@yemi33/minions 0.1.2047 → 0.1.2049

package/dashboard/js/render-pipelines.js

@@ -310,6 +310,7 @@ function renderPipelines(pipelines) {
   const start = _pipelinePage * PIPELINE_PER_PAGE;
   const pageItems = pipelines.slice(start, start + PIPELINE_PER_PAGE);
 
+  // eslint-disable-next-line no-unsanitized/property -- reason: structural HTML is a string literal; all user data wrapped in escHtml() (fields: pipeline id, title, trigger, resources, stages)
   el.innerHTML = pageItems.map(function(p) {
     const activeRun = _getPipelineActiveRun(p);
     const lastRun = (p.runs || []).slice(-1)[0];
@@ -351,6 +352,7 @@ function renderPipelines(pipelines) {
   }).join('');
 
   if (pipelines.length > PIPELINE_PER_PAGE) {
+    // eslint-disable-next-line no-unsanitized/method -- reason: composed from internal numeric page bounds and fixed pager actions (no user data flows in)
     el.insertAdjacentHTML('beforeend', '<div class="pr-pager">' +
       '<span class="pr-page-info">Showing ' + (start + 1) + ' to ' + Math.min(start + PIPELINE_PER_PAGE, pipelines.length) + ' of ' + pipelines.length + '</span>' +
       '<div class="pr-pager-btns">' +
@@ -474,6 +476,7 @@ function openPipelineDetail(id) {
   html += '</div>';
 
   document.getElementById('modal-title').textContent = 'Pipeline: ' + displayTitle;
+  // eslint-disable-next-line no-unsanitized/property -- reason: renderMd() escapes user-controlled stage output before assembling HTML; all other user data wrapped in escHtml() (see dashboard/js/utils.js)
   document.getElementById('modal-body').innerHTML = html;
   document.getElementById('modal').classList.add('open');
 
@@ -684,6 +687,7 @@ function openCreatePipelineModal() {
   }).join('');
 
   document.getElementById('modal-title').textContent = 'New Pipeline';
+  // eslint-disable-next-line no-unsanitized/property -- reason: composed from fixed scheduler option arrays and escaped timezone (no user data flows in)
   document.getElementById('modal-body').innerHTML =
     '<div style="display:flex;flex-direction:column;gap:10px">' +
       '<label style="color:var(--text);font-size:var(--text-md)">ID<input id="pl-id" style="' + inputStyle + '" placeholder="e.g. daily-audit-cycle"></label>' +
@@ -785,6 +789,7 @@ function openEditPipelineModal(id) {
   window._editPipelineId = id;
 
   document.getElementById('modal-title').textContent = 'Edit Pipeline: ' + displayTitle;
+  // eslint-disable-next-line no-unsanitized/property -- reason: structural HTML is a string literal; all user data wrapped in escHtml() (fields: pipeline id, title, stages JSON, timezone)
   document.getElementById('modal-body').innerHTML =
     '<div style="display:flex;flex-direction:column;gap:10px">' +
       '<div style="color:var(--muted);font-size:11px">ID: <strong style="color:var(--text)">' + escHtml(id) + '</strong></div>' +

package/dashboard/js/render-plans.js

@@ -13,6 +13,7 @@ function openCreatePlanModal() {
   const inputStyle = 'display:block;width:100%;margin-top:4px;padding:6px 8px;background:var(--bg);border:1px solid var(--border);border-radius:var(--radius-sm);color:var(--text);font-size:var(--text-md);font-family:inherit';
 
   document.getElementById('modal-title').textContent = 'Create Plan';
+  // eslint-disable-next-line no-unsanitized/property -- reason: structural HTML is a string literal; all user data wrapped in escapeHtml() (fields: project names)
   document.getElementById('modal-body').innerHTML =
     '<div style="display:flex;flex-direction:column;gap:10px">' +
       '<label style="color:var(--text);font-size:var(--text-md)">Title <input id="plan-new-title" style="' + inputStyle + '" placeholder="e.g. Add user authentication with JWT"></label>' +
@@ -383,6 +384,7 @@ function renderPlans(plans) {
     '</div>';
   }
 
+  // eslint-disable-next-line no-unsanitized/property -- reason: structural HTML is a string literal; all user data wrapped in escapeHtml() (fields: plan file, summary, project, generatedBy, revision feedback, action target files)
   el.innerHTML = html;
   restoreNotifBadges();
 }
@@ -413,6 +415,7 @@ function openArchivedPlansModal() {
   }).join('');
 
