A clipboard-poisoning paste bug, a per-startup graph, and reviving an orphaned visualization

1. The ----- paste bug — colored ≠ meaningful

Clicking a "blue command" in a pane, then pasting, produced only a row of dashes — and every paste after that too. The paste path was fine; the clipboard had been poisoned. The click-to-copy link provider treated any contiguous run of colored cells as a copyable "command," so a TUI's colored separator line (─────) became a link, and clicking it copied dashes.

Fix: a run must contain an alphanumeric before it's linkified — commands/paths/hashes always do, decorative rules never do. One-line guard, big behavior fix. Lesson: a copy heuristic over terminal cells must exclude decorative glyphs, and a bad copy fails silently and at a distance ("paste is broken" reported, but the cause was the click).

2. Per-startup graph (the graph data was already per-startup; the UI wasn't)

The connective graph is stored per-startup (graph/<startup_id>.jsonl, git commits in that startup's granted folder), but the only UI was a cross-startup aggregate modal mislabeled "Connective graph." Now: the toolbar 📊 stays the aggregate dashboard, and a sidebar right-click → "This startup's graph" opens the panel scoped to one startup (Activity, the node-graph, the list, and Pulse all filter to it). Implemented client-side — the renderer already had every node, so no backend change was needed to ship it.

3. Reviving an orphaned visualization

While wiring the split I found GraphView (a React Flow node/edge diagram built earlier) and a VizDemo showcase were in the repo but imported by nothing — the "graph" tab had been quietly rendering recap cards, not the node-graph. Re-wired GraphView as a proper 🕸 Graph tab (scoped per-startup). Nothing had been deleted; it just wasn't connected.

Bonus: the "35 Dependabot vulnerabilities" are mostly noise

GitHub flagged 35 vulns (1 critical, 12 high). pnpm audit on the live v2 workspace shows one moderate (transitive uuid via react-mosaic, not exploitable in its v4 usage). The other ~34 come from old_repo/requirements.txt — the dead v1 Python codebase that isn't used, built, or deployed. The real attack surface is ~nil; the alerts are a dependency-graph scanning a fossil.