Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@apps/desktop/src/main/index.ts`:
- Around line 2484-2495: Extract the deep-link token extraction and
queuing/sending logic into a shared function (e.g., processDeepLink or
handleAuthLink) that takes a token/URL, looks up the ready BrowserWindow via
BrowserWindow.getAllWindows().find(...), and either sends 'auth:verify-token' to
webContents or assigns pendingAuthToken; then invoke this new function from both
the macOS open-url handler and from the app startup argv parsing and the
app.on('second-instance', ...) handler so Windows/Linux cold-start and
second-instance protocol links are handled the same way as the existing macOS
flow.
- Around line 2484-2495: Replace the transient lookup via
BrowserWindow.getAllWindows().find(...) with a module-level mainWindow reference
(same pattern as settingsWindow): ensure mainWindow is assigned when the app
creates the primary window, then in the auth delivery path only target that
mainWindow (check !mainWindow.isDestroyed() &&
mainWindow.webContents.isLoading() === false) before calling
mainWindow.webContents.send('auth:verify-token', token), mainWindow.show(),
mainWindow.focus(); if mainWindow is undefined or not ready, set
pendingAuthToken = token (do not send to any other window). Ensure any existing
uses of the local mainWin are updated to use the module-level mainWindow
variable.

In `@apps/desktop/src/renderer/components/sync/LoginModal.tsx`:
- Around line 107-108: The modal is plain divs and the email input relies on
placeholder text causing accessibility issues; update the LoginModal component
so the container uses proper dialog semantics (add role="dialog" and
aria-modal="true" on the modal element and ensure the overlay remains clickable
for dismiss via handleClose), add a visible or visually-hidden heading inside
the modal (e.g., <h2> sign-in title) with an id and set aria-labelledby on the
modal to that id, and replace the placeholder-only email input with a properly
associated label (or give the input an aria-labelledby/aria-label tied to the
new heading or a dedicated label element) so screen readers get a stable name;
apply the same changes to the other modal instance referenced around lines
148-159 in the same file (same component/markup patterns).
- Around line 88-98: The resend action currently waits for requestMagicLink to
resolve before starting the cooldown, allowing multiple clicks; modify
handleResend (and the other resend handler that calls requestMagicLink) to
disable the action immediately by setting a local pending flag (e.g.,
isResending via useState) or by calling setResendTimer(RESEND_COOLDOWN) before
awaiting requestMagicLink, then await requestMagicLink, and in a finally block
clear the pending flag or, on error, reset the timer and call setError(err
instanceof Error ? err.message : 'Failed to resend') so the button is unblocked
only after success/failure is handled.

In `@apps/desktop/src/renderer/styles/global.css`:
- Around line 1491-1539: The onboarding prompt (.sidebar-sync-prompt) is missing
-webkit-app-region: no-drag so its buttons can receive clicks in custom-titlebar
builds; update the CSS for .sidebar-sync-prompt (and optionally
.sidebar-sync-prompt-actions) to include -webkit-app-region: no-drag alongside
existing rules so the prompt and its action container opt out of the draggable
sidebar region and allow button interaction.

In `@apps/web/app/`(marketing)/auth/verify/AuthVerifyContent.tsx:
- Around line 29-39: The two inline SVGs in the AuthVerifyContent component are
missing accessible labels; either add an explicit <title> with a unique id and
set role="img" plus aria-labelledby to expose meaningful labels for screen
readers, or mark purely decorative SVGs as aria-hidden="true" and
focusable="false"; update both SVG instances in AuthVerifyContent (the
error/close icon and the other inline SVG) accordingly so they pass a11y
linting.

In `@apps/web/app/globals.css`:
- Around line 142-143: The CSS triggers a stylelint rule
"declaration-empty-line-before" between the `@apply` directive and the subsequent
box-shadow declaration; fix by inserting a blank line between the `@apply` rule
(the line containing "@apply bg-surface border border-accent/30 rounded-xl;")
and the "box-shadow" declaration (the line with "box-shadow: 0 0 40px
var(--color-accent-glow);"), or alternatively update the stylelint rule
configuration if you prefer no blank line.
- Around line 56-58: The global attribute selector [data-active='true'] is too
broad and causes style bleed; narrow its scope by qualifying it with a
component- or region-specific ancestor (e.g., .your-component
[data-active='true'] or .nav [data-active='true']) so only intended elements get
the purple color, and update any places that relied on the global selector to
use the new scoped selector (reference the existing [data-active='true']
selector to locate and replace).
- Around line 264-271: The reduced-motion media query omits the
.animate-fade-in-up selector so that fade-in-up animations still run for users
who request reduced motion; update the `@media` (prefers-reduced-motion: reduce)
selector list in globals.css to include .animate-fade-in-up (the same place
where .animate-shiny-text, .animate-marquee, etc. are listed) so the fade-in-up
animation is disabled for reduced-motion preferences.
- Around line 187-189: Stylelint is flagging valid Tailwind v4 at-rules like
`@utility` and `@theme`; update the Stylelint config (.stylelintrc.json) to adjust
the at-rule-no-unknown rule by adding ignoreAtRules and include "theme",
"utility", "apply", "import", and "tailwind" so `@utility` and `@theme` blocks in
globals.css no longer error; modify the "rules" object to set at-rule-no-unknown
to ["error", { "ignoreAtRules": ["theme","utility","apply","import","tailwind"]
}].

