@dreb/coding-agent 2.45.0 → 2.45.1

package/README.md

@@ -81,7 +81,7 @@ Or use a custom provider (corporate proxy, Bedrock, etc.) — see [Custom provid
 
 Then just talk to dreb. All 11 built-in tools are enabled by default: `read`, `write`, `edit`, `bash`, `grep`, `find`, `ls`, `web_search`, `web_fetch`, `subagent`, and `wait`. Use `--tools` to restrict to a subset (e.g., `--tools read,grep,find,ls` for read-only). Three additional tools — `search`, `skill`, and `tasks_update` — are always active regardless of `--tools`. `suggest_next` is active by default but excluded when `--tools` is specified. The model uses these to fulfill your requests. Add capabilities via [skills](#skills), [prompt templates](#prompt-templates), [extensions](#extensions), or [packages](#packages).
 
-**Also available:** [`@dreb/telegram`](https://www.npmjs.com/package/@dreb/telegram) — run dreb as a Telegram bot with live tool status and visible results for user-facing tools (`npm install -g @dreb/telegram`). [`@dreb/dashboard`](https://www.npmjs.com/package/@dreb/dashboard) — run `dreb dashboard` for a browser UI with fleet overview, full chat steering, subagent observability, host file browser, curated appearance themes (per-browser light/dark), and Tailscale/rotating-code pairing (`npm install -g @dreb/dashboard`; see [docs/dashboard.md](docs/dashboard.md)). Compact SSE snapshots update live fleet cards without repeatedly fetching the cross-project inventory, and session drill-in hydrates state, messages, and background agents through one ordered snapshot request. Its top bar and persistent session header indicators report connecting, connected, retrying, resyncing, disconnected, or auth failed; bounded SSE replay plus an explicit snapshot barrier restores session state and tasks after a reload, restart, gap, backpressure disconnect, or stalled stream.
+**Also available:** [`@dreb/telegram`](https://www.npmjs.com/package/@dreb/telegram) — run dreb as a Telegram bot with live tool status and visible results for user-facing tools (`npm install -g @dreb/telegram`). [`@dreb/dashboard`](https://www.npmjs.com/package/@dreb/dashboard) — run `dreb dashboard` for a browser UI with fleet overview, full chat steering, sanitized inline raster images returned by tools, subagent observability, host file browser, curated appearance themes (per-browser light/dark), and Tailscale/rotating-code pairing (`npm install -g @dreb/dashboard`; see [docs/dashboard.md](docs/dashboard.md)). Compact SSE snapshots update live fleet cards without repeatedly fetching the cross-project inventory, and session drill-in hydrates state, messages, and background agents through one ordered snapshot request. Its top bar and persistent session header indicators report connecting, connected, retrying, resyncing, disconnected, or auth failed; bounded SSE replay plus an explicit snapshot barrier restores session state, tasks, and tool-result images after a reload, restart, gap, backpressure disconnect, or stalled stream.
 
 **Platform notes:** [Windows](docs/windows.md) | [Termux (Android)](docs/termux.md) | [tmux](docs/tmux.md) | [Terminal setup](docs/terminal-setup.md) | [Shell aliases](docs/shell-aliases.md)
 

package/dist/core/export-html/template.js

@@ -14,6 +14,51 @@
       const data = JSON.parse(new TextDecoder('utf-8').decode(bytes));
       const { header, entries, leafId: defaultLeafId, systemPrompt, tools, renderedTools } = data;
 
