[UX] Global Ctrl+Z shortcut hijacks text-field undo everywhere #84

Severity

Medium — a universal editing shortcut is broken in every input.

What happens

toggle-undo is registered globally on ctrl+z, and ShortcutRegistry.handleKeydown never checks whether the event target is an input/textarea/contenteditable — it calls preventDefault() and fires the handler. Verified live against the packaged 0.6.0 bundle: pressing Ctrl+Z while typing in the SOQL editor opens the Undo History panel and suppresses native text undo. Same risk applies to any user-rebound shortcut without modifiers.

Evidence

• src/ui/utils/shortcuts.ts:100-109 (no target check)
• src/ui/app/AppRoot.tsx:219-222 (ctrl+z registration), :230

Suggested fix

In handleKeydown, ignore events whose target is an editable element unless the binding uses a safe modifier combo; consider moving undo-panel to a non-conflicting default (e.g. ctrl+shift+z).

Environment

Commit 74cf21b (main), WaveLink 0.6.0. Found in the 2026-08-31 adversarial audit (live harness + code verified).