In `@apps/web/components/FaqAccordion.tsx`:
- Around line 39-52: The map callback defines an unused parameter `index`
causing an ESLint warning; remove the unused parameter by changing the map
callback signature from items.map((item, index) => ...) to items.map((item) =>
...), keeping the rest of the JSX (AccordionItem, AccordionTrigger,
AccordionContent) unchanged so keys and value generation still use
item.question.

In `@apps/web/components/Footer.tsx`:
- Around line 38-61: The inline SVG icons for the social links (the icon nodes
for labels 'GitHub', 'X', and 'Blog' in Footer.tsx) are missing accessible
titles; insert a <title> element inside each SVG with a descriptive name (e.g.,
"GitHub", "X", "Blog") so screen readers can announce them, or alternatively add
aria-hidden="true" to each SVG if you want the parent anchor's aria-label to be
the sole accessible name; update the SVG elements where label: 'GitHub' / label:
'X' / label: 'Blog' are defined accordingly.

In `@apps/web/components/landing/CreatorStory.tsx`:
- Line 45: The Tailwind classes on the Github icon in CreatorStory.tsx use
invalid tokens `h-4.5 w-4.5`; update the Github element(s) (the JSX where
<Github className="h-4.5 w-4.5" /> appears) to use valid spacing tokens such as
`h-5 w-5` or explicit values like `h-[18px] w-[18px]`; make the same replacement
for the other two occurrences of the Github icon in this component (the other
<Github ... /> instances currently using `h-4.5 w-4.5`).

In `@apps/web/components/landing/Hero.tsx`:
- Line 28: The hero currently uses PLACEHOLDER_VIDEO in the Hero component to
power the interactive preview; remove/stop using that placeholder by disabling
the demo affordance until a real demo exists: update Hero to conditionally
render the modal trigger and prevent opening (e.g., gated by a boolean like
hasDemo or omit calling setIsOpen) when PLACEHOLDER_VIDEO is still set, or
replace the interactive iframe preview with a static fallback (thumbnail/image
or disabled button) so no placeholder URL is loaded; ensure you update any other
occurrences of PLACEHOLDER_VIDEO or modal-opening logic (e.g., the modal
component or state setters used for the preview) in the same file to match this
behavior.
- Around line 167-209: Replace the manual backdrop/modal implementation that
uses isVideoOpen, setIsVideoOpen, AnimatePresence and motion.div with a Radix
Dialog primitive: use Dialog.Root controlling open state, Dialog.Trigger for
opening, Dialog.Portal/Dialog.Overlay for the backdrop (remove role="button" and
manual onKeyDown handlers), Dialog.Content for the centered video container
(keep motion animations if desired but wrap them inside Radix primitives), and
Dialog.Close for the XIcon button (add an explicit aria-label like "Close
video"); ensure focus is trapped/restored by Radix and preserve the iframe
(PLACEHOLDER_VIDEO) inside Dialog.Content while keeping onClick stopPropagation
on the inner container to prevent overlay close.

In `@apps/web/components/landing/Testimonials.tsx`:
- Around line 7-52: The testimonials currently render the hard-coded "reviews"
array as named, real-looking customer quotes (const reviews) which must not be
shipped; either remove or neutralize these fabricated entries: replace the
objects in reviews with non-identifiable demo placeholders (e.g., anonymous
roles like "Product User", generic text or marketing-safe copy) or gate the
entire Testimonials component behind a feature flag/ENV check so it does not
render in production until real, verified quotes are provided; update the
component that consumes reviews (Testimonials) to use the new placeholder data
or early-return when the flag is off.