   document.getElementById('modal-title').textContent = 'Archived Plans';
+  // eslint-disable-next-line no-unsanitized/property -- reason: structural HTML is a string literal; all user data wrapped in escapeHtml() (fields: archived plan file, summary, project, generatedBy)
   document.getElementById('modal-body').innerHTML = html;
   document.getElementById('modal-body').style.fontFamily = "'Segoe UI', system-ui, sans-serif";
   document.getElementById('modal-body').style.whiteSpace = 'normal';
@@ -456,6 +459,7 @@ async function planExecute(file, project, btn) {
 function planReexecuteModal(file, project) {
   const inputStyle = 'display:block;width:100%;margin-top:4px;padding:6px 8px;background:var(--bg);border:1px solid var(--border);border-radius:var(--radius-sm);color:var(--text);font-size:var(--text-md);font-family:inherit';
   document.getElementById('modal-title').textContent = 'Re-execute Plan';
+  // eslint-disable-next-line no-unsanitized/property -- reason: structural HTML is a string literal; all user data wrapped in escapeHtml() (fields: plan file, project)
   document.getElementById('modal-body').innerHTML =
     '<div style="display:flex;flex-direction:column;gap:10px">' +
       '<div style="font-size:12px;color:var(--muted)">' + escapeHtml(file) + '</div>' +
@@ -545,6 +549,7 @@ function _renderPlanModal(normalizedFile, raw, lastMod) {
   if (normalizedFile.endsWith('.json')) {
     let plan;
     try { plan = JSON.parse(raw); } catch (e) {
+      // eslint-disable-next-line no-unsanitized/property -- reason: structural HTML is a string literal; all user data wrapped in escapeHtml() (fields: parse error message, raw plan excerpt)
       document.getElementById('modal-body').innerHTML = '<p style="color:var(--red)">Failed to parse plan JSON: ' + escapeHtml(e.message) + '</p><pre style="font-size:10px;max-height:200px;overflow:auto">' + escapeHtml((raw || '').slice(0, 500)) + '</pre>';
       return;
     }
@@ -632,6 +637,7 @@ function _renderPlanModal(normalizedFile, raw, lastMod) {
   const lastModLabel = lastMod ? '<div style="font-size:10px;color:var(--muted);font-weight:400;margin-top:2px">Last updated: ' + formatLocalDateTime(lastMod) + '</div>' : '';
   const actionBtns = '<div style="display:flex;gap:4px;flex-wrap:wrap;margin-top:4px">' + modalActions + '</div>';
 
+  // eslint-disable-next-line no-unsanitized/property -- reason: structural HTML is a string literal; all user data wrapped in escapeHtml() (fields: plan title, version label, action target files)
   document.getElementById('modal-title').innerHTML = escapeHtml(title) + (versionLabel ? ' <span style="font-size:11px;font-weight:700;padding:1px 6px;border-radius:3px;background:rgba(56,139,253,0.15);color:var(--blue)">' + escapeHtml(versionLabel) + '</span>' : '') + lastModLabel + actionBtns;
   const modalBody = document.getElementById('modal-body');
   const scrollTop = modalBody.scrollTop;
@@ -640,6 +646,7 @@ function _renderPlanModal(normalizedFile, raw, lastMod) {
     modalBody.style.fontFamily = 'Consolas, monospace';
     modalBody.style.whiteSpace = 'pre-wrap';
   } else {
+    // eslint-disable-next-line no-unsanitized/property -- reason: renderMd() escapes all user-controlled fields before assembling HTML (see dashboard/js/utils.js)
     modalBody.innerHTML = renderMd(text);
   }
   modalBody.scrollTop = scrollTop;
@@ -882,6 +889,7 @@ async function planOpenInDocChat(file) {
       document.getElementById('modal-body').style.fontFamily = 'Consolas, monospace';
       document.getElementById('modal-body').style.whiteSpace = 'pre-wrap';
     } else {
+      // eslint-disable-next-line no-unsanitized/property -- reason: renderMd() escapes all user-controlled fields before assembling HTML (see dashboard/js/utils.js)
       document.getElementById('modal-body').innerHTML = renderMd(text);
     }
     _modalDocContext = { title: title, content: text, selection: '' };
@@ -932,6 +940,7 @@ async function openVerifyGuide(file) {
     const content = await fetch('/api/plans/' + encodeURIComponent(normalizedFile)).then(r => r.text());
     document.getElementById('modal-title').innerHTML = 'Manual Testing Guide' +
       ' <button class="pr-pager-btn" style="font-size:9px;padding:2px 8px;margin-left:8px;vertical-align:middle" onclick="openArchivedPrdModal()">Back</button>';
+    // eslint-disable-next-line no-unsanitized/property -- reason: renderMd() escapes all user-controlled fields before assembling HTML (see dashboard/js/utils.js)
     document.getElementById('modal-body').innerHTML = renderMd(content);
     _modalDocContext = { title: 'Manual Testing Guide', content, selection: '' };
     _modalFilePath = 'prd/' + normalizedFile; showModalQa();

