@yemi33/minions 0.1.1549 → 0.1.1550

package/CHANGELOG.md

@@ -1,8 +1,12 @@
 # Changelog
 
-## 0.1.1549 (2026-04-24)
+## 0.1.1550 (2026-04-24)
+
+### Fixes
+-  escape </script> literal in utils.js (closes #1746) (#1751)
 
 ### Other
+- test(engine): add unit tests for isWorktreeRetryableError, removeStaleIndexLock, _maxTurnsForType, buildProjectContext, normalizeAc (#1752)
 - test(timeout): add unit tests for checkIdleThreshold, checkSteering, checkTimeouts (#1748)
 
 ## 0.1.1548 (2026-04-23)

package/dashboard/js/utils.js

@@ -98,9 +98,15 @@ function toggleModalPin() {
 
 // Canonical HTML-escape helper (SEC-03). Use this in all new code and for any user-controlled
 // field that reaches `.innerHTML` / a template literal. Escapes the 6 HTML metacharacters
-// (& < > " ' /) — the `/` escape closes the `</script>` break-out path that a 5-char escape
+// (& < > " ' /) — the `/` escape closes the `<\/script>` break-out path that a 5-char escape
 // leaves open. Returns '' for null/undefined so missing fields never render the literal strings
 // "null"/"undefined". Idempotent for non-metacharacter input (double-escaping only expands `&`).
+// NOTE: the `<\/script>` spelling above is deliberate. dashboard.js inlines every module in
+// dashboard/js/ into a single inline <script> block; a raw closing-script-tag literal in any
+// comment or string closes that block early and spills the rest as document text (issue #1746).
+// The HTML5 tokenizer's script-data end-tag match is byte-level and ignores JS comment/string
+// boundaries, so the only safe way to reference the token in-source is to break the match —
+// `<` followed by `\/` works because after `<` only `/` (not `\`) triggers end-tag-open state.
 function escapeHtml(str) {
   if (str === null || str === undefined) return '';
   return String(str)

package/engine.js

@@ -3759,6 +3759,8 @@ module.exports = {
   // Shared helpers (used by lifecycle.js and tests)
   reconcileItemsWithPrs, detectDependencyCycles,
   parseConflictFiles, pruneAncestorDeps, preflightMergeSimulation, // exported for testing
+  isWorktreeRetryableError, removeStaleIndexLock, // exported for testing
+  _maxTurnsForType, buildProjectContext, normalizeAc, // exported for testing
 
   // Playbooks
   renderPlaybook, validatePlaybookVars, PLAYBOOK_REQUIRED_VARS, buildWorkItemDispatchVars,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yemi33/minions",
-  "version": "0.1.1549",
+  "version": "0.1.1550",
   "description": "Multi-agent AI dev team that runs from ~/.minions/ — five autonomous agents share a single engine, dashboard, and knowledge base",
   "bin": {
     "minions": "bin/minions.js"