@warlock.js/ai-panoptic 4.15.0 → 5.0.0

package/esm/dashboard/serve.mjs

@@ -3,6 +3,7 @@ import { extractLastSystemPrompt } from "../evaluate/extract-last-system-prompt.
 import { findSpanById } from "../evaluate/find-span-by-id.mjs";
 import { parseQuery } from "./parse-query.mjs";
 import { dashboardHtml } from "./ui.html.mjs";
+import { timingSafeEqual } from "node:crypto";
 
 //#region ../ai-panoptic/src/dashboard/serve.ts
 /** Hard cap on the evaluate route's request body — well beyond a real instructions string. */
@@ -25,11 +26,41 @@ function hostHeaderName(hostHeader) {
 	const colon = hostHeader.indexOf(":");
 	return colon === -1 ? hostHeader : hostHeader.slice(0, colon);
 }
-/** Constant-ish bearer-token check from `Authorization` header or `?token=`. */
-function isAuthorized(req, url, token) {
+/**
+* Constant-time string equality (S4) — guards against a timing
+* side-channel that could otherwise let a network-adjacent attacker
+* recover the token byte-by-byte via repeated timed guesses. Plain `===`
+* short-circuits on the first differing byte, so response latency leaks
+* how many leading bytes matched; `timingSafeEqual` does not. Lengths are
+* compared first (a length mismatch is not secret and `timingSafeEqual`
+* requires equal-length buffers anyway).
+*/
+function constantTimeEqual(a, b) {
+	const bufA = Buffer.from(a);
+	const bufB = Buffer.from(b);
+	if (bufA.length !== bufB.length) return false;
+	return timingSafeEqual(bufA, bufB);
+}
+/**
+* Bearer-token check (S4): `Authorization: Bearer <token>` header, or
+* (only when `allowQueryToken`) a `?token=` query param.
+*
+* The query-string form only exists for the one request that structurally
+* cannot carry a custom header — the initial browser navigation that
+* loads the HTML shell (a typed/clicked/bookmarked URL). Every other
+* request the served page makes is same-origin `fetch()`, which can and
+* does set `Authorization` (see `ui.html.ts`'s `fetchAuthed`), so the API
+* routes never need to accept a query-string token. Restricting the
+* fallback to just the page route minimizes the token's exposure in
+* server access logs, proxy logs, and browser history to a single route
+* instead of every poll.
+*/
+function isAuthorized(req, url, token, allowQueryToken) {
 	const header = req.headers.authorization;
-	if (header && header === `Bearer ${token}`) return true;
-	return url.searchParams.get("token") === token;
+	if (header && constantTimeEqual(header, `Bearer ${token}`)) return true;
+	if (!allowQueryToken) return false;
+	const queryToken = url.searchParams.get("token");
+	return queryToken !== null && constantTimeEqual(queryToken, token);
 }
 /**
 * Build the `node:http` request handler for the dashboard over a given
@@ -69,7 +100,8 @@ function createRequestHandler(store, config) {
 			sendJson(res, 403, { error: "host_not_allowed" });
 			return;
 		}
-		if (config.authToken && !isAuthorized(req, url, config.authToken)) {
+		const isPageRoute = pathname === base || pathname === base.replace(/\/$/, "");
+		if (config.authToken && !isAuthorized(req, url, config.authToken, isPageRoute)) {
 			sendJson(res, 401, { error: "unauthorized" });
 			return;
 		}

package/esm/dashboard/serve.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"serve.mjs","names":[],"sources":["../../../../../../../ai-panoptic/src/dashboard/serve.ts"],"sourcesContent":["import type { IncomingMessage, ServerResponse } from \"node:http\";\nimport type { EvaluateConfig } from \"../evaluate/evaluate.type\";\nimport { evaluateSystemPrompt } from \"../evaluate/evaluate-system-prompt\";\nimport { extractLastSystemPrompt } from \"../evaluate/extract-last-system-prompt\";\nimport { findSpanById } from \"../evaluate/find-span-by-id\";\nimport type { TraceStoreContract } from \"../store/trace-store.contract\";\nimport { parseQuery } from \"./parse-query\";\nimport { dashboardHtml } from \"./ui.html\";\n\n/** Fully-resolved routing config the request handler closes over. */\nexport type ServeConfig = {\n  /** Normalized mount path, always ending in `/` (e.g. `\"/\"`). */\n  basePath: string;\n  /** Header title baked into the served page. */\n  title: string;\n  /** Bearer token required on every request when set (S4). */\n  authToken?: string;\n  /** `Host` header allowlist — defends against DNS-rebinding (S4). */\n  allowedHosts: string[];\n  /**\n   * Enables the one write route: `POST\n   * {basePath}api/traces/:traceId/spans/:spanId/evaluate`. Absent ⇒ the\n   * route 405s (POST isn't accepted by any route) and the served page never\n   * renders the Evaluate button.