package/dashboard/js/render-prd.js

@@ -44,6 +44,7 @@ async function _savePrdDesc(source, itemId) {
     });
     if (res.ok) {
       _prdDescRawCache = newDesc;
+      // eslint-disable-next-line no-unsanitized/property -- reason: renderMd() escapes all user-controlled fields before assembling HTML (see dashboard/js/utils.js)
       view.innerHTML = newDesc ? renderMd(newDesc) : '<span style="color:var(--muted);font-size:11px">No description</span>';
       view.style.display = '';
       editor.style.display = 'none';
@@ -116,6 +117,7 @@ function renderPrd(prd, prog) {
           ' <button class="pr-pager-btn" style="font-size:9px;padding:1px 6px;margin-left:4px" onclick="planArchive(\'' + escHtml(prdFile) + '\',this)">Archive</button>';
       }
     }
+    // eslint-disable-next-line no-unsanitized/property -- reason: structural HTML is a string literal; all user data wrapped in escHtml() (fields: PRD file; status label/color and age text are derived UI state)
     badge.innerHTML = '<span style="font-weight:600;font-size:11px;color:' + (statusColors[effectiveStatus] || 'var(--muted)') + '">' + (statusLabels[effectiveStatus] || effectiveStatus) + '</span>' +
       ' <span style="color:var(--muted);font-size:10px">' + (prd.age || '') + '</span>' + actions;
   } else {
@@ -134,6 +136,7 @@ function renderPrd(prd, prog) {
     const parts = Object.entries(counts).filter(([, n]) => n > 0).map(([s, n]) =>
       '<span style="font-size:10px;color:' + (statusColors[s] || 'var(--muted)') + '">' + n + ' ' + (statusLabels[s] || s).toLowerCase() + '</span>'
     );
+    // eslint-disable-next-line no-unsanitized/property -- reason: composed from compile-time constants (no user data flows in)
     badge.innerHTML = '<span style="font-weight:600;font-size:11px;color:var(--text)">' + existing.length + ' PRDs</span> ' + parts.join(' · ');
   }
   section.innerHTML = '';
@@ -644,6 +647,7 @@ function renderPrdProgress(prog) {
     '</div>';
   }
 
+  // eslint-disable-next-line no-unsanitized/property -- reason: structural HTML is a string literal; all user data wrapped in escHtml() or renderMd() by PRD renderers (fields: item ids/names/descriptions, source, projects, PR links, branches, agent labels)
   el.innerHTML = html;
   restoreNotifBadges();
 }
@@ -686,6 +690,7 @@ function openArchivedPrdModal() {
   }
 
   document.getElementById('modal-title').textContent = 'Archived PRDs';
+  // eslint-disable-next-line no-unsanitized/property -- reason: structural HTML is a string literal; all user data wrapped in escHtml() (fields: archived PRD file, summary, projects, completion date)
   document.getElementById('modal-body').innerHTML = html;
   document.getElementById('modal-body').style.fontFamily = "'Segoe UI', system-ui, sans-serif";
   document.getElementById('modal-body').style.whiteSpace = 'normal';
@@ -725,6 +730,7 @@ function showArchivedPrdDetail(idxOrFile) {
   '</div>';
 
   document.getElementById('modal-title').textContent = g.summary || g.file;
+  // eslint-disable-next-line no-unsanitized/property -- reason: structural HTML is a string literal; all user data wrapped in escHtml() or renderMd() by archived PRD renderers (fields: PRD file, group header, items, stats, E2E links)
   document.getElementById('modal-body').innerHTML = toggleHtml + content;
   document.getElementById('modal-body').style.fontFamily = "'Segoe UI', system-ui, sans-serif";
   document.getElementById('modal-body').style.whiteSpace = 'normal';
@@ -816,6 +822,7 @@ async function prdItemEdit(source, itemId) {
   '</div>';
 
   document.getElementById('modal-title').textContent = item.id + ' — ' + (item.name || '').slice(0, 60);
+  // eslint-disable-next-line no-unsanitized/property -- reason: structural HTML is a string literal; all user data wrapped in escHtml() or renderMd() (fields: PRD item name/description, source, item id, agent, completion summary, PR links)
   document.getElementById('modal-body').innerHTML = html;
   document.getElementById('modal-body').style.fontFamily = '';
   document.getElementById('modal-body').style.whiteSpace = '';
@@ -1003,6 +1010,7 @@ function openArchive(i) {
 
   html += '</div>';
 
+  // eslint-disable-next-line no-unsanitized/property -- reason: structural HTML is a string literal; all user data wrapped in escHtml() (fields: archive summary, feature ids/names/descriptions/statuses, rationale, affected areas, open questions)
   document.getElementById('modal-body').innerHTML = html;
   document.getElementById('modal-body').style.fontFamily = "'Segoe UI', system-ui, sans-serif";
   document.getElementById('modal-body').style.whiteSpace = 'normal';

