open-file fallback sends local filesystem paths to react-grab.com; telemetry undocumented in README

Summary

Two related privacy/disclosure items from a security review:

1. Local file path transmitted to vendor server (Medium)

packages/react-grab/src/utils/open-file.ts:7,42-44 — when the dev-server open fails in production mode, the code calls:

window.open("https://react-grab.com/open-file?url=<filePath>&line=N")

This transmits the user's local filesystem path (which often contains usernames, project names, and directory structure) to a third-party server as URL parameters.

Suggested fix: route through the local CLI/daemon instead, or strip to project-relative paths before constructing the URL.

2. Telemetry not disclosed in README

The browser package sends an anonymous {source=browser, v, t} version ping on init (src/core/log-intro.ts:13-19, opt-out via telemetry: false), and the CLI sends a {source=cli} ping plus an init report POSTing framework/package-manager/router info and error stack traces to react-grab.com/api/report-cli (packages/cli/src/commands/init.ts:33,44-57; DO_NOT_TRACK respected). None of this is mentioned in the README. Sibling projects handle disclosure well (react-doctor's telemetry README section), so react-grab should match that bar — especially given agents are instructed by SKILL.md to auto-run npx react-grab@latest pull.

Credit where due

The rest of the egress story is solid: opt-outs exist for every path (telemetry: false, DO_NOT_TRACK), captured grabs stay on-device in a 0700 dir with symlink/ownership refusal, clipboard parsing treats hostile input as untrusted, no lifecycle scripts, npm provenance attested.