+      // ============================================================
+      // IMAGE SANITIZATION
+      // ============================================================
+
+      // Exact raster MIME allowlist. Only these canonical MIME strings may be
+      // interpolated into a data: URI for an <img>. SVG is deliberately excluded
+      // because it can carry scripts/markup.
+      const ALLOWED_IMAGE_MIME_TYPES = new Set(['image/png', 'image/jpeg', 'image/gif', 'image/webp']);
+
+      // Strict base64: one-or-more groups of the base64 alphabet with optional
+      // '=' padding. Rejects whitespace, data-URI prefixes, quotes, angle
+      // brackets, or any character that could break out of the src attribute or
+      // inject additional markup/attributes.
+      const BASE64_PATTERN = /^[A-Za-z0-9+/]+={0,2}$/;
+
+      function isPlausibleBase64(value) {
+        if (typeof value !== 'string' || value.length === 0) return false;
+        if (value.length % 4 !== 0) return false;
+        return BASE64_PATTERN.test(value);
+      }
+
+      /**
+       * Build a safe `data:` URI for an image content block, or return null when
+       * the MIME type is not an allowlisted raster type or the base64 payload is
+       * not strictly valid. Because only canonical allowlisted MIME strings and
+       * validated base64 are interpolated, crafted values cannot create extra
+       * attributes or break out into markup.
+       */
+      function sanitizeImageDataUri(mimeType, base64Data) {
+        if (typeof mimeType !== 'string') return null;
+        if (!ALLOWED_IMAGE_MIME_TYPES.has(mimeType)) return null;
+        if (!isPlausibleBase64(base64Data)) return null;
+        return `data:${mimeType};base64,${base64Data}`;
+      }
+
+      /**
+       * Render an <img> tag for an image content block, or '' if it fails
+       * sanitization. Shared by the tool-result and message image paths.
+       */
+      function renderImageTag(img, className) {
+        const src = sanitizeImageDataUri(img && img.mimeType, img && img.data);
+        if (src === null) return '';
+        return `<img src="${src}" class="${className}" />`;
+      }
+
       // ============================================================
       // URL PARAMETER HANDLING
       // ============================================================
@@ -879,9 +924,9 @@
         const renderResultImages = () => {
           const images = getResultImages();
           if (images.length === 0) return '';
-          return '<div class="tool-images">' + 
-            images.map(img => `<img src="data:${img.mimeType};base64,${img.data}" class="tool-image" />`).join('') + 
-            '</div>';
+          const tags = images.map(img => renderImageTag(img, 'tool-image')).filter(Boolean);
+          if (tags.length === 0) return '';
+          return '<div class="tool-images">' + tags.join('') + '</div>';
         };
 
         let html = `<div class="tool-execution ${statusClass}">`;
@@ -915,7 +960,6 @@
 
             html += `<div class="tool-header"><span class="tool-name">read</span> <span class="tool-path">${pathHtml}</span></div>`;
             if (result) {
-              html += renderResultImages();
               const output = getResultText();
               const lang = filePath ? getLanguageFromPath(filePath) : null;
               if (output) html += formatExpandableOutput(output, 10, lang);
@@ -1000,6 +1044,11 @@
           }
         }
 
+        // Sanitized tool-result images render generically for every tool name.
+        // Kept out of the per-tool switch so it applies uniformly (and only once)
+        // to built-in and custom tools alike.
+        html += renderResultImages();
+
         html += '</div>';
         return html;
       }
@@ -1128,12 +1177,9 @@
 
             if (Array.isArray(content)) {
               const images = content.filter(c => c.type === 'image');
-              if (images.length > 0) {
-                html += '<div class="message-images">';
-                for (const img of images) {
-                  html += `<img src="data:${img.mimeType};base64,${img.data}" class="message-image" />`;
-                }
-                html += '</div>';
+              const imageTags = images.map(img => renderImageTag(img, 'message-image')).filter(Boolean);
+              if (imageTags.length > 0) {
+                html += '<div class="message-images">' + imageTags.join('') + '</div>';
               }
             }
 