package/dashboard/js/render-prs.js

@@ -170,6 +170,7 @@ function renderPrs(prs) {
 
   const tableWrap = el.querySelector('.pr-table-wrap');
   const savedScroll = tableWrap ? tableWrap.scrollLeft : 0;
+  // eslint-disable-next-line no-unsanitized/property -- reason: structural HTML is a string literal; all PR user data wrapped in escapeHtml() by prRow() (fields: PR id, title, description, agent, branch, review/build/status labels)
   el.innerHTML = prTableHtml(rows) + pager;
   if (savedScroll) {
     const newWrap = el.querySelector('.pr-table-wrap');
@@ -184,6 +185,7 @@ function openAllPrs() {
   const modalEl = document.querySelector('#modal .modal');
   if (modalEl) modalEl.classList.add('modal-wide');
   document.getElementById('modal-title').textContent = 'All Pull Requests (' + allPrs.length + ')';
+  // eslint-disable-next-line no-unsanitized/property -- reason: structural HTML is a string literal; all PR user data wrapped in escapeHtml() by prRow() (fields: PR id, title, description, agent, branch, review/build/status labels)
   document.getElementById('modal-body').innerHTML = prTableHtml(allPrs.map(prRow).join(''));
   document.getElementById('modal-body').style.fontFamily = "'Segoe UI', system-ui, sans-serif";
   document.getElementById('modal-body').style.whiteSpace = 'normal';
@@ -194,6 +196,7 @@ function openModal(i) {
   const item = inboxData[i];
   if (!item) return;
   document.getElementById('modal-title').textContent = item.name;
+  // eslint-disable-next-line no-unsanitized/property -- reason: renderMd() escapes item.content before assembling HTML; item.name is wrapped in escapeHtml() (see dashboard/js/utils.js)
   document.getElementById('modal-body').innerHTML =
     '<div style="margin-bottom:12px"><button class="pr-pager-btn" style="font-size:10px;padding:3px 10px" onclick="promoteToKB(\'' + escapeHtml(item.name) + '\')">Add to Knowledge Base</button></div>' +
     '<div style="font-size:12px;line-height:1.7;color:var(--muted)">' + renderMd(item.content) + '</div>';
@@ -224,6 +227,7 @@ function openAddPrModal() {
     : '';
 
   document.getElementById('modal-title').textContent = 'Link Pull Request';
+  // eslint-disable-next-line no-unsanitized/property -- reason: structural HTML is a string literal; all user data wrapped in escapeHtml() (fields: project names)
   document.getElementById('modal-body').innerHTML =
     '<div style="display:flex;flex-direction:column;gap:10px">' +
       noProjectsWarning +

package/dashboard/js/render-schedules.js

@@ -369,6 +369,7 @@ function renderSchedules(schedules) {
     }
   }
 
+  // eslint-disable-next-line no-unsanitized/property -- reason: structural HTML is a string literal; all user data wrapped in escHtml() by schedule renderers (fields: schedule id/title/cron/type/project/agent/description)
   el.innerHTML = html;
 }
 
@@ -382,6 +383,7 @@ function openScheduleDetail(id) {
   const lastRun = s._lastRun ? formatLocalDateTime(s._lastRun) : 'never';
   const enabledLabel = s.enabled ? '<span class="pr-badge approved">enabled</span>' : '<span class="pr-badge rejected">disabled</span>';
 
+  // eslint-disable-next-line no-unsanitized/property -- reason: structural HTML is a string literal; all user data wrapped in escHtml() (fields: schedule title, schedule id)
   document.getElementById('modal-title').innerHTML = escHtml(s.title || s.id) +
     ' <div style="display:flex;gap:4px;margin-top:4px">' +
       '<button class="pr-pager-btn" style="font-size:10px;padding:2px 10px;color:var(--green)" onclick="runScheduleNow(\'' + escHtml(s.id) + '\',this)">Run now</button>' +
@@ -402,6 +404,7 @@ function openScheduleDetail(id) {
     (s.description ? '<div><strong style="color:var(--muted)">Description:</strong><div style="margin-top:4px;padding:8px;background:var(--surface2);border-radius:4px">' + renderMd(s.description) + '</div></div>' : '') +
   '</div>';
 
+  // eslint-disable-next-line no-unsanitized/property -- reason: structural HTML is a string literal; all user data wrapped in escHtml() or renderMd() (fields: schedule id/title/cron/type/priority/project/agent/description/last run)
   document.getElementById('modal-body').innerHTML = body;
   document.getElementById('modal-body').style.whiteSpace = 'normal';
   document.getElementById('modal-body').style.fontFamily = "'Segoe UI', system-ui, sans-serif";
@@ -518,6 +521,7 @@ function openCreateScheduleModal() {
   document.getElementById('modal-title').textContent = 'New Scheduled Task';
   document.getElementById('modal-body').style.whiteSpace = 'normal';
   document.getElementById('modal-body').style.fontFamily = '';
+  // eslint-disable-next-line no-unsanitized/property -- reason: structural HTML is a string literal; all user data wrapped in escHtml() by _scheduleFormHtml() (fields: project names, agent ids/names)
   document.getElementById('modal-body').innerHTML = _scheduleFormHtml({}, false);
   document.getElementById('modal').classList.add('open');
   _updateCronPreview();
@@ -530,6 +534,7 @@ function openEditScheduleModal(id) {
   document.getElementById('modal-title').textContent = 'Edit Schedule: ' + id;
   document.getElementById('modal-body').style.whiteSpace = 'normal';
   document.getElementById('modal-body').style.fontFamily = '';
+  // eslint-disable-next-line no-unsanitized/property -- reason: structural HTML is a string literal; all user data wrapped in escHtml() by _scheduleFormHtml() (fields: schedule id/title/cron/description, project names, agent ids/names)
   document.getElementById('modal-body').innerHTML = _scheduleFormHtml(sched, true);
   window._editScheduleId = id;
   document.getElementById('modal').classList.add('open');