\n   */\n  evaluate?: EvaluateConfig;\n};\n\n/** Request body accepted by the evaluate route — everything optional. */\ntype EvaluateRequestBody = {\n  /** Per-run instructions override; falls back to `config.evaluate.instructions`. */\n  instructions?: string;\n};\n\n/** Hard cap on the evaluate route's request body — well beyond a real instructions string. */\nconst MAX_EVALUATE_BODY_BYTES = 64 * 1024;\n\n/**\n * Security response headers added to every dashboard response (S4):\n * block MIME-sniffing, framing, referrer leakage, and lock the page's\n * content sources down to itself (the UI is fully self-contained — no CDN).\n */\nconst SECURITY_HEADERS: Record<string, string> = {\n  \"x-content-type-options\": \"nosniff\",\n  \"x-frame-options\": \"DENY\",\n  \"referrer-policy\": \"no-referrer\",\n  \"content-security-policy\":\n    \"default-src 'none'; style-src 'unsafe-inline'; script-src 'unsafe-inline'; connect-src 'self'; img-src 'self' data:; base-uri 'none'; form-action 'none'; frame-ancestors 'none'\",\n};\n\n/** Extract the host (no port) from a `Host` header value. */\nfunction hostHeaderName(hostHeader: string | undefined): string | undefined {\n  if (!hostHeader) return undefined;\n  // IPv6 literal `[::1]:4319` → `[::1]`; otherwise strip `:port`.\n  if (hostHeader.startsWith(\"[\")) {\n    return hostHeader.slice(0, hostHeader.indexOf(\"]\") + 1);\n  }\n  const colon = hostHeader.indexOf(\":\");\n  return colon === -1 ? hostHeader : hostHeader.slice(0, colon);\n}\n\n/** Constant-ish bearer-token check from `Authorization` header or `?token=`. */\nfunction isAuthorized(req: IncomingMessage, url: URL, token: string): boolean {\n  const header = req.headers.authorization;\n  if (header && header === `Bearer ${token}`) return true;\n  return url.searchParams.get(\"token\") === token;\n}\n\n/**\n * Build the `node:http` request handler for the dashboard over a given\n * trace store. Kept separate from the server lifecycle so it can be unit\n * tested by feeding it a fake `req`/`res` without binding a port.\n *\n * Routes (all under `config.basePath`):\n *\n * - `GET api/traces`        → `store.query(parseQuery(searchParams))`\n * - `GET api/traces/:id`    → `store.get(id)` or `404`\n * - `GET api/aggregate`     → `store.aggregate(parseQuery(searchParams))`\n * - `GET {basePath}`        → the self-contained HTML page\n * - `POST api/traces/:traceId/spans/:spanId/evaluate` → ONLY when\n *   `config.evaluate` is set; grades the span's last captured system\n *   prompt and returns a {@link EvaluateVerdict}. The dashboard's one\n *   write route — absent config, POST 405s like it would against any\n *   other route (the path is never even pattern-matched).\n *\n * Anything else → `404`. A method the matched route doesn't accept → `405`.\n * Host allowlist + bearer-token auth (S4) are checked for EVERY request,\n * regardless of method, before any routing. The store shapes\n * ({@link Trace}/{@link TraceSpan}) are already JSON-safe, so GET responses\n * are a plain `JSON.stringify` with no serializer.\n *\n * @example\n * const handler = createRequestHandler(store, { basePath: \"/\", title: \"Panoptic\" });\n * http.createServer(handler).listen(4319, \"127.0.0.1\");\n */\nexport function createRequestHandler(\n  store: TraceStoreContract,\n  config: ServeConfig,\n): (req: IncomingMessage, res: ServerResponse) => void {\n  const base = config.basePath;\n  const apiPrefix = `${base}api`;\n\n  return function handle(req: IncomingMessage, res: ServerResponse): void {\n    // `req.url` is path + query only; a dummy origin lets URL parse it.\n    const url = new URL(req.url ?? \"/\", \"http://localhost\");\n    const pathname = url.pathname;\n\n    // Host-header allowlist — blocks DNS-rebinding attacks that point a\n    // hostile domain at this loopback port (S4). Checked for every method.\n    const host = hostHeaderName(req.headers.host);\n    if (!host || !config.allowedHosts.includes(host.toLowerCase())) {\n      sendJson(res, 403, { error: \"host_not_allowed\" });\n\n      return;\n    }\n\n    // Bearer-token auth when configured (always required off loopback, S4).\n    if (config.authToken && !isAuthorized(req, url, config.authToken)) {\n      sendJson(res, 401, { error: \"unauthorized\" });\n\n      return;\n    }\n\n    // The one write route — opt-in via `config.evaluate`, so it must be\n    // checked before the blanket GET-only gate below.\n    if (req.method === \"POST\" && config.evaluate) {\n      const match = matchEvaluatePath(pathname, apiPrefix);\n\n      if (match) {\n        void handleEvaluate(store, config.evaluate, match.traceId, match.spanId, req, res);\n\n        return;\n      }\n    }\n\n    if (req.method !