In `@apps/web/components/landing/VideoGuides.tsx`:
- Around line 51-56: Replace the interactive button with a non-interactive
element (or disable it) when there is no video: check the hasVideo boolean
(derived from videoSrc) and if false render a div/span wrapper (or render the
same button element with disabled and aria-disabled="true" and remove the
onClick handler) so the item is not keyboard-focusable or clickable; ensure you
adjust the element that currently uses setIsOpen (the onClick tied to setIsOpen)
and preserve styling (className) while adding a clear non-interactive state
(cursor-default, no pointer events) for the component in VideoGuides.tsx.
- Around line 103-139: Replace the backdrop div/dialog markup in VideoGuides.tsx
with proper dialog semantics: when isOpen && hasVideo render a container with
role="dialog" and aria-modal="true", move the Escape key handling out of the
backdrop onKeyDown into a document/keydown handler (or use a focus-trap library)
so Escape closes via setIsOpen regardless of which element has focus, implement
focus management to move focus into the dialog on open and restore the
previously focused element on close, trap tab focus inside the dialog while open
and prevent background scrolling, and give the icon-only close button (the XIcon
button) an accessible name (e.g., aria-label="Close video") so it is
keyboard/screen-reader operable; keep the iframe usage but ensure it does not
steal initial focus.

In `@apps/web/components/landing/WhyLocal.tsx`:
- Around line 272-293: The table in WhyLocal.tsx (the <table className="w-full
text-sm"> inside the component rendering rows and CellValue) lacks an accessible
name; add a concise caption element or an aria-label on the table to describe
its purpose (for example "Feature comparison: Readied vs Cloud Apps") so screen
readers announce the table's purpose before its contents; update the JSX to
include either a visually hidden <caption> or an aria-label attribute on that
table element accordingly.

In `@apps/web/components/magicui/animated-beam.tsx`:
- Around line 87-100: The ResizeObserver only observes containerRef so the beam
path (computed in updatePath using fromRef and toRef bounding rects) can become
stale when those endpoints resize; update the effect to observe fromRef.current
and toRef.current as well (or add a window 'resize' fallback) by attaching the
same ResizeObserver to each element if present and disconnecting them all in the
cleanup, ensuring updatePath is called on observations for containerRef,
fromRef, and toRef.
- Around line 103-110: The decorative SVG in the AnimatedBeam component should
be hidden from assistive technologies; update the <svg> element (the SVG in
animated-beam.tsx that uses svgDimensions and className) to include
aria-hidden="true" so screen readers ignore it, preserving existing attributes
and behavior.

In `@apps/web/components/magicui/animated-grid-pattern.tsx`:
- Around line 117-129: The current key for motion.rect in the squares.map uses
position-based values (`key={`${x}-${y}-${index}`}`) which changes when
updateSquarePosition mutates pos and causes React to remount the element; change
the key to use the stable square identifier instead (use the square's id) in the
map that renders motion.rect so the element identity remains stable across
position updates (update the key prop in the render inside squares.map where
motion.rect and onAnimationComplete call updateSquarePosition).
- Line 54: The initial call to useState(() => generateSquares(numSquares)) runs
while dimensions is {width: 0, height: 0}, causing getPos to compute invalid
positions (all [0,0]); change the initialization to start with an empty array
and populate squares once real dimensions are available: update the useState for
squares to initialize to [] and modify the existing useEffect that depends on
dimensions (the one that currently calls setSquares) to call
generateSquares(numSquares) only when dimensions.width and dimensions.height are
> 0, using setSquares to replace the empty array; reference functions/vars
generateSquares, getPos, dimensions, setSquares, and the useEffect that runs on
dimension changes.

In `@apps/web/components/magicui/animated-shiny-text.tsx`:
- Around line 8-32: AnimatedShinyText currently sets a style with the CSS
variable (--shiny-width) and then spreads {...props}, so a caller's style prop
can overwrite it; to fix, destructure style from props (e.g., const { style,
...rest } = props) and merge them when rendering (apply componentStyle = {
'--shiny-width': `${shimmerWidth}px`, ...style } or equivalent) so the
component-controlled --shiny-width is preserved while still honoring
caller-provided styles, then spread the remaining props (rest) onto the span;
reference AnimatedShinyText, shimmerWidth, props, and the inline style that sets
'--shiny-width'.

In `@apps/web/components/magicui/border-beam.tsx`:
- Around line 76-100: The beam currently always animates; detect reduced-motion
preferences (e.g., import and call useReducedMotion from 'framer-motion' or use
matchMedia('(prefers-reduced-motion: reduce)') ) inside the BorderBeam component
and, when reduced motion is requested, avoid the infinite animation by not
passing an animate/transition or by setting initial and animate to the same
static offsetDistance value (use the computed `${initialOffset}%` or `${100 -
initialOffset}%`/`${-initialOffset}%` depending on reverse) so the motion.div
stays static; update the motion.div usage (the initial/animate/transition props)
to branch on the reduced-motion flag and ensure
style.offsetPath/width/--color-from/--color-to remain unchanged.