package/dashboard/js/render-skills.js

@@ -113,6 +113,7 @@ function renderSkills(skills) {
     html += '</div>';
   }
 
+  // eslint-disable-next-line no-unsanitized/property -- reason: structural HTML is a string literal; all user data wrapped in escHtml() or _jsArg() (fields: skill file/source/dir/name/description/tab labels)
   el.innerHTML = html;
   window._lastSkills = skills;
 }
@@ -131,6 +132,7 @@ function openSkill(file, source, dir) {
     .then(r => r.text())
     .then(content => {
       document.getElementById('modal-title').textContent = file;
+      // eslint-disable-next-line no-unsanitized/property -- reason: renderMd() escapes all user-controlled fields before assembling HTML (see dashboard/js/utils.js)
       document.getElementById('modal-body').innerHTML = renderMd(content);
       document.getElementById('modal-body').style.fontFamily = "'Segoe UI', system-ui, sans-serif";
       document.getElementById('modal-body').style.whiteSpace = 'normal';

package/dashboard/js/render-watches.js

@@ -187,6 +187,7 @@ function renderWatches(watchesData) {
     '</div>';
   }
 
+  // eslint-disable-next-line no-unsanitized/property -- reason: structural HTML is a string literal; all user data wrapped in escHtml() (fields: watch id/target/description/action type/owner/timestamps)
   el.innerHTML = html;
 }
 
@@ -278,6 +279,7 @@ function openWatchDetail(id) {
   var targetLabel = _targetTypeLabel(w.targetType);
   var condLabel = _conditionLabel(w.condition);
 
+  // eslint-disable-next-line no-unsanitized/property -- reason: structural HTML is a string literal; all user data wrapped in escHtml() (fields: watch description/target/id)
   document.getElementById('modal-title').innerHTML = escHtml(w.description || w.target) +
     ' <div style="display:flex;gap:4px;margin-top:4px">' +
       (w.status === 'active' ? '<button class="pr-pager-btn" style="font-size:10px;padding:2px 10px;color:var(--yellow)" onclick="toggleWatchPause(\'' + escHtml(w.id) + '\',true);closeModal()">Pause</button>' : '') +
@@ -318,6 +320,7 @@ function openWatchDetail(id) {
     '<div id="watch-history-' + escHtml(w.id) + '"><div style="color:var(--muted);font-style:italic;font-size:11px">Loading history…</div></div>' +
   '</div>';
 
+  // eslint-disable-next-line no-unsanitized/property -- reason: structural HTML is a string literal; all user data wrapped in escHtml() by watch detail renderers (fields: watch id/target/owner/description/action params/requires/history/result messages)
   document.getElementById('modal-body').innerHTML = body;
   document.getElementById('modal-body').style.whiteSpace = 'normal';
   document.getElementById('modal-body').style.fontFamily = "'Segoe UI', system-ui, sans-serif";
@@ -336,10 +339,12 @@ function openWatchDetail(id) {
       return res.json();
     }).then(function(data) {
       if (!container.isConnected) return; // user closed the modal
+      // eslint-disable-next-line no-unsanitized/property -- reason: _renderWatchHistoryDetail() escapes all user-controlled fields before assembling HTML
       container.innerHTML = _renderWatchHistoryDetail(data && data.history);
     }).catch(function() {
       if (!container.isConnected) return;
       // Fall back to the inline _history from /api/watches (best-effort).
+      // eslint-disable-next-line no-unsanitized/property -- reason: _renderWatchHistoryDetail() escapes all user-controlled fields before assembling HTML
       container.innerHTML = _renderWatchHistoryDetail(w._history || []);
     });
   })();
@@ -489,6 +494,7 @@ function _addWatchStepRow(initial) {
   row.className = 'watch-step-row';
   row.setAttribute('data-step-idx', String(idx));
   row.style.cssText = 'border:1px solid var(--border);border-radius:var(--radius-sm);padding:8px;display:flex;flex-direction:column;gap:6px;background:var(--surface)';
+  // eslint-disable-next-line no-unsanitized/property -- reason: structural HTML is a string literal; all user data wrapped in escHtml() (fields: action registry values/labels/descriptions)
   row.innerHTML =
     '<div style="display:flex;align-items:center;justify-content:space-between;gap:8px">' +
       '<select id="watch-step-' + idx + '-type" style="' + inputStyle + ';margin-top:0;flex:1" onchange="_updateWatchStepParamsHint(' + idx + ')">' + actionOpts + '</select>' +
@@ -551,6 +557,7 @@ function _addRequireRow(initial) {
   row.className = 'watch-require-row';
   row.setAttribute('data-require-idx', String(idx));
   row.style.cssText = 'display:grid;grid-template-columns:1fr 1fr 1fr auto;gap:6px;align-items:end';
+  // eslint-disable-next-line no-unsanitized/property -- reason: structural HTML is a string literal; all user data wrapped in escHtml() (fields: target type registry values/labels)
   row.innerHTML =
     '<label style="color:var(--text);font-size:11px;margin:0">Target<input id="watch-require-' + idx + '-target" placeholder="e.g. PR-123, pipeline-X" style="' + inputStyle + '"></label>' +
     '<label style="color:var(--text);font-size:11px;margin:0">Target Type<select id="watch-require-' + idx + '-target-type" style="' + inputStyle + '" onchange="_updateRequireConditionOptions(' + idx + ')">' + ttOpts + '</select></label>' +
@@ -576,6 +583,7 @@ function _updateRequireConditionOptions(idx) {
   if (!ttSel || !condSel || !_watchTargetTypesCache) return;
   var entry = _watchTargetTypesCache.find(function(t) { return t.value === ttSel.value; });
   var conditions = (entry && entry.conditions) || [];
+  // eslint-disable-next-line no-unsanitized/property -- reason: structural HTML is a string literal; all user data wrapped in escHtml() (fields: condition registry values, condition labels)
   condSel.innerHTML = (conditions.length ? '' : '<option value="">— select target type first —</option>') +
     conditions.map(function(c) {
       return '<option value="' + escHtml(c) + '">' + escHtml(_conditionLabel(c)) + '</option>';
@@ -589,6 +597,7 @@ function _updateWatchConditionOptions() {
   if (!ttSel || !condSel || !_watchTargetTypesCache) return;
   var entry = _watchTargetTypesCache.find(function(t) { return t.value === ttSel.value; });
   var conditions = (entry && entry.conditions) || [];
+  // eslint-disable-next-line no-unsanitized/property -- reason: structural HTML is a string literal; all user data wrapped in escHtml() (fields: condition registry values, condition labels)
   condSel.innerHTML = conditions.map(function(c) {
     return '<option value="' + escHtml(c) + '">' + escHtml(_conditionLabel(c)) + '</option>';
   }).join('');
@@ -597,6 +606,7 @@ function _updateWatchConditionOptions() {
 function _renderCreateWatchModal() {
   document.getElementById('modal-title').innerHTML = 'Create Watch' +
     ' <button class="pr-pager-btn" style="font-size:10px;padding:2px 12px;color:var(--green);border-color:var(--green);margin-left:8px" onclick="submitWatch()">Create</button>';
+  // eslint-disable-next-line no-unsanitized/property -- reason: structural HTML is a string literal; all user data wrapped in escHtml() by _watchFormHtml() (fields: target/action registries, project names, agent ids/names)
   document.getElementById('modal-body').innerHTML = _watchFormHtml();
   document.getElementById('modal-body').style.whiteSpace = 'normal';
   document.getElementById('modal-body').style.fontFamily = "'Segoe UI', system-ui, sans-serif";