== \"GET\") {\n      sendJson(res, 405, { error: \"method_not_allowed\" });\n\n      return;\n    }\n\n    if (pathname === `${apiPrefix}/traces`) {\n      sendJson(res, 200, store.query(parseQuery(url.searchParams)));\n\n      return;\n    }\n\n    if (pathname.startsWith(`${apiPrefix}/traces/`)) {\n      const traceId = decodeURIComponent(pathname.slice(`${apiPrefix}/traces/`.length));\n      const trace = traceId.length > 0 ? store.get(traceId) : undefined;\n\n      if (trace === undefined) {\n        sendJson(res, 404, { error: \"trace_not_found\", traceId });\n\n        return;\n      }\n\n      sendJson(res, 200, trace);\n\n      return;\n    }\n\n    if (pathname === `${apiPrefix}/aggregate`) {\n      sendJson(res, 200, store.aggregate(parseQuery(url.searchParams)));\n\n      return;\n    }\n\n    if (pathname === base || pathname === base.replace(/\\/$/, \"\")) {\n      res.writeHead(200, {\n        \"content-type\": \"text/html; charset=utf-8\",\n        ...SECURITY_HEADERS,\n      });\n      res.end(dashboardHtml(base, config.title, Boolean(config.evaluate), config.evaluate?.instructions ?? \"\"));\n\n      return;\n    }\n\n    sendJson(res, 404, { error: \"not_found\" });\n  };\n}\n\n/** Write a JSON response with the given status code and security headers. */\nfunction sendJson(res: ServerResponse, status: number, body: unknown): void {\n  res.writeHead(status, {\n    \"content-type\": \"application/json; charset=utf-8\",\n    ...SECURITY_HEADERS,\n  });\n  res.end(JSON.stringify(body));\n}\n\n/**\n * Match `{apiPrefix}/traces/:traceId/spans/:spanId/evaluate` — the one\n * write route. Returns `undefined` for anything else, including the plain\n * `{apiPrefix}/traces/:id` read route (no `/spans/.../evaluate` suffix),\n * so the two never collide.\n */\nfunction matchEvaluatePath(\n  pathname: string,\n  apiPrefix: string,\n): { traceId: string; spanId: string } | undefined {\n  const prefix = `${apiPrefix}/traces/`;\n\n  if (!pathname.startsWith(prefix)) {\n    return undefined;\n  }\n\n  const match = /^([^/]+)\\/spans\\/([^/]+)\\/evaluate$/.exec(pathname.slice(prefix.length));\n\n  if (!match) {\n    return undefined;\n  }\n\n  return {\n    traceId: decodeURIComponent(match[1]),\n    spanId: decodeURIComponent(match[2]),\n  };\n}\n\n/**\n * Collect and JSON-parse a request body, capped at\n * {@link MAX_EVALUATE_BODY_BYTES} so an oversized body can't hold the\n * connection open indefinitely. An empty body resolves to `undefined` —\n * the evaluate route treats that as \"no per-run override\".\n */\nfunction readJsonBody<T>(req: IncomingMessage): Promise<T | undefined> {\n  return new Promise((resolve, reject) => {\n    const chunks: Buffer[] = [];\n    let size = 0;\n\n    req.on(\"data\", (chunk: Buffer) => {\n      size += chunk.length;\n\n      if (size > MAX_EVALUATE_BODY_BYTES) {\n        req.destroy();\n        reject(new Error(\"payload_too_large\"));\n\n        return;\n      }\n\n      chunks.push(chunk);\n    });\n\n    req.on(\"end\", () => {\n      if (chunks.length === 0) {\n        resolve(undefined);\n\n        return;\n      }\n\n      try {\n        resolve(JSON.parse(Buffer.concat(chunks).toString(\"utf-8\")) as T);\n      } catch {\n        reject(new Error(\"invalid_json\"));\n      }\n    });\n\n    req.on(\"error\", reject);\n  });\n}\n\n/**\n * Handle `POST {apiPrefix}/traces/:traceId/spans/:spanId/evaluate`. Looks\n * up the trace + span, extracts its last captured system prompt, and\n * grades it via {@link evaluateSystemPrompt}. `judgePromptBody` itself\n * never throws (a broken judge degrades to an issues-only outcome) — the\n * try/catch here only guards `config.evaluate.model` resolution, the one\n * step that CAN throw (e.g. a factory constructing an SDK client).\n */\nasync function handleEvaluate(\n  store: TraceStoreContract,\n  evaluate: EvaluateConfig,\n  traceId: string,\n  spanId: string,\n  req: IncomingMessage,\n  res: ServerResponse,\n): Promise<void> {\n  const trace = store.get(traceId);\n\n  if (trace === undefined) {\n    sendJson(res, 404, { error: \"trace_not_found\", traceId });\n\n    return;\n  }\n\n  const span = findSpanById(trace.root, spanId);\n\n  if (span === undefined) {\n    sendJson(res, 404, { error: \"span_not_found\", spanId });\n\n    return;\n  }\n\n  const systemPrompt = extractLastSystemPrompt(span);\n\n  if (systemPrompt === undefined) {\n    sendJson(res, 422, { error: \"no_system_prompt\" });\n\n    return;\n  }\n\n  let body: EvaluateRequestBody | undefined;\n\n  try {\n    body = await readJsonBody<EvaluateRequestBody>(req);\n  } catch (error) {\n    const message = error instanceof Error ? error.message : \"invalid_json\";\n    sendJson(res, message === \"payload_too_large\" ? 