@blockrun/franklin 3.21.2 → 3.21.3

package/dist/panel/html.js

@@ -1990,6 +1990,22 @@ function formatDuration(sec) {
   return m > 0 ? m + 'm ' + s + 's' : s + 's';
 }
 
+function escapeHtml(value) {
+  return String(value == null ? '' : value).replace(/[&<>"']/g, ch => ({
+    '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;'
+  }[ch]));
+}
+
+function safeHttpUrl(value) {
+  if (typeof value !== 'string') return '';
+  try {
+    const u = new URL(value);
+    return (u.protocol === 'http:' || u.protocol === 'https:') ? u.href : '';
+  } catch (e) {
+    return '';
+  }
+}
+
 function renderCallsList(calls) {
   const list = document.getElementById('calls-list');
   if (!list) return;
@@ -2007,13 +2023,14 @@ function renderCallsList(calls) {
     const fromHuman = formatPhoneNumber(c.from);
     const when = new Date(c.timestamp).toLocaleString();
     const cost = c.paid_usd ? '$' + c.paid_usd.toFixed(2) : '—';
-    const safeTask = (c.task || '').replace(/[<>&]/g, ch => ({'<':'&lt;','>':'&gt;','&':'&amp;'}[ch]));
+    const safeTask = escapeHtml(c.task || '');
+    const recordingUrl = safeHttpUrl(c.recording_url);
     const transcriptHtml = c.transcript
       ? '<details style="margin-top:8px"><summary style="cursor:pointer;color:var(--text-dim);font-size:12px">Transcript</summary><pre style="white-space:pre-wrap;background:oklch(0 0 0 / 25%);padding:10px;border-radius:8px;font-size:12px;margin-top:6px;max-height:400px;overflow:auto">' +
-        c.transcript.replace(/[<>&]/g, ch => ({'<':'&lt;','>':'&gt;','&':'&amp;'}[ch])) + '</pre></details>'
+        escapeHtml(c.transcript) + '</pre></details>'
       : '';
-    const recordingHtml = c.recording_url
-      ? '<a href="' + c.recording_url + '" target="_blank" rel="noopener" style="font-size:11px;color:var(--brand);text-decoration:none;margin-left:8px">▶ recording</a>'
+    const recordingHtml = recordingUrl
+      ? '<a href="' + escapeHtml(recordingUrl) + '" target="_blank" rel="noopener" style="font-size:11px;color:var(--brand);text-decoration:none;margin-left:8px">▶ recording</a>'
       : '';
     return ''
       + '<div class="phone-row" style="grid-template-columns:auto 1fr auto;align-items:start">'
@@ -2023,12 +2040,12 @@ function renderCallsList(calls) {
       + '    </svg>'
       + '  </div>'
       + '  <div class="phone-main">'
-      + '    <div class="phone-num">' + human + ' <span style="font-size:11px;color:var(--text-dim);font-weight:400">from ' + fromHuman + '</span></div>'
+      + '    <div class="phone-num">' + escapeHtml(human) + ' <span style="font-size:11px;color:var(--text-dim);font-weight:400">from ' + escapeHtml(fromHuman) + '</span></div>'
       + '    <div class="phone-meta">'
-      + '      <span class="chip ' + st.cls + '">' + st.label + '</span>'
+      + '      <span class="chip ' + st.cls + '">' + escapeHtml(st.label) + '</span>'
       + '      <span class="chip">' + formatDuration(c.duration_sec) + '</span>'
       + '      <span class="chip">' + cost + '</span>'
-      + '      <span style="font-size:11px;color:var(--text-dim)">' + when + '</span>'
+      + '      <span style="font-size:11px;color:var(--text-dim)">' + escapeHtml(when) + '</span>'
       + recordingHtml
       + '    </div>'
       + '    <div style="font-size:12px;color:var(--text-muted);margin-top:4px;line-height:1.5">' + (safeTask.slice(0, 200) + (safeTask.length > 200 ? '…' : '')) + '</div>'
@@ -2074,6 +2091,7 @@ document.querySelector('[data-tab="markets"]')?.addEventListener('click', loadMa
   const initialHash = (location.hash || '').replace(/^#/, '');
   if (initialHash && initialHash !== 'overview' && document.getElementById('tab-' + initialHash)) {
     activateTab(initialHash);
+    if (initialHash === 'calls') loadCalls();
   }
 }
 

package/dist/phone/call-log.js

@@ -100,24 +100,30 @@ export class CallLog {
     summary(limit = 50) {
         const all = this.all();
         const latest = new Map();
+        const paidByCall = new Map();
         for (const e of all) {
+            paidByCall.set(e.call_id, Math.max(paidByCall.get(e.call_id) ?? 0, e.paid_usd));
             const cur = latest.get(e.call_id);
             // Keep the row with the FRESHEST timestamp per call_id (status updates).
             if (!cur || e.timestamp >= cur.timestamp)
                 latest.set(e.call_id, e);
         }
         // Sort newest-first by the latest-row timestamp.
-        const list = Array.from(latest.values()).sort((a, b) => b.timestamp - a.timestamp);
+        const list = Array.from(latest.values())
+            .map(e => ({ ...e, paid_usd: paidByCall.get(e.call_id) ?? e.paid_usd }))
+            .sort((a, b) => b.timestamp - a.timestamp);
         return list.slice(0, limit);
     }
     byCallId(callId) {
         let best = null;
+        let paidUsd = 0;
         for (const e of this.all()) {
             if (e.call_id !== callId)
                 continue;
+            paidUsd = Math.max(paidUsd, e.paid_usd);
             if (!best || e.timestamp >= best.timestamp)
                 best = e;
         }
-        return best;
+        return best ? { ...best, paid_usd: paidUsd } : null;
     }
 }

package/dist/tools/voice.js

@@ -346,7 +346,7 @@ export const voiceStatusCapability = {
                     callLog().append({
                         ...prior,
                         timestamp: Date.now(),
-                        paid_usd: 0, // status polls are free; only the initial POST charges
+                        paid_usd: prior.paid_usd, // status polls are free; preserve the per-call total
                         status: normalizeStatus(res.status ?? res.queue_status ?? res.disposition),
                         duration_sec: duration ?? prior.duration_sec,
                         transcript: transcript ?? prior.transcript,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blockrun/franklin",
-  "version": "3.21.2",
+  "version": "3.21.3",
   "description": "Franklin Agent — The AI agent with a wallet. Spends USDC autonomously to get real work done. Pay per action, no subscriptions.",
   "type": "module",
   "exports": {