package/dashboard/js/render-work-items.js

@@ -149,6 +149,7 @@ function renderWorkItems(items) {
 
   const tableWrap = el.querySelector('.pr-table-wrap');
   const savedScroll = tableWrap ? tableWrap.scrollLeft : 0;
+  // eslint-disable-next-line no-unsanitized/property -- reason: structural HTML is a string literal; all user data wrapped in escapeHtml() by wiRow() (fields: work item id/title/source/status/agent/PR links/dates/follow-up metadata)
   el.innerHTML = html;
   if (savedScroll) {
     const newWrap = el.querySelector('.pr-table-wrap');
@@ -200,6 +201,7 @@ async function editWorkItem(id, source) {
 
   document.getElementById('modal-title').textContent = 'Edit Work Item ' + id;
   document.getElementById('modal-body').style.whiteSpace = 'normal';
+  // eslint-disable-next-line no-unsanitized/property -- reason: structural HTML is a string literal; all user data wrapped in escapeHtml() (fields: title, description, references, acceptance criteria, dependencies, agent ids/names, work item id/source)
   document.getElementById('modal-body').innerHTML =
     '<div style="display:flex;flex-direction:column;gap:12px;font-family:inherit">' +
       '<label style="color:var(--text);font-size:var(--text-md)">Title' +
@@ -320,6 +322,7 @@ async function toggleWorkItemArchive() {
   try {
     const items = await fetch('/api/work-items/archive').then(r => r.json());
     if (!items.length) { el.innerHTML = '<p class="empty">No archived work items.</p>'; return; }
+    // eslint-disable-next-line no-unsanitized/property -- reason: structural HTML is a string literal; all user data wrapped in escapeHtml() (fields: archived work item id/title/type/status/agent)
     el.innerHTML = '<div style="font-size:10px;color:var(--muted);margin-bottom:6px;font-weight:600;text-transform:uppercase;letter-spacing:0.5px">Archived (' + items.length + ')</div>' +
       '<div class="pr-table-wrap"><table class="pr-table"><thead><tr><th>ID</th><th>Title</th><th>Type</th><th>Status</th><th>Agent</th><th>Archived</th></tr></thead><tbody>' +
       items.map(function(i) {
@@ -371,6 +374,7 @@ let _feedbackRating = null;
 function feedbackWorkItem(id, source) {
   _feedbackRating = null;
   document.getElementById('modal-title').textContent = 'Feedback on ' + id;
+  // eslint-disable-next-line no-unsanitized/property -- reason: structural HTML is a string literal; all user data wrapped in escapeHtml() (fields: work item id, source)
   document.getElementById('modal-body').innerHTML =
     '<div style="display:flex;flex-direction:column;gap:16px">' +
       '<div style="display:flex;gap:16px;justify-content:center">' +
@@ -431,6 +435,7 @@ function openCreateWorkItemModal() {
   const inputStyle = 'display:block;width:100%;margin-top:4px;padding:6px 8px;background:var(--bg);border:1px solid var(--border);border-radius:var(--radius-sm);color:var(--text);font-size:var(--text-md);font-family:inherit';
 