In `@apps/web/components/magicui/dot-pattern.tsx`:
- Around line 21-64: The DotPattern component currently uses width and height
directly in grid math which will break if width or height are zero/negative; in
the DotPattern function validate and normalize props before calculating dots
(e.g., coerce width/height to a positive minimum like 1 or bail out), and use
those safe values in the Array.from length and in the col/row computation
(references: DotPattern, width, height, dimensions, dots variable) so you never
divide by or mod by zero and rendering won't fail.

In `@apps/web/components/magicui/hero-video-dialog.tsx`:
- Around line 111-132: Overlay currently uses role="button" and closes via
bubbling; change the outer motion.div to role="dialog" with aria-modal="true"
and an accessible label (aria-labelledby or aria-label), and restrict closing:
keep Escape handling but ensure it only closes when the event is for the dialog
(attach onKeyDown to the dialog or check e.key === 'Escape'), and change the
onClick close behavior to only close when the click target is the overlay itself
(compare event.target === event.currentTarget) so clicks inside the inner
motion.div (the element using selectedAnimation) don’t bubble out; make the
close control an explicit interactive button (the motion.button) with an onClick
handler that calls setIsVideoOpen(false), add an aria-label (e.g., "Close video
dialog"), and mark the XIcon as aria-hidden to avoid duplicate announcement.
- Around line 88-94: Replace the plain <img> in hero-video-dialog.tsx with
Next.js' optimized Image component: import Image from "next/image", then render
<Image> using the existing thumbnailSrc and thumbnailAlt props and the same
width/height and className; add appropriate Image props such as priority or
sizes for a large hero image (or explicitly pass unoptimized if you have a
reason to skip optimization) to enable automatic responsive loading and
optimization. Ensure you update any surrounding attributes or styling expected
by the current img (className "w-full rounded-xl..." and width/height values) so
the visual output remains unchanged.

In `@apps/web/components/magicui/marquee.tsx`:
- Around line 45-74: The marquee currently always renders repeated animated
copies; detect prefers-reduced-motion and collapse to one static copy by (1)
making repeated items non-render/hidden in reduced-motion: update the mapping
over Array(safeRepeat) so duplicates (i > 0) get a class like
'motion-reduce:hidden' and the animated container also gets
'motion-reduce:animate-none' (or remove animation CSS) so motion is disabled;
(2) ensure accessibility for hidden duplicates by retaining aria-hidden and
tabIndex: -1 on duplicates (the existing {...(i > 0 ? { 'aria-hidden': true,
tabIndex: -1 } : {})}); and (3) optionally make safeRepeat respect reduced
motion by checking window.matchMedia('(prefers-reduced-motion: reduce)') in a
small effect/hook and setting safeRepeat to 1 during SSR-safe initialization —
update references to safeRepeat, the duplicated inner div key/i check, and the
container classnames to implement these changes.

In `@apps/web/components/magicui/number-ticker.tsx`:
- Around line 53-56: The number formatting is hardcoded to 'en-US' in the
ref.current.textContent assignment (and similarly at the other formatting site
around lines 71-74), which breaks i18n; update the NumberTicker component to
accept an optional locale prop (e.g., locale?: string) and use that when
creating Intl.NumberFormat, falling back to undefined to use the user's browser
locale if no prop is provided, and update both places where Intl.NumberFormat is
constructed to reference this prop (or undefined) instead of the literal
'en-US'.
- Around line 53-56: Refactor the assignment to ref.current.textContent in
number-ticker.tsx to remove the redundant toFixed call: instead of
Number(latest.toFixed(decimalPlaces)) pass the numeric value (e.g.,
Number(latest) or latest if already a number) directly into Intl.NumberFormat
with minimumFractionDigits/maximumFractionDigits set to decimalPlaces; update
the expression in the ref.current.textContent assignment that references latest
and decimalPlaces to rely on Intl.NumberFormat for precision rather than using
toFixed.

In `@apps/web/components/magicui/shimmer-button.tsx`:
- Around line 13-46: The ShimmerButton component currently relies on the browser
default button type (submit); update the component to ensure a safe default by
applying type="button" when no type is provided: inside the forwardRef
functional component for ShimmerButton, ensure the rendered <button> uses the
incoming props.type if present, otherwise sets type="button" (e.g., set a
default via destructuring or coalesce before spreading props) so accidental form
submissions are prevented while preserving any explicit type passed to
ShimmerButton.

In `@apps/web/components/magicui/text-reveal.tsx`:
- Around line 12-49: Detect the user's reduced-motion preference (e.g., via
framer-motion's useReducedMotion or window.matchMedia('(prefers-reduced-motion:
reduce)') ) inside the TextReveal component and when reduced motion is requested
skip the scroll-driven animation: do not call/use the
scrollYProgress/useScroll-driven Word animation, and instead render the children
as plain static text (no 200vh wrapper or sticky animated layout) preserving
className and accessibility; update TextReveal to branch (reducedMotion ? static
render : existing animated render) so Word and scrollYProgress are not used when
reduced motion is enabled.

