The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
stack-backend	Ready	Preview, Comment	Feb 16, 2026 10:58pm
stack-dashboard	Ready	Preview, Comment	Feb 16, 2026 10:58pm
stack-demo	Ready	Preview, Comment	Feb 16, 2026 10:58pm
stack-docs	Ready	Preview, Comment	Feb 16, 2026 10:58pm
test-sandbox	Error		Feb 16, 2026 10:58pm

sequenceDiagram
    participant User as User
    participant Client as Dashboard Client
    participant Layout as VibeCodeLayout
    participant Preview as EmailPreview
    participant Backend as Backend API
    participant AI as OpenRouter/OpenAI

    User->>Client: Edit region and click Commit
    Client->>Layout: onWysiwygEditCommit(metadata, newText)
    Layout->>Preview: optimistic preview update (in-iframe)
    Layout->>Backend: POST /internal/wysiwyg-edit (metadata, sourceType, old/new)
    Backend->>AI: generateText (system + user prompt) OR return mock
    AI-->>Backend: updated_source
    Backend-->>Layout: return updated_source
    Layout->>Client: update editor code and preview
    Client-->>User: show updated code/preview

sequenceDiagram
    participant User as User
    participant Client as Dashboard Client
    participant Dialog as Confirm Dialog
    participant Backend as Backend API
    participant DB as Database

    User->>Client: Click Delete template/draft/theme
    Client->>Dialog: open confirm
    User->>Dialog: Confirm
    Dialog->>Backend: DELETE /internal/.../{id}
    Backend->>Backend: verify admin, check shared-server or active-theme
    Backend->>DB: delete record / update config
    DB-->>Backend: success
    Backend-->>Client: 200 OK
    Client-->>User: refresh UI

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

Claude encountered an error —— View job

I'll analyze this and get back to you.

Greptile Summary

This PR implements a comprehensive redesign of the email system with device viewport previews, AI-assisted editing, and CRUD operations for templates, drafts, and themes.

Major Changes:

• Added device viewport previews (phone, tablet, desktop) with realistic Gmail UI mockups
• Implemented DELETE endpoints for email templates, drafts, and themes with proper validation
• Added multi-provider AI support (OpenAI and OpenRouter) for template editing assistance
• Enhanced email preview component with responsive design and email client frames
• Added comprehensive E2E tests for template creation and deletion workflows

Critical Security Issue:

• docker/dependencies/freestyle-mock/server.ts contains a severe remote code execution vulnerability - it accepts and executes arbitrary user-provided scripts without any validation or sandboxing. This service has full filesystem access, can spawn processes, and install arbitrary packages. Even for a mock service, this poses an extreme security risk if exposed to any network.

Security Improvements:

• Added theme_id type validation in email template endpoint to prevent object injection attacks (line 43-45 in email-templates/[templateId]/route.tsx)
• Proper authentication checks on all new DELETE endpoints
• Validation to prevent deletion of default themes or themes currently in use

Confidence Score: 1/5

• This PR contains a CRITICAL remote code execution vulnerability in the freestyle-mock server that must be addressed before merging
• The freestyle-mock server accepts and executes arbitrary user-provided code without any validation, sandboxing, or security controls. It has full filesystem access, can spawn processes, modify environment variables, and install arbitrary npm packages. This is an extremely severe security vulnerability that poses a critical risk even in test/development environments. While the rest of the PR shows good security practices (type validation, proper authentication), this single issue is severe enough to warrant the lowest confidence score.
• CRITICAL: docker/dependencies/freestyle-mock/server.ts requires immediate security review and remediation before this PR can be safely merged

Important Files Changed

Sequence Diagram

sequenceDiagram
    participant User as User/Dashboard
    participant Dashboard as Dashboard Client
    participant Backend as Backend API
    participant AI as AI Provider (OpenAI/OpenRouter)
    participant Freestyle as Freestyle-Mock Server
    participant DB as Database

    Note over User,DB: Email Template Editing Flow

    User->>Dashboard: Edit email template
    Dashboard->>Backend: PATCH /email-templates/{id}
    Backend->>Backend: Validate theme_id type
    Backend->>Freestyle: POST /execute/v1/script
    Note right of Freestyle: Executes user-provided<br/>TSX code (SECURITY RISK)
    Freestyle->>Freestyle: Install dependencies
    Freestyle->>Freestyle: Execute script
    Freestyle-->>Backend: Return rendered HTML
    Backend->>DB: Update config override
    Backend-->>Dashboard: Return rendered HTML
    Dashboard-->>User: Show preview

    Note over User,DB: AI-Assisted Editing Flow

    User->>Dashboard: Ask AI for help
    Dashboard->>Backend: POST /ai-chat/{threadId}
    Backend->>Backend: Validate messages
    Backend->>AI: Generate text with tools
    AI-->>Backend: Response with tool calls
    Backend->>DB: Save thread message
    Backend-->>Dashboard: Return AI response
    Dashboard-->>User: Show AI suggestions

    Note over User,DB: Template Deletion Flow

    User->>Dashboard: Delete template
    Dashboard->>Backend: DELETE /email-templates/{id}
    Backend->>Backend: Check if template exists
    Backend->>DB: Set template config to null
    Backend-->>Dashboard: Success
    Dashboard-->>User: Refresh list