413 : 400, { error: message });\n\n    return;\n  }\n\n  try {\n    const verdict = await evaluateSystemPrompt(systemPrompt, evaluate, body?.instructions);\n    sendJson(res, 200, verdict);\n  } catch (error) {\n    sendJson(res, 502, {\n      error: \"evaluate_failed\",\n      message: error instanceof Error ? error.message : String(error),\n    });\n  }\n}\n"],"mappings":";;;;;;;;AAmCA,MAAM,0BAA0B,KAAK;;;;;;AAOrC,MAAM,mBAA2C;CAC/C,0BAA0B;CAC1B,mBAAmB;CACnB,mBAAmB;CACnB,2BACE;AACJ;;AAGA,SAAS,eAAe,YAAoD;CAC1E,IAAI,CAAC,YAAY,OAAO;CAExB,IAAI,WAAW,WAAW,GAAG,GAC3B,OAAO,WAAW,MAAM,GAAG,WAAW,QAAQ,GAAG,IAAI,CAAC;CAExD,MAAM,QAAQ,WAAW,QAAQ,GAAG;CACpC,OAAO,UAAU,KAAK,aAAa,WAAW,MAAM,GAAG,KAAK;AAC9D;;AAGA,SAAS,aAAa,KAAsB,KAAU,OAAwB;CAC5E,MAAM,SAAS,IAAI,QAAQ;CAC3B,IAAI,UAAU,WAAW,UAAU,SAAS,OAAO;CACnD,OAAO,IAAI,aAAa,IAAI,OAAO,MAAM;AAC3C;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6BA,SAAgB,qBACd,OACA,QACqD;CACrD,MAAM,OAAO,OAAO;CACpB,MAAM,YAAY,GAAG,KAAK;CAE1B,OAAO,SAAS,OAAO,KAAsB,KAA2B;EAEtE,MAAM,MAAM,IAAI,IAAI,IAAI,OAAO,KAAK,kBAAkB;EACtD,MAAM,WAAW,IAAI;EAIrB,MAAM,OAAO,eAAe,IAAI,QAAQ,IAAI;EAC5C,IAAI,CAAC,QAAQ,CAAC,OAAO,aAAa,SAAS,KAAK,YAAY,CAAC,GAAG;GAC9D,SAAS,KAAK,KAAK,EAAE,OAAO,mBAAmB,CAAC;GAEhD;EACF;EAGA,IAAI,OAAO,aAAa,CAAC,aAAa,KAAK,KAAK,OAAO,SAAS,GAAG;GACjE,SAAS,KAAK,KAAK,EAAE,OAAO,eAAe,CAAC;GAE5C;EACF;EAIA,IAAI,IAAI,WAAW,UAAU,OAAO,UAAU;GAC5C,MAAM,QAAQ,kBAAkB,UAAU,SAAS;GAEnD,IAAI,OAAO;IACT,AAAK,eAAe,OAAO,OAAO,UAAU,MAAM,SAAS,MAAM,QAAQ,KAAK,GAAG;IAEjF;GACF;EACF;EAEA,IAAI,IAAI,WAAW,OAAO;GACxB,SAAS,KAAK,KAAK,EAAE,OAAO,qBAAqB,CAAC;GAElD;EACF;EAEA,IAAI,aAAa,GAAG,UAAU,UAAU;GACtC,SAAS,KAAK,KAAK,MAAM,MAAM,WAAW,IAAI,YAAY,CAAC,CAAC;GAE5D;EACF;EAEA,IAAI,SAAS,WAAW,GAAG,UAAU,SAAS,GAAG;GAC/C,MAAM,UAAU,mBAAmB,SAAS,MAAM,GAAG,UAAU,UAAU,MAAM,CAAC;GAChF,MAAM,QAAQ,QAAQ,SAAS,IAAI,MAAM,IAAI,OAAO,IAAI;GAExD,IAAI,UAAU,QAAW;IACvB,SAAS,KAAK,KAAK;KAAE,OAAO;KAAmB;IAAQ,CAAC;IAExD;GACF;GAEA,SAAS,KAAK,KAAK,KAAK;GAExB;EACF;EAEA,IAAI,aAAa,GAAG,UAAU,aAAa;GACzC,SAAS,KAAK,KAAK,MAAM,UAAU,WAAW,IAAI,YAAY,CAAC,CAAC;GAEhE;EACF;EAEA,IAAI,aAAa,QAAQ,aAAa,KAAK,QAAQ,OAAO,EAAE,GAAG;GAC7D,IAAI,UAAU,KAAK;IACjB,gBAAgB;IAChB,GAAG;GACL,CAAC;GACD,IAAI,IAAI,cAAc,MAAM,OAAO,OAAO,QAAQ,OAAO,QAAQ,GAAG,OAAO,UAAU,gBAAgB,EAAE,CAAC;GAExG;EACF;EAEA,SAAS,KAAK,KAAK,EAAE,OAAO,YAAY,CAAC;CAC3C;AACF;;AAGA,SAAS,SAAS,KAAqB,QAAgB,MAAqB;CAC1E,IAAI,UAAU,QAAQ;EACpB,gBAAgB;EAChB,GAAG;CACL,CAAC;CACD,IAAI,IAAI,KAAK,UAAU,IAAI,CAAC;AAC9B;;;;;;;AAQA,SAAS,kBACP,UACA,WACiD;CACjD,MAAM,SAAS,GAAG,UAAU;CAE5B,IAAI,CAAC,SAAS,WAAW,MAAM,GAC7B;CAGF,MAAM,QAAQ,sCAAsC,KAAK,SAAS,MAAM,OAAO,MAAM,CAAC;CAEtF,IAAI,CAAC,OACH;CAGF,OAAO;EACL,SAAS,mBAAmB,MAAM,EAAE;EACpC,QAAQ,mBAAmB,MAAM,EAAE;CACrC;AACF;;;;;;;AAQA,SAAS,aAAgB,KAA8C;CACrE,OAAO,IAAI,SAAS,SAAS,WAAW;EACtC,MAAM,SAAmB,CAAC;EAC1B,IAAI,OAAO;EAEX,IAAI,GAAG,SAAS,UAAkB;GAChC,QAAQ,MAAM;GAEd,IAAI,OAAO,yBAAyB;IAClC,IAAI,QAAQ;IACZ,uBAAO,IAAI,MAAM,mBAAmB,CAAC;IAErC;GACF;GAEA,OAAO,KAAK,KAAK;EACnB,CAAC;EAED,IAAI,GAAG,aAAa;GAClB,IAAI,OAAO,WAAW,GAAG;IACvB,QAAQ,MAAS;IAEjB;GACF;GAEA,IAAI;IACF,QAAQ,KAAK,MAAM,OAAO,OAAO,MAAM,CAAC,CAAC,SAAS,OAAO,CAAC,CAAM;GAClE,QAAQ;IACN,uBAAO,IAAI,MAAM,cAAc,CAAC;GAClC;EACF,CAAC;EAED,IAAI,GAAG,SAAS,MAAM;CACxB,CAAC;AACH;;;;;;;;;AAUA,eAAe,eACb,OACA,UACA,SACA,QACA,KACA,KACe;CACf,MAAM,QAAQ,MAAM,IAAI,OAAO;CAE/B,IAAI,UAAU,QAAW;EACvB,SAAS,KAAK,KAAK;GAAE,OAAO;GAAmB;EAAQ,CAAC;EAExD;CACF;CAEA,MAAM,OAAO,aAAa,MAAM,MAAM,MAAM;CAE5C,IAAI,SAAS,QAAW;EACtB,SAAS,KAAK,KAAK;GAAE,OAAO;GAAkB;EAAO,CAAC;EAEtD;CACF;CAEA,MAAM,eAAe,wBAAwB,IAAI;CAEjD,IAAI,iBAAiB,QAAW;EAC9B,SAAS,KAAK,KAAK,EAAE,OAAO,mBAAmB,CAAC;EAEhD;CACF;CAEA,IAAI;CAEJ,IAAI;EACF,OAAO,MAAM,aAAkC,GAAG;CACpD,SAAS,OAAO;EACd,MAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU;EACzD,SAAS,KAAK,YAAY,sBAAsB,MAAM,KAAK,EAAE,OAAO,QAAQ,CAAC;EAE7E;CACF;CAEA,IAAI;EAEF,SAAS,KAAK,KAAK,MADG,qBAAqB,cAAc,UAAU,MAAM,YAAY,CAC3D;CAC5B,SAAS,OAAO;EACd,SAAS,KAAK,KAAK;GACjB,OAAO;GACP,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;EAChE,CAAC;CACH;AACF"}
+{"version":3,"file":"serve.mjs","names":[],"sources":["../../../../../../../ai-panoptic/src/dashboard/serve.ts"],"sourcesContent":["import { timingSafeEqual } from \"node:crypto\";\nimport type { IncomingMessage, ServerResponse } from \"node:http\";\nimport type { EvaluateConfig } from \"../evaluate/evaluate.type\";\nimport { evaluateSystemPrompt } from \"../evaluate/evaluate-system-prompt\";\nimport { extractLastSystemPrompt } from \"../evaluate/extract-last-system-prompt\";\nimport { findSpanById } from \"../evaluate/find-span-by-id\";\nimport type { TraceStoreContract } from \"../store/trace-store.contract\";\nimport { parseQuery } from \"./parse-query\";\nimport { dashboardHtml } from \"./ui.html\";\n\n/** Fully-resolved routing config the request handler closes over. */\nexport type ServeConfig = {\n  /** Normalized mount path, always ending in `/` (e.g. `\"/\"`). */\n  basePath: string;\n  /** Header title baked into the served page. */\n  title: string;\n  /** Bearer token required on every request when set (S4). */\n  authToken?: string;\n  /** `Host` header allowlist — defends against DNS-rebinding (S4). */\n  allowedHosts: string[];\n  /**\n   * Enables the one write route: `POST\n   * {basePath}api/traces/:traceId/spans/:spanId/evaluate`. Absent ⇒ the\n   * route 405s (POST isn't accepted by any route) and the served page never\n   * renders the Evaluate button.