In `@apps/web/components/Navbar.tsx`:
- Around line 117-137: The Docs dropdown button in Navbar is missing ARIA
attributes; add aria-haspopup="true" to the button element (the button rendering
"Docs" with class navLinkClass) and either implement a controlled open state
(e.g., isDocsOpen boolean in the Navbar component, toggle it in the button's
onClick and set aria-expanded={isDocsOpen}, and replace CSS
group-hover/group-focus-within toggles with classnames driven by isDocsOpen) or,
for a minimal fix, at least add aria-haspopup="true" to the existing button so
screen readers know it opens a menu.
- Around line 245-268: In the section rendering links (inside section.links.map
in Navbar.tsx) simplify the conditional that currently uses "'external' in link
&& link.external" to just check "link.external"; update the ternary that chooses
between the <a> with ExternalIcon and the <Link> to use "link.external" as the
predicate so external undefined/false behaves correctly and keep the rest
(closeSheet, href, rel, target, className) unchanged.
- Around line 69-84: Replace the hardcoded hex color in the ExternalIcon SVG by
using the design system's semantic text color class (e.g., replace
className="... text-[`#71717a`]" with the appropriate token such as
"text-text-secondary" or "text-muted-foreground") in the ExternalIcon component;
locate other occurrences of the same hex string elsewhere in this file (the
other inline SVG/icon usages that also use "#71717a") and apply the same swap so
all icons use the semantic token consistently.

In `@apps/web/components/ui/button.tsx`:
- Around line 31-39: The Button component forwards a default type prop
unconditionally which leaks button-only attributes onto non-button renderings
when asChild is true; update the render logic in Button (the forwardRef function
using asChild and Comp/Slot) to only pass type={type} when rendering a real
button (i.e., when asChild is false or Comp === 'button'), omitting the type
prop for the Slot branch so anchors/Next Link children don't receive button-only
props.

In `@apps/web/mdx-components.tsx`:
- Around line 11-28: Export a plain mdxComponents object that merges
defaultComponents with the explicit component registry (Card, Cards, Callout,
Step, Steps, Tab, Tabs, Accordion, Accordions, File, Folder, Files, TypeTable)
and then change useMDXComponents to build on that by returning
{...mdxComponents, ...components}; update the module to export both
mdxComponents and useMDXComponents so the docs runtime can import the base
registry directly while the hook still supports runtime overrides.

In `@docs/plans/2026-03-12-roadmap-auth-sync-ai.md`:
- Around line 9-17: The roadmap still marks GET /auth/me with bad JWT as
returning 500 and flagged as a bug—update the table entry for `GET /auth/me` to
show 401 Unauthorized (remove the **Bug** marker and change the Notes to
indicate the invalid-JWT handling was fixed in this PR), and make the same
change to the duplicate occurrence further down (the block currently referenced
around lines 57–60) so both entries reflect the fix.

In `@docs/plans/2026-03-12-website-redesign-design.md`:
- Around line 116-130: The markdown code fence for the file tree under
"apps/web/" is missing a language tag which triggers MD040; update the
triple-backtick fence to include a language (use "text") so the block becomes
```text at the start and ``` at the end; locate the fenced block that begins
with "apps/web/" (contains components/, lib/, app/, globals.css, layout.tsx) and
add the language tag to fix the lint error.

In `@docs/plans/2026-03-12-website-redesign-implementation.md`:
- Around line 438-452: The fenced code block containing the "Structure:" ASCII
tree triggers markdownlint MD040 because it has no language; update that block
by adding a language identifier (e.g., change the opening triple backticks to
```text) for the block that starts with "Structure:" so the linter recognizes it
and MD040 is resolved.

---

Outside diff comments:
In `@apps/web/app/`(marketing)/auth/verify/AuthVerifyContent.tsx:
- Around line 14-22: The deep-link is built with the raw token which can produce
malformed readied:// URLs; update the places that construct the deep-link (the
assignment to window.location.href in the useEffect and the other occurrence
around lines 85-87) to URL-encode the token using encodeURIComponent(token)
before interpolating it into `readied://auth/verify?token=...` so the token is
safely escaped when building the deep link.

In `@apps/web/app/`(marketing)/download/page.tsx:
- Around line 13-15: The metadata.title/description in the Download page uses
both "Try free for {config.trialDays} days" and "Free forever", which conflicts
with the product pricing; update the copy in the metadata object (and the
corresponding marketing text block later in the same file around the download
page content) to match the actual model in packages/product-config/src/facade.ts
(e.g., use either a trial-focused message that references config.trialDays or a
perpetual free-tier message), then propagate the same wording to the related
marketing/legal templates (terms.astro, privacy.astro) so messaging is
consistent across metadata, the page content, and legal pages.