package/docs/dashboard.md

@@ -120,12 +120,29 @@ networking window above.
 | Screen | What it does |
 |---|---|
 | **Fleet** | Home. Live-first: one grid of every live session at the top — status chip (● running / ◆ needs-attention / ○ idle / ✕ error), project path, activity line, live subagent lines, tasks progress, ctx%, model, last activity. Live cards keep a deterministic order by project path, then session start time; needs-attention cards badge the browser tab without jumping around. Below the grid: past sessions grouped by project, three compact rows per group with an "all N on disk" expander, resume and delete. |
-| **Session view** | Full chat drill-in. Markdown streaming transcript (text, thinking blocks with expand preference, agent-result cards, tool cards with bespoke read/write/edit/bash bodies plus full expandable inputs and markdown-rendered results for markdown-contract tools like subagent/skill/web_fetch/suggest_next, compaction/branch summaries, custom messages), per-message copy, tasks panel, subagent strip, status line with elapsed time plus ■ stop and compaction/retry aborts, a persistent session-header live indicator, and an info bar with cwd, branch, session name, token breakdown, cost/(sub)/daily rollup, ctx%, median tok/s, and a stats popover. Composer supports auto-grow, history, `/` autocomplete from `get_commands`, image attach/paste, queued-message chips with restore-all, steer/follow-up modes, and suggest-next. The ⋯ menu covers export HTML, compact, rename, fork-from-message, loaded context, and tool expand/collapse. Session names update live from manual rename or auto-naming. Extension UI requests (select/confirm/input/editor) render as modals; notifications as toasts. |
+| **Session view** | Full chat drill-in. Markdown streaming transcript (text, thinking blocks with expand preference, agent-result cards, tool cards with bespoke read/write/edit/bash bodies plus full expandable inputs, markdown-rendered results for markdown-contract tools like subagent/skill/web_fetch/suggest_next, and inline tool-result images, compaction/branch summaries, custom messages), per-message copy, tasks panel, subagent strip, status line with elapsed time plus ■ stop and compaction/retry aborts, a persistent session-header live indicator, and an info bar with cwd, branch, session name, token breakdown, cost/(sub)/daily rollup, ctx%, median tok/s, and a stats popover. Composer supports auto-grow, history, `/` autocomplete from `get_commands`, image attach/paste, queued-message chips with restore-all, steer/follow-up modes, and suggest-next. The ⋯ menu covers export HTML, compact, rename, fork-from-message, loaded context, and tool expand/collapse. Session names update live from manual rename or auto-naming. Extension UI requests (select/confirm/input/editor) render as modals; notifications as toasts. |
 | **Subagent view** | Read-only transcript of a background agent: live events via the RPC relay, hydrated from the agent's on-disk session log (`/subagents/:agentId/messages`) so the view survives browser reloads. Shows the task, streaming output, and tool activity. No composer — subagents can't be steered yet; the parent session controls them. |
 | **Files** | Host-wide browser with places shortcuts (home, /tmp, project roots), breadcrumbs to `/`, new-folder, download, drop-zone/picker upload with explicit collision prompts, and "new session here" on any directory. It also shows the **effective global nested-context trust** for the displayed canonical directory: untrusted, trusted by that root, inherited from a granting root, or global expert trust-all. You can trust the displayed folder and descendants, or untrust the actual granting root; untrusting an inherited folder removes that root's trust for all descendants. |
 | **Settings** | Persistent defaults (default model, thinking level, steering/follow-up queue modes, auto-compaction, auto-retry) via `get_settings`/`set_settings` — validation errors are shown verbatim. Entering Settings flushes pending writes and reloads durable global + project settings, so external edits appear; read, parse, or write failures fail loudly instead of showing stale settings. The global-only nested-context policy lists every explicit trusted root for audit and revoke, offers a simple add-by-path control, and includes a prominently warned expert trust-all toggle; the Files view remains the primary place to grant trust while browsing. Most defaults seed new sessions; context-trust changes are observed by active main/subagent processes for future lazy loads, but cannot remove already injected content. Dashboard-local preferences (always expand thinking, needs-attention notification permission) live in the browser, alongside an appearance section: a theme gallery of eight curated themes (entropist.ca, Dim, Solarized, Gruvbox, Caves of Qud, Van Gogh, and the colorblind-safe Okabe-Ito and Paul Tol) with live preview cards and a system/light/dark mode selector, saved per browser. Shows the current rotating pairing code on the host/local dashboard, plus the paired-devices list with unpair. |
 | **Pairing** | Remote first-login: identity echo, rotating-code entry, and the security copy explaining what pairing grants. |
 
+### Tool-result images
+
+Tool results containing PNG, JPEG, GIF, or WebP image blocks render inline in
+any tool card, not only `read`. This human-facing rendering is independent of
+model vision support: a text-only model can omit an image from its own context
+while the dashboard still shows it. MIME types use an exact raster allowlist,
+SVG is rejected, and payloads must be valid base64 before the client builds a
+`data:` URI. HTML transcript exports apply the same rules and embed accepted
+images.
+
+Small results arrive in their normal live event. If an image makes an event
+exceed the SSE per-event byte budget, the existing resync barrier restores the
+full persisted result over HTTP; refresh and subagent hydration use the same
+image-aware transcript path. Display dimensions are bounded, but the underlying
+bytes are not compressed by the dashboard. Lower-bandwidth thumbnail and HD
+loading behavior is tracked separately.
+
 ## Fleet transport and freshness
 
 A normal dashboard load makes one authoritative `GET /api/fleet`; the fleet is

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@dreb/coding-agent",
-	"version": "2.45.0",
+	"version": "2.45.1",
 	"description": "Coding agent CLI with read, bash, edit, write tools and session management",
 	"type": "module",
 	"drebConfig": {