\n   */\n  evaluate?: EvaluateConfig;\n};\n\n/** Request body accepted by the evaluate route — everything optional. */\ntype EvaluateRequestBody = {\n  /** Per-run instructions override; falls back to `config.evaluate.instructions`. */\n  instructions?: string;\n};\n\n/** Hard cap on the evaluate route's request body — well beyond a real instructions string. */\nconst MAX_EVALUATE_BODY_BYTES = 64 * 1024;\n\n/**\n * Security response headers added to every dashboard response (S4):\n * block MIME-sniffing, framing, referrer leakage, and lock the page's\n * content sources down to itself (the UI is fully self-contained — no CDN).\n */\nconst SECURITY_HEADERS: Record<string, string> = {\n  \"x-content-type-options\": \"nosniff\",\n  \"x-frame-options\": \"DENY\",\n  \"referrer-policy\": \"no-referrer\",\n  \"content-security-policy\":\n    \"default-src 'none'; style-src 'unsafe-inline'; script-src 'unsafe-inline'; connect-src 'self'; img-src 'self' data:; base-uri 'none'; form-action 'none'; frame-ancestors 'none'\",\n};\n\n/** Extract the host (no port) from a `Host` header value. */\nfunction hostHeaderName(hostHeader: string | undefined): string | undefined {\n  if (!hostHeader) return undefined;\n  // IPv6 literal `[::1]:4319` → `[::1]`; otherwise strip `:port`.\n  if (hostHeader.startsWith(\"[\")) {\n    return hostHeader.slice(0, hostHeader.indexOf(\"]\") + 1);\n  }\n  const colon = hostHeader.indexOf(\":\");\n  return colon === -1 ? hostHeader : hostHeader.slice(0, colon);\n}\n\n/**\n * Constant-time string equality (S4) — guards against a timing\n * side-channel that could otherwise let a network-adjacent attacker\n * recover the token byte-by-byte via repeated timed guesses. Plain `===`\n * short-circuits on the first differing byte, so response latency leaks\n * how many leading bytes matched; `timingSafeEqual` does not. Lengths are\n * compared first (a length mismatch is not secret and `timingSafeEqual`\n * requires equal-length buffers anyway).\n */\nfunction constantTimeEqual(a: string, b: string): boolean {\n  const bufA = Buffer.from(a);\n  const bufB = Buffer.from(b);\n\n  if (bufA.length !== bufB.length) return false;\n\n  return timingSafeEqual(bufA, bufB);\n}\n\n/**\n * Bearer-token check (S4): `Authorization: Bearer <token>` header, or\n * (only when `allowQueryToken`) a `?token=` query param.\n *\n * The query-string form only exists for the one request that structurally\n * cannot carry a custom header — the initial browser navigation that\n * loads the HTML shell (a typed/clicked/bookmarked URL). Every other\n * request the served page makes is same-origin `fetch()`, which can and\n * does set `Authorization` (see `ui.html.ts`'s `fetchAuthed`), so the API\n * routes never need to accept a query-string token. Restricting the\n * fallback to just the page route minimizes the token's exposure in\n * server access logs, proxy logs, and browser history to a single route\n * instead of every poll.\n */\nfunction isAuthorized(\n  req: IncomingMessage,\n  url: URL,\n  token: string,\n  allowQueryToken: boolean,\n): boolean {\n  const header = req.headers.authorization;\n  if (header && constantTimeEqual(header, `Bearer ${token}`)) return true;\n  if (!allowQueryToken) return false;\n  const queryToken = url.searchParams.get(\"token\");\n  return queryToken !== null && constantTimeEqual(queryToken, token);\n}\n\n/**\n * Build the `node:http` request handler for the dashboard over a given\n * trace store. Kept separate from the server lifecycle so it can be unit\n * tested by feeding it a fake `req`/`res` without binding a port.\n *\n * Routes (all under `config.basePath`):\n *\n * - `GET api/traces`        → `store.query(parseQuery(searchParams))`\n * - `GET api/traces/:id`    → `store.get(id)` or `404`\n * - `GET api/aggregate`     → `store.aggregate(parseQuery(searchParams))`\n * - `GET {basePath}`        → the self-contained HTML page\n * - `POST api/traces/:traceId/spans/:spanId/evaluate` → ONLY when\n *   `config.evaluate` is set; grades the span's last captured system\n *   prompt and returns a {@link EvaluateVerdict}. The dashboard's one\n *   write route — absent config, POST 405s like it would against any\n *   other route (the path is never even pattern-matched).\n *\n * Anything else → `404`. A method the matched route doesn't accept → `405`.\n * Host allowlist + bearer-token auth (S4) are checked for EVERY request,\n * regardless of method, before any routing. The store shapes\n * ({@link Trace}/{@link TraceSpan}) are already JSON-safe, so GET responses\n * are a plain `JSON.stringify` with no serializer.