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@apps/desktop/src/main/index.ts`:
- Around line 302-311: The current delivery on
mainWindow.webContents.on('did-finish-load') can race with the renderer
listener; change it to perform a handshake: when did-finish-load fires and
pendingAuthToken exists, register a one-time ipcMain listener for an
'auth:listener-ready' message (use webContents.once/ ipcMain.once tied to
mainWindow.webContents.id) and only then send 'auth:verify-token' with
pendingAuthToken via mainWindow.webContents.send; clear pendingAuthToken only
after the send completes (or immediately after sending but not before the
listener handshake), add a short timeout fallback to log and avoid dropping the
token, and keep references to symbols pendingAuthToken,
mainWindow.webContents.on('did-finish-load'), and the IPC channels
'auth:listener-ready' and 'auth:verify-token' to implement the fix.

In `@apps/desktop/src/renderer/components/sidebar/Sidebar.tsx`:
- Around line 22-23: Reorder the imports so external modules and hooks come
before local component imports: move the imports for EnableSyncModal and
useSyncOnboarding so they appear above the local SidebarHeader (and other
sibling ./ imports) in Sidebar.tsx; ensure the import groupings follow the
linter rule (third-party/hooks first, then local components) to satisfy ESLint
import order.

In `@apps/desktop/src/renderer/components/sync/index.ts`:
- Line 9: The export re-exports EnableSyncModal from './LoginModal' but the
filename no longer matches the component name; rename the source file
LoginModal.tsx to EnableSyncModal.tsx and update any imports/exports to use the
new filename so the export line export { EnableSyncModal } from './LoginModal';
becomes consistent with the module name; ensure the component
declaration/exports inside the renamed file still export EnableSyncModal (named
export or default converted appropriately) and update any other files importing
'./LoginModal' to the new './EnableSyncModal'.

In `@apps/desktop/src/renderer/components/sync/LoginModal.module.css`:
- Around line 213-217: Remove the two `!important` usages on the .hint rule by
replacing the generic selector with a more specific one (e.g., use `.sent
.hint`) so specificity resolves without forcing styles; update the CSS rule for
the hint (the existing `.hint` block) to move margin-top and color/font-size
into the more-specific selector (`.sent .hint`) and leave or reduce the base
`.hint` styles as needed to avoid using `!important`.

In `@apps/desktop/src/renderer/components/sync/LoginModal.tsx`:
- Line 171: Remove the inline autoFocus attribute from the input in LoginModal
and instead manage focus imperatively: add a ref (e.g., loginInputRef) to the
input and a useEffect inside the LoginModal component that, when the modal
becomes visible (the same condition that shows the modal after clicking "Enable
Sync"), calls loginInputRef.current.focus() after a short delay (setTimeout or
requestAnimationFrame) to avoid interrupting screen readers; ensure to clean up
timers and only focus when the modal is mounted/visible.

In `@apps/desktop/src/renderer/hooks/useSyncOnboarding.ts`:
- Line 21: The variable totalNotes is misleading and the type assertion is
unnecessary; update the logic around the counts variable so it either (a) reads
the intended total via counts?.total if you really need the total, or (b) rename
totalNotes to activeNotes and use counts?.active without the (counts as {
active?: number }) cast. Locate the assignment to totalNotes in
useSyncOnboarding and change the identifier and expression accordingly (remove
the explicit type assertion and use counts?.active or counts?.total as
appropriate), and update any downstream references to the renamed variable.

In `@apps/web/app/`(marketing)/auth/verify/AuthVerifyContent.tsx:
- Line 14: The token is inserted into a custom-protocol URL without encoding;
update both occurrences (the window.location.href assignments in
AuthVerifyContent.tsx) to embed encodeURIComponent(token) instead of raw token
so special characters are URL-encoded and cannot break parsing or introduce
injection issues.

In `@apps/web/components/FaqAccordion.tsx`:
- Around line 39-44: The current slug generation in the items.map →
AccordionItem value prop uses item.question.slice(0,
40).toLowerCase().replace(...) which can produce duplicate values for questions
with the same first 40 chars; update the value to guarantee uniqueness by
appending a stable suffix (e.g., the loop index or a short hash) so each
AccordionItem gets a unique value (reference the items.map callback,
AccordionItem, and the existing value generation expression) — for example use
`faq-${i}` or `faq-${normalizedQuestion}-${i}` to avoid collisions while
preserving readable slugs.

