +1,27 @@
 import { useMemo } from "react";
+import DOMPurify from "dompurify";
 
 interface MarkdownRendererProps {
   content: string;
   className?: string;
 }
 
+/**
+ * Renders Markdown as HTML. `renderMarkdown` already escapes inline text,
+ * but Markdown that comes from AI / shared notes / a chat partner can
+ * include raw HTML in unexpected places. We pass the result through
+ * DOMPurify so even a clever payload can't smuggle <script>, <iframe>,
+ * or onerror attributes into the page.
+ */
 export function MarkdownRenderer({ content, className = "" }: MarkdownRendererProps) {
-  const html = useMemo(() => renderMarkdown(content), [content]);
+  const html = useMemo(() => {
+    const raw = renderMarkdown(content);
+    return DOMPurify.sanitize(raw, {
+      USE_PROFILES: { html: true },
+      FORBID_TAGS: ["style", "form", "input", "textarea", "button", "iframe", "object", "embed", "script"],
+      FORBID_ATTR: ["onerror", "onload", "onclick", "onmouseover", "onfocus", "style"],
+    });
+  }, [content]);
 
   return (
     <div