\n *\n * @example\n * const handler = createRequestHandler(store, { basePath: \"/\", title: \"Panoptic\" });\n * http.createServer(handler).listen(4319, \"127.0.0.1\");\n */\nexport function createRequestHandler(\n  store: TraceStoreContract,\n  config: ServeConfig,\n): (req: IncomingMessage, res: ServerResponse) => void {\n  const base = config.basePath;\n  const apiPrefix = `${base}api`;\n\n  return function handle(req: IncomingMessage, res: ServerResponse): void {\n    // `req.url` is path + query only; a dummy origin lets URL parse it.\n    const url = new URL(req.url ?? \"/\", \"http://localhost\");\n    const pathname = url.pathname;\n\n    // Host-header allowlist — blocks DNS-rebinding attacks that point a\n    // hostile domain at this loopback port (S4). Checked for every method.\n    const host = hostHeaderName(req.headers.host);\n    if (!host || !config.allowedHosts.includes(host.toLowerCase())) {\n      sendJson(res, 403, { error: \"host_not_allowed\" });\n\n      return;\n    }\n\n    // Bearer-token auth when configured (always required off loopback, S4).\n    // `?token=` is only honored on the HTML page route — see `isAuthorized`.\n    const isPageRoute = pathname === base || pathname === base.replace(/\\/$/, \"\");\n    if (config.authToken && !isAuthorized(req, url, config.authToken, isPageRoute)) {\n      sendJson(res, 401, { error: \"unauthorized\" });\n\n      return;\n    }\n\n    // The one write route — opt-in via `config.evaluate`, so it must be\n    // checked before the blanket GET-only gate below.\n    if (req.method === \"POST\" && config.evaluate) {\n      const match = matchEvaluatePath(pathname, apiPrefix);\n\n      if (match) {\n        void handleEvaluate(store, config.evaluate, match.traceId, match.spanId, req, res);\n\n        return;\n      }\n    }\n\n    if (req.method !== \"GET\") {\n      sendJson(res, 405, { error: \"method_not_allowed\" });\n\n      return;\n    }\n\n    if (pathname === `${apiPrefix}/traces`) {\n      sendJson(res, 200, store.query(parseQuery(url.searchParams)));\n\n      return;\n    }\n\n    if (pathname.startsWith(`${apiPrefix}/traces/`)) {\n      const traceId = decodeURIComponent(pathname.slice(`${apiPrefix}/traces/`.length));\n      const trace = traceId.length > 0 ? store.get(traceId) : undefined;\n\n      if (trace === undefined) {\n        sendJson(res, 404, { error: \"trace_not_found\", traceId });\n\n        return;\n      }\n\n      sendJson(res, 200, trace);\n\n      return;\n    }\n\n    if (pathname === `${apiPrefix}/aggregate`) {\n      sendJson(res, 200, store.aggregate(parseQuery(url.searchParams)));\n\n      return;\n    }\n\n    if (pathname === base || pathname === base.replace(/\\/$/, \"\")) {\n      res.writeHead(200, {\n        \"content-type\": \"text/html; charset=utf-8\",\n        ...SECURITY_HEADERS,\n      });\n      res.end(dashboardHtml(base, config.title, Boolean(config.evaluate), config.evaluate?.instructions ?? \"\"));\n\n      return;\n    }\n\n    sendJson(res, 404, { error: \"not_found\" });\n  };\n}\n\n/** Write a JSON response with the given status code and security headers. */\nfunction sendJson(res: ServerResponse, status: number, body: unknown): void {\n  res.writeHead(status, {\n    \"content-type\": \"application/json; charset=utf-8\",\n    ...SECURITY_HEADERS,\n  });\n  res.end(JSON.stringify(body));\n}\n\n/**\n * Match `{apiPrefix}/traces/:traceId/spans/:spanId/evaluate` — the one\n * write route. Returns `undefined` for anything else, including the plain\n * `{apiPrefix}/traces/:id` read route (no `/spans/.../evaluate` suffix),\n * so the two never collide.\n */\nfunction matchEvaluatePath(\n  pathname: string,\n  apiPrefix: string,\n): { traceId: string; spanId: string } | undefined {\n  const prefix = `${apiPrefix}/traces/`;\n\n  if (!pathname.startsWith(prefix)) {\n    return undefined;\n  }\n\n  const match = /^([^/]+)\\/spans\\/([^/]+)\\/evaluate$/.exec(pathname.slice(prefix.length));\n\n  if (!match) {\n    return undefined;\n  }\n\n  return {\n    traceId: decodeURIComponent(match[1]),\n    spanId: decodeURIComponent(match[2]),\n  };\n}\n\n/**\n * Collect and JSON-parse a request body, capped at\n * {@link MAX_EVALUATE_BODY_BYTES} so an oversized body can't hold the\n * connection open indefinitely. An empty body resolves to `undefined` —\n * the evaluate route treats that as \"no per-run override\".\n */\nfunction readJsonBody<T>(req: IncomingMessage): Promise<T | undefined> {\n  return new Promise((resolve, reject) => {\n    const chunks: Buffer[] = [];\n    let size = 0;\n\n    req.on(\"data\", (chunk: Buffer) => {\n      size += chunk.length;\n\n      if (size > MAX_EVALUATE_BODY_BYTES) {\n        req.destroy();\n        reject(new Error(\"payload_too_large\"));\n\n        return;\n      }\n\n      chunks.push(chunk);\n    });\n\n    req.on(\"end\", () => {\n      if (chunks.length === 0) {\n        resolve(undefined);\n\n        return;\n      }\n\n      try {\n        resolve(JSON.parse(Buffer.concat(chunks).toString(\"utf-8\")) as T);\n      } catch {\n        reject(new Error(\"invalid_json\"));\n      }\n    });\n\n    req.on(\"error\", reject);\n  });\n}\n\n/**\n * Handle `POST {apiPrefix}/traces/:traceId/spans/:spanId/evaluate`. Looks\n * up the trace + span, extracts its last captured system prompt, and\n * grades it via {@link evaluateSystemPrompt}. `judgePromptBody` itself\n * never throws (a broken judge degrades to an issues-only outcome) — the\n * try/catch here only guards `config.evaluate.model` resolution, the one\n * step that CAN throw (e.g. a factory constructing an SDK client).