In `@apps/web/components/magicui/border-beam.tsx`:
- Around line 3-5: Remove the extra blank line between the two import statements
so the imports are contiguous (i.e., put "import { motion, type MotionStyle,
type Transition, useReducedMotion } from 'framer-motion';" immediately above
"import { cn } from '@/lib/utils';") to satisfy the ESLint import-order/style
rule; ensure no other spacing changes are introduced and run lint to confirm the
warning is resolved.

In `@docs/plans/2026-03-12-roadmap-auth-sync-ai.md`:
- Around line 114-125: The two fenced code blocks in the doc are missing
language tags (markdownlint MD040); update both blocks so the directory tree
block (the one containing "renderer/components/CommandK/ ... useCommandK.ts" and
"packages/ai-assistant/src/ ... registry.ts") and the action flow block ("Select
text → Cmd+K → \"Summarize\" → AI streams result → Preview → \"Insert\" →
Replaces selection") start with ```text (i.e., replace ``` with ```text) so the
linter is satisfied.
- Around line 48-51: The Markdown table under the "Files to change" heading
lacks a blank line (violates MD058); edit the document and insert a single empty
line between the "Files to change" heading and the table so the table is
separated from the preceding paragraph/heading—this affects the table that
references renderer/components/sync/LoginModal.tsx (redesign as "Enable Sync"
modal).

In `@packages/api/src/index.ts`:
- Around line 75-78: When handling HTTPException, normalize the returned body
from err.getResponse() into a JSON object and preserve the status code from
err.getStatus(); specifically, replace the direct return of err.getResponse()
with logic that captures const resp = err.getResponse(); if typeof resp ===
'string' set body = { message: resp }; else if resp is an object ensure it has a
message field (or pass through) and then return the response with the correct
status using err.getStatus() (e.g., res.status(err.getStatus()).json(body) or
the equivalent in this handler), so HTTPException responses match the JSON shape
used by the 404 and generic error handlers.

---

Outside diff comments:
In `@apps/web/components/landing/Testimonials.tsx`:
- Around line 80-84: The figure element in Testimonials.tsx is using the cn()
utility unnecessarily: replace className={cn('relative w-80 shrink-0
overflow-hidden rounded-xl border border-border bg-surface p-5')} with a plain
string className='relative w-80 shrink-0 overflow-hidden rounded-xl border
border-border bg-surface p-5' and then remove the now-unused cn import (or its
usage) to avoid an unnecessary function call.
- Around line 57-65: The Stars component currently renders multiple Star SVGs
that will be announced by screen readers; mark each decorative Star as hidden
from assistive tech by adding aria-hidden="true" (and optionally role="img" if
your SVGs require it) on the rendered Star element inside Stars, and add a
single accessible summary for the rating (e.g., a visually-hidden/sr-only text
like "{count} stars") within the Stars component so screen readers get one
concise announcement instead of multiple SVGs; update the Stars function and the
Star usage accordingly.

In `@apps/web/components/landing/VideoGuides.tsx`:
- Around line 51-64: Replace the interactive wrapper div in the VideoGuides
component with a native button when hasVideo is true: render <button
type="button"> (keeping the same className, onClick={() => setIsOpen(true)}, and
children) and remove role, tabIndex, and custom onKeyDown handling; when
hasVideo is false continue to render a plain <div> with the non-interactive
classes and no click/keyboard handlers. Ensure you still use the same state
updater setIsOpen and preserve the conditional cursor classes and visuals so
behavior and styling remain unchanged.

In `@apps/web/components/magicui/number-ticker.tsx`:
- Around line 17-25: The NumberTicker component is missing the locale prop in
its parameter destructuring and it's not included in the formatting effect
dependencies; update the NumberTicker function signature to destructure locale
from props (alongside value, startValue, direction, delay, className,
decimalPlaces, etc.) and add locale to the useEffect dependency array that
creates/updates the Intl.NumberFormat so the formatter re-runs when locale
changes (refer to NumberTicker and the effect that builds the formatter).
- Around line 50-61: The component is not destructuring the locale prop and the
effect uses locale without declaring it in dependencies; update the component's
parameter destructuring to include locale (so the passed prop is used) and
modify the useEffect dependency array to [springValue, decimalPlaces, locale] so
the Intl.NumberFormat call inside the springValue.on('change', ...) callback
always sees the current locale; ensure you reference the same symbols (locale,
springValue, decimalPlaces, ref) and keep the rest of the NumberTicker component
logic unchanged.