   document.getElementById('modal-title').textContent = 'Create Work Item';
+  // eslint-disable-next-line no-unsanitized/property -- reason: structural HTML is a string literal; all user data wrapped in escapeHtml() (fields: agent ids/names, project names)
   document.getElementById('modal-body').innerHTML =
     '<div style="display:flex;flex-direction:column;gap:10px">' +
       '<label style="color:var(--text);font-size:var(--text-md)">Title <input id="wi-new-title" style="' + inputStyle + '" placeholder="What needs to be done?"></label>' +
@@ -646,6 +651,7 @@ function openWorkItemDetail(id) {
 
   const initial = needsHydration ? Object.assign({}, cached, { _descriptionLoading: true }) : cached;
   document.getElementById('modal-title').textContent = initial.title || initial.id;
+  // eslint-disable-next-line no-unsanitized/property -- reason: structural HTML is a string literal; all user data wrapped in escapeHtml() or renderMd() by _wiRenderDetail() (fields: title, description, agent, source, reasons, references, artifacts, PR links)
   document.getElementById('modal-body').innerHTML = _wiRenderDetail(initial);
   document.getElementById('modal-body').style.fontFamily = "'Segoe UI', system-ui, sans-serif";
   document.getElementById('modal-body').style.whiteSpace = 'normal';
@@ -669,6 +675,7 @@ function openWorkItemDetail(id) {
       merged.description = full.description || cached.description || '';
       if (Array.isArray(full.acceptanceCriteria)) merged.acceptanceCriteria = full.acceptanceCriteria;
       if (Array.isArray(full.references)) merged.references = full.references;
+      // eslint-disable-next-line no-unsanitized/property -- reason: structural HTML is a string literal; all user data wrapped in escapeHtml() or renderMd() by _wiRenderDetail() (fields: title, description, agent, source, reasons, references, artifacts, PR links)
       document.getElementById('modal-body').innerHTML = _wiRenderDetail(merged);
     })
     .catch(function() {
@@ -681,6 +688,7 @@ function openAllWorkItems() {
   document.getElementById('modal-title').textContent = 'All Work Items (' + allWorkItems.length + ')';
   const html = '<div class="pr-table-wrap"><table class="pr-table"><thead><tr><th>ID</th><th>Title</th><th>Source</th><th>Type</th><th>Priority</th><th>Status</th><th>Agent</th><th>PR</th><th>Created</th><th></th><th></th></tr></thead><tbody>' +
     allWorkItems.map(wiRow).join('') + '</tbody></table></div>';
+  // eslint-disable-next-line no-unsanitized/property -- reason: structural HTML is a string literal; all user data wrapped in escapeHtml() by wiRow() (fields: work item id/title/source/status/agent/PR links/dates/follow-up metadata)
   document.getElementById('modal-body').innerHTML = html;
   document.getElementById('modal-body').style.fontFamily = "'Segoe UI', system-ui, sans-serif";
   document.getElementById('modal-body').style.whiteSpace = 'normal';
@@ -696,6 +704,7 @@ function viewAgentOutput(logPath) {
   fetch('/api/agent-output?file=' + encodeURIComponent(logPath))
     .then(function(r) { if (!r.ok) throw new Error('HTTP ' + r.status); return r.text(); })
     .then(function(content) {
+      // eslint-disable-next-line no-unsanitized/property -- reason: renderAgentOutput() escapes all user-controlled fields before assembling HTML (see dashboard/js/render-utils.js)
       document.getElementById('modal-body').innerHTML = renderAgentOutput(content);
     })
     .catch(function() {