\n */\nasync function handleEvaluate(\n  store: TraceStoreContract,\n  evaluate: EvaluateConfig,\n  traceId: string,\n  spanId: string,\n  req: IncomingMessage,\n  res: ServerResponse,\n): Promise<void> {\n  const trace = store.get(traceId);\n\n  if (trace === undefined) {\n    sendJson(res, 404, { error: \"trace_not_found\", traceId });\n\n    return;\n  }\n\n  const span = findSpanById(trace.root, spanId);\n\n  if (span === undefined) {\n    sendJson(res, 404, { error: \"span_not_found\", spanId });\n\n    return;\n  }\n\n  const systemPrompt = extractLastSystemPrompt(span);\n\n  if (systemPrompt === undefined) {\n    sendJson(res, 422, { error: \"no_system_prompt\" });\n\n    return;\n  }\n\n  let body: EvaluateRequestBody | undefined;\n\n  try {\n    body = await readJsonBody<EvaluateRequestBody>(req);\n  } catch (error) {\n    const message = error instanceof Error ? error.message : \"invalid_json\";\n    sendJson(res, message === \"payload_too_large\" ? 413 : 400, { error: message });\n\n    return;\n  }\n\n  try {\n    const verdict = await evaluateSystemPrompt(systemPrompt, evaluate, body?.instructions);\n    sendJson(res, 200, verdict);\n  } catch (error) {\n    sendJson(res, 502, {\n      error: \"evaluate_failed\",\n      message: error instanceof Error ? error.message : String(error),\n    });\n  }\n}\n"],"mappings":";;;;;;;;;AAoCA,MAAM,0BAA0B,KAAK;;;;;;AAOrC,MAAM,mBAA2C;CAC/C,0BAA0B;CAC1B,mBAAmB;CACnB,mBAAmB;CACnB,2BACE;AACJ;;AAGA,SAAS,eAAe,YAAoD;CAC1E,IAAI,CAAC,YAAY,OAAO;CAExB,IAAI,WAAW,WAAW,GAAG,GAC3B,OAAO,WAAW,MAAM,GAAG,WAAW,QAAQ,GAAG,IAAI,CAAC;CAExD,MAAM,QAAQ,WAAW,QAAQ,GAAG;CACpC,OAAO,UAAU,KAAK,aAAa,WAAW,MAAM,GAAG,KAAK;AAC9D;;;;;;;;;;AAWA,SAAS,kBAAkB,GAAW,GAAoB;CACxD,MAAM,OAAO,OAAO,KAAK,CAAC;CAC1B,MAAM,OAAO,OAAO,KAAK,CAAC;CAE1B,IAAI,KAAK,WAAW,KAAK,QAAQ,OAAO;CAExC,OAAO,gBAAgB,MAAM,IAAI;AACnC;;;;;;;;;;;;;;;AAgBA,SAAS,aACP,KACA,KACA,OACA,iBACS;CACT,MAAM,SAAS,IAAI,QAAQ;CAC3B,IAAI,UAAU,kBAAkB,QAAQ,UAAU,OAAO,GAAG,OAAO;CACnE,IAAI,CAAC,iBAAiB,OAAO;CAC7B,MAAM,aAAa,IAAI,aAAa,IAAI,OAAO;CAC/C,OAAO,eAAe,QAAQ,kBAAkB,YAAY,KAAK;AACnE;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6BA,SAAgB,qBACd,OACA,QACqD;CACrD,MAAM,OAAO,OAAO;CACpB,MAAM,YAAY,GAAG,KAAK;CAE1B,OAAO,SAAS,OAAO,KAAsB,KAA2B;EAEtE,MAAM,MAAM,IAAI,IAAI,IAAI,OAAO,KAAK,kBAAkB;EACtD,MAAM,WAAW,IAAI;EAIrB,MAAM,OAAO,eAAe,IAAI,QAAQ,IAAI;EAC5C,IAAI,CAAC,QAAQ,CAAC,OAAO,aAAa,SAAS,KAAK,YAAY,CAAC,GAAG;GAC9D,SAAS,KAAK,KAAK,EAAE,OAAO,mBAAmB,CAAC;GAEhD;EACF;EAIA,MAAM,cAAc,aAAa,QAAQ,aAAa,KAAK,QAAQ,OAAO,EAAE;EAC5E,IAAI,OAAO,aAAa,CAAC,aAAa,KAAK,KAAK,OAAO,WAAW,WAAW,GAAG;GAC9E,SAAS,KAAK,KAAK,EAAE,OAAO,eAAe,CAAC;GAE5C;EACF;EAIA,IAAI,IAAI,WAAW,UAAU,OAAO,UAAU;GAC5C,MAAM,QAAQ,kBAAkB,UAAU,SAAS;GAEnD,IAAI,OAAO;IACT,AAAK,eAAe,OAAO,OAAO,UAAU,MAAM,SAAS,MAAM,QAAQ,KAAK,GAAG;IAEjF;GACF;EACF;EAEA,IAAI,IAAI,WAAW,OAAO;GACxB,SAAS,KAAK,KAAK,EAAE,OAAO,qBAAqB,CAAC;GAElD;EACF;EAEA,IAAI,aAAa,GAAG,UAAU,UAAU;GACtC,SAAS,KAAK,KAAK,MAAM,MAAM,WAAW,IAAI,YAAY,CAAC,CAAC;GAE5D;EACF;EAEA,IAAI,SAAS,WAAW,GAAG,UAAU,SAAS,GAAG;GAC/C,MAAM,UAAU,mBAAmB,SAAS,MAAM,GAAG,UAAU,UAAU,MAAM,CAAC;GAChF,MAAM,QAAQ,QAAQ,SAAS,IAAI,MAAM,IAAI,OAAO,IAAI;GAExD,IAAI,UAAU,QAAW;IACvB,SAAS,KAAK,KAAK;KAAE,OAAO;KAAmB;IAAQ,CAAC;IAExD;GACF;GAEA,SAAS,KAAK,KAAK,KAAK;GAExB;EACF;EAEA,IAAI,aAAa,GAAG,UAAU,aAAa;GACzC,SAAS,KAAK,KAAK,MAAM,UAAU,WAAW,IAAI,YAAY,CAAC,CAAC;GAEhE;EACF;EAEA,IAAI,aAAa,QAAQ,aAAa,KAAK,QAAQ,OAAO,EAAE,GAAG;GAC7D,IAAI,UAAU,KAAK;IACjB,gBAAgB;IAChB,GAAG;GACL,CAAC;GACD,IAAI,IAAI,cAAc,MAAM,OAAO,OAAO,QAAQ,OAAO,QAAQ,GAAG,OAAO,UAAU,gBAAgB,EAAE,CAAC;GAExG;EACF;EAEA,SAAS,KAAK,KAAK,EAAE,OAAO,YAAY,CAAC;CAC3C;AACF;;AAGA,SAAS,SAAS,KAAqB,QAAgB,MAAqB;CAC1E,IAAI,UAAU,QAAQ;EACpB,gBAAgB;EAChB,GAAG;CACL,CAAC;CACD,IAAI,IAAI,KAAK,UAAU,IAAI,CAAC;AAC9B;;;;;;;AAQA,SAAS,kBACP,UACA,WACiD;CACjD,MAAM,SAAS,GAAG,UAAU;CAE5B,IAAI,CAAC,SAAS,WAAW,MAAM,GAC7B;CAGF,MAAM,QAAQ,sCAAsC,KAAK,SAAS,MAAM,OAAO,MAAM,CAAC;CAEtF,IAAI,CAAC,OACH;CAGF,OAAO;EACL,SAAS,mBAAmB,MAAM,EAAE;EACpC,QAAQ,mBAAmB,MAAM,EAAE;CACrC;AACF;;;;;;;AAQA,SAAS,aAAgB,KAA8C;CACrE,OAAO,IAAI,SAAS,SAAS,WAAW;EACtC,MAAM,SAAmB,CAAC;EAC1B,IAAI,OAAO;EAEX,IAAI,GAAG,SAAS,UAAkB;GAChC,QAAQ,MAAM;GAEd,IAAI,OAAO,yBAAyB;IAClC,IAAI,QAAQ;IACZ,uBAAO,IAAI,MAAM,mBAAmB,CAAC;IAErC;GACF;GAEA,OAAO,KAAK,KAAK;EACnB,CAAC;EAED,IAAI,GAAG,aAAa;GAClB,IAAI,OAAO,WAAW,GAAG;IACvB,QAAQ,MAAS;IAEjB;GACF;GAEA,IAAI;IACF,QAAQ,KAAK,MAAM,OAAO,OAAO,MAAM,CAAC,CAAC,SAAS,OAAO,CAAC,CAAM;GAClE,QAAQ;IACN,uBAAO,IAAI,MAAM,cAAc,CAAC;GAClC;EACF,CAAC;EAED,IAAI,GAAG,SAAS,MAAM;CACxB,CAAC;AACH;;;;;;;;;AAUA,eAAe,eACb,OACA,UACA,SACA,QACA,KACA,KACe;CACf,MAAM,QAAQ,MAAM,IAAI,OAAO;CAE/B,IAAI,UAAU,QAAW;EACvB,SAAS,KAAK,KAAK;GAAE,OAAO;GAAmB;EAAQ,CAAC;EAExD;CACF;CAEA,MAAM,OAAO,aAAa,MAAM,MAAM,MAAM;CAE5C,IAAI,SAAS,QAAW;EACtB,SAAS,KAAK,KAAK;GAAE,OAAO;GAAkB;EAAO,CAAC;EAEtD;CACF;CAEA,MAAM,eAAe,wBAAwB,IAAI;CAEjD,IAAI,iBAAiB,QAAW;EAC9B,SAAS,KAAK,KAAK,EAAE,OAAO,mBAAmB,CAAC;EAEhD;CACF;CAEA,IAAI;CAEJ,IAAI;EACF,OAAO,MAAM,aAAkC,GAAG;CACpD,SAAS,OAAO;EACd,MAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU;EACzD,SAAS,KAAK,YAAY,sBAAsB,MAAM,KAAK,EAAE,OAAO,QAAQ,CAAC;EAE7E;CACF;CAEA,IAAI;EAEF,SAAS,KAAK,KAAK,MADG,qBAAqB,cAAc,UAAU,MAAM,YAAY,CAC3D;CAC5B,SAAS,OAAO;EACd,SAAS,KAAK,KAAK;GACjB,OAAO;GACP,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;EAChE,CAAC;CACH;AACF"}

package/esm/dashboard/ui.html.mjs

@@ -302,16 +302,23 @@ function dashboardHtml(basePath, title, evaluateEnabled = false, evaluateDefault
   var EVALUATE_DEFAULT_INSTRUCTIONS = ${encodeForInlineScript(evaluateDefaultInstructions)};
 
   // Carry the ?token= the page itself was loaded with onto every
-  // subsequent poll — otherwise the API calls below inherit no auth and
-  // 401 forever once authToken is configured (the initial page load is
-  // the only request the URL's query string naturally reaches).
-  var TOKEN = new URLSearchParams(window.location.search).get("token");
-  function fetchAuthed(url, options) {
-    var opts = options || {};
-    var headers = opts.headers || {};
-    if (TOKEN) headers = Object.assign({}, headers, { Authorization: "Bearer " + TOKEN });
-    return fetch(url, Object.assign({}, opts, { headers: headers }));
-  }
+  // subsequent poll as an Authorization header — otherwise the API calls
+  // below inherit no auth and 401 forever once authToken is configured
+  // (the initial page load is the only request the URL's query string
+  // naturally reaches; the server only honors ?token= on that one route,
+  // see serve.ts). The token itself is kept in its own nested closure,
+  // not a plain var sitting alongside the rest of this file's top-level
+  // state, so it isn't trivially reachable from other code sharing this
+  // script's outer scope; only the fetchAuthed function it returns is.
+  var fetchAuthed = (function () {
+    var TOKEN = new URLSearchParams(window.location.search).get("token");
+    return function fetchAuthed(url, options) {
+      var opts = options || {};
+      var headers = opts.headers || {};
+      if (TOKEN) headers = Object.assign({}, headers, { Authorization: "Bearer " + TOKEN });
+      return fetch(url, Object.assign({}, opts, { headers: headers }));
+    };
+  })();
 
   var state = {
     traces: [], selectedId: null, selectedSpanId: null, collapsed: {}, sig: null,
@@ -619,11 +626,34 @@ function dashboardHtml(basePath, title, evaluateEnabled = false, evaluateDefault
     return out;
   }
 
+  // (S5) Markdown link URLs come from captured prompt/tool text — attacker-
+  // influenced content — so only http:, https:, mailto: and relative/anchor
+  // URLs may become an href; javascript:, data:, vbscript:, etc. must not.
+  // The check runs on the URL as the browser will act on it: undo the
+  // entities esc() introduced (the HTML parser decodes them exactly once in
+  // the attribute), strip the control chars / whitespace browsers ignore
+  // when parsing a scheme (java\\tscript:), and lowercase. Returns the
+  // original (still-escaped) URL when safe, or null to drop the link.
+  function sanitizeHref(url) {
+    var probe = url.replace(/&(amp|lt|gt|quot|#39);/g, function (m, name) {
+      return { amp: "&", lt: "<", gt: ">", quot: '"', "#39": "'" }[name];
+    });
+    probe = probe.replace(/[\\u0000-\\u0020\\u007f]+/g, "").toLowerCase();
+    if (/^[a-z][a-z0-9+.-]*:/.test(probe)) {
+      return /^(https?|mailto):/.test(probe) ? url : null;
+    }
+    if (/^[\\/\\\\]{2}/.test(probe)) return null; // scheme-relative smuggles a foreign host
+    return url;
+  }
   function mdInline(s) {
     s = s.replace(/\\*\\*([^*]+)\\*\\*/g, "<strong>$1</strong>");
     var codeRe = new RegExp(BT + "([^" + BT + "]+)" + BT, "g");
     s = s.replace(codeRe, "<code>$1</code>");
-    s = s.replace(/\\[([^\\]]+)\\]\\(([^)]+)\\)/g, '<a href="$2" target="_blank" rel="noopener">$1</a>');
+    s = s.replace(/\\[([^\\]]+)\\]\\(([^)]+)\\)/g, function (m, label, url) {
+      var href = sanitizeHref(url);
+      if (href === null) return label; // unsafe scheme: label as plain text, no <a>
+      return '<a href="' + href + '" target="_blank" rel="noopener">' + label + "</a>";
+    });
     return s;
   }
   function mdToHtml(raw) {