---

Duplicate comments:
In `@apps/desktop/src/main/index.ts`:
- Around line 2484-2494: Current deep-link handling is non-deterministic because
BrowserWindow.getAllWindows().find(...) can return any loaded window and not all
entry points (open-url, second-instance, process.argv cold start) call the same
logic; create a single shared deep-link handler function (e.g.,
handleDeepLink(uriOrToken)) that extracts the token and sends it via
webContents.send('auth:verify-token', token) or sets pendingAuthToken when no
window exists, replace the ad-hoc BrowserWindow.getAllWindows().find(...) usage
with a deterministic getter for the main window (e.g., getMainWindow() or
store/retrieve mainWindowId and use BrowserWindow.fromId(mainWindowId)), and
wire this handler into all entry points (open-url, app.on('second-instance'),
app.whenReady() / process.argv parsing) so all paths route tokens through the
same deterministic flow (use pendingAuthToken only as fallback until
getMainWindow() returns a ready window).

In `@apps/desktop/src/renderer/components/sync/LoginModal.tsx`:
- Line 111: The overlay div in LoginModal.tsx has onClick={handleClose} but no
keyboard handler; add an onKeyDown handler on the same element that checks for
e.key === 'Escape' (or 'Esc') and calls handleClose to dismiss the modal, and
make the overlay focusable (e.g., add tabIndex={0}) so it can receive keyboard
events; update the element with these attributes and ensure the handler
references the existing handleClose function.

In `@apps/desktop/src/renderer/styles/global.css`:
- Around line 1491-1502: The .sidebar-sync-prompt element is missing the
-webkit-app-region: no-drag rule so its interactive controls receive clicks
instead of dragging the window; update the .sidebar-sync-prompt CSS block to
include -webkit-app-region: no-drag (consistent with .sidebar-nav and
.sidebar-footer) so the prompt opts out of the draggable .sidebar region and its
buttons work correctly in custom-titlebar builds.

In `@apps/web/components/landing/Hero.tsx`:
- Around line 29-47: DEMO_VIDEO_URL is empty so the interactive button in
EditorMockWithPlay is tabbable and announced even though it can't open; update
EditorMockWithPlay (and VideoPreview if needed) to check hasVideo and when false
render a non-interactive wrapper (e.g., a <div> with same visual layout) or a
disabled button (set disabled and aria-disabled="true" and remove the onClick)
and surface a “coming soon” visual/aria label; ensure the aria-label and
keyboard focusability reflect the non-interactive state when DEMO_VIDEO_URL ===
''.

In `@apps/web/components/magicui/hero-video-dialog.tsx`:
- Around line 111-124: The modal's keyboard focus management is broken because
the onKeyDown is attached to a non-focusable motion.div so Escape and focus
trapping never work; update the hero video dialog to either reuse the Radix
dialog pattern used in sheet.tsx (e.g., use Radix Dialog primitives to
open/close, trap focus, and restore focus) or make the modal container focusable
and manage focus explicitly: move the Escape handler to a focusable element (or
window keydown handler), call focus() on the dialog root when opening (so the
handler receives events), implement focus trap while isVideoOpen is true, and
restore focus to the original trigger when closing (ensure you update references
to motion.div and setIsVideoOpen accordingly).

In `@apps/web/components/magicui/marquee.tsx`:
- Around line 61-69: The Marquee component still lacks prefers-reduced-motion
support: update the duplicated panel div (the element using key={i} and
className with cn(...)) to include Tailwind motion-reduce utilities so users
with reduced motion are not animated and duplicates are hidden; specifically add
"motion-reduce:animate-none" alongside the
animate-marquee/animate-marquee-vertical classes and add "motion-reduce:hidden"
for duplicate panels (i > 0) so they collapse when motion is reduced, keeping
existing conditionals for vertical, pauseOnHover, and reverse intact.

In `@apps/web/components/ui/button.tsx`:
- Around line 32-40: The component currently always forwards type to Comp (const
Comp = asChild ? Slot : 'button'), which causes type="button" to be passed into
non-button elements when asChild=true; change the render so that the type prop
is only included when rendering a real button (i.e., when asChild is false or
Comp === 'button')—when asChild is true, omit type from the spread so Slot does
not pass it to child anchors/Links; update the JSX around Comp, the asChild prop
handling, and the props spread logic in this component (the function receiving {
className, variant, size, asChild = false, type = 'button', ...props }, ref) to
conditionally apply type.

In `@docs/plans/2026-03-12-roadmap-auth-sync-ai.md`:
- Line 16: Update the docs entry for the endpoint labeled "`GET /auth/me` + bad
JWT" so it reflects the backend change returning 401 instead of 500; find both
occurrences that currently state "**500** | **Bug**: should return 401, not 500"
(one near the top summary and the duplicate further down) and change the status
to 401 and wording to indicate it now returns 401 for invalid JWTs. Ensure both
instances (the main table entry and the duplicated backend status entry) are
consistent.