package/dashboard/js/settings.js

@@ -351,6 +351,7 @@ async function openSettings() {
     saveBtn.onclick = saveSettings;
     actions.insertBefore(saveBtn, actions.lastElementChild);
   }
+  // eslint-disable-next-line no-unsanitized/property -- reason: structural HTML is a string literal; all user data wrapped in escHtml() (fields: engine, claude, agents, projects, routing, features)
   document.getElementById('modal-body').innerHTML = '<div id="settings-status" style="font-size:11px;min-height:16px;margin-bottom:4px"></div>' + html;
   document.getElementById('modal-body').style.fontFamily = '';
   document.getElementById('modal-body').style.whiteSpace = '';
@@ -411,9 +412,11 @@ async function initRuntimeFleetUI(engineCfg, agentsCfg) {
   const names = runtimes.length ? runtimes.map(rt => rt.name) : ['copilot'];
   const currentDefault = engineCfg.defaultCli || 'copilot';
   const currentCc = engineCfg.ccCli || '';
+  // eslint-disable-next-line no-unsanitized/property -- reason: structural HTML is a string literal; all user data wrapped in escHtml() (fields: runtime names)
   cliSelect.innerHTML = names.map(n =>
     '<option value="' + escHtml(n) + '"' + (n === currentDefault ? ' selected' : '') + '>' + escHtml(n) + '</option>'
   ).join('');
+  // eslint-disable-next-line no-unsanitized/property -- reason: structural HTML is a string literal; all user data wrapped in escHtml() (fields: runtime names)
   ccCliSelect.innerHTML =
     '<option value=""' + (!currentCc ? ' selected' : '') + '>Inherit Default CLI</option>' +
     names.map(n =>
@@ -427,6 +430,7 @@ async function initRuntimeFleetUI(engineCfg, agentsCfg) {
     const agentId = cell.getAttribute('data-runtime-cli');
     const agent = (agentsCfg || {})[agentId] || {};
     const current = agent.cli || '';
+    // eslint-disable-next-line no-unsanitized/property -- reason: structural HTML is a string literal; all user data wrapped in escHtml() (fields: agentId, runtime names)
     cell.innerHTML =
       '<select data-agent="' + escHtml(agentId) + '" data-field="cli" style="width:100%;padding:4px 6px;background:var(--surface);border:1px solid var(--border);border-radius:4px;color:var(--text);font-size:11px">' +
         '<option value=""' + (!current ? ' selected' : '') + '>(fleet default)</option>' +
@@ -486,6 +490,7 @@ async function loadModelsForRuntime(runtimeName, inputId, currentValue) {
   if (!wrap) return;
   const token = _nextModelLoadToken('runtime', inputId);
   if (!runtimeName) {
+    // eslint-disable-next-line no-unsanitized/property -- reason: structural HTML is a string literal; all user data wrapped in escHtml() (fields: currentValue; inputId is an internal fixed DOM id)
     wrap.innerHTML = '<input id="' + inputId + '" value="' + escHtml(currentValue || '') + '" placeholder="(no runtime selected)" disabled style="width:100%;padding:4px 6px;background:var(--surface);border:1px solid var(--border);border-radius:4px;color:var(--muted);font-size:12px">';
     return;
   }
@@ -500,6 +505,7 @@ async function loadModelsForRuntime(runtimeName, inputId, currentValue) {
   if (!models || models.length === 0) {
     // Free-text fallback — let the user type anything (custom Anthropic /
     // OpenAI model IDs, future models, etc.).
+    // eslint-disable-next-line no-unsanitized/property -- reason: structural HTML is a string literal; all user data wrapped in escHtml() (fields: currentValue; inputId is an internal fixed DOM id)
     wrap.innerHTML = '<input id="' + inputId + '" value="' + escHtml(currentValue || '') + '" placeholder="Default (CLI chooses)" style="width:100%;padding:4px 6px;background:var(--surface);border:1px solid var(--border);border-radius:4px;color:var(--text);font-size:12px">';
     return;
   }
@@ -516,6 +522,7 @@ async function loadModelsForRuntime(runtimeName, inputId, currentValue) {
   if (currentValue && !models.some(m => (m.id || m.name) === currentValue)) {
     opts += '<option value="' + escHtml(currentValue) + '" selected>' + escHtml(currentValue) + ' (custom)</option>';
   }
+  // eslint-disable-next-line no-unsanitized/property -- reason: structural HTML is a string literal; all user data wrapped in escHtml() (fields: model id, model label, currentValue; inputId is an internal fixed DOM id)
   wrap.innerHTML = '<select id="' + inputId + '" style="width:100%;padding:4px 6px;background:var(--surface);border:1px solid var(--border);border-radius:4px;color:var(--text);font-size:12px">' + opts + '</select>';
 }
 
@@ -533,6 +540,7 @@ async function loadModelsForAgent(agentId, runtimeName, currentValue) {
   const baseStyle = 'width:120px;padding:4px 6px;background:var(--surface);border:1px solid var(--border);border-radius:4px;color:var(--text);font-size:11px';
   const token = _nextModelLoadToken('agent', agentId);
   if (!runtimeName) {
+    // eslint-disable-next-line no-unsanitized/property -- reason: structural HTML is a string literal; all user data wrapped in escHtml() (fields: agentId, currentValue)
     cell.innerHTML = '<input ' + baseAttrs + ' value="' + escHtml(currentValue || '') + '" placeholder="(no runtime)" disabled style="' + baseStyle + ';color:var(--muted)">';
     return;
   }
@@ -545,6 +553,7 @@ async function loadModelsForAgent(agentId, runtimeName, currentValue) {
   if (!_isCurrentModelLoad('agent', agentId, token)) return;
   const models = Array.isArray(payload.models) ? payload.models : null;
   if (!models || models.length === 0) {
+    // eslint-disable-next-line no-unsanitized/property -- reason: structural HTML is a string literal; all user data wrapped in escHtml() (fields: agentId, runtimeName, currentValue)
     cell.innerHTML = '<input ' + baseAttrs + ' value="' + escHtml(currentValue || '') + '" placeholder="' + escHtml(runtimeName) + ' default" style="' + baseStyle + '">';
     return;
   }
@@ -559,6 +568,7 @@ async function loadModelsForAgent(agentId, runtimeName, currentValue) {
   if (currentValue && !models.some(m => (m.id || m.name) === currentValue)) {
     opts += '<option value="' + escHtml(currentValue) + '" selected>' + escHtml(currentValue) + ' (custom — invalid for ' + escHtml(runtimeName) + '?)</option>';
   }
+  // eslint-disable-next-line no-unsanitized/property -- reason: structural HTML is a string literal; all user data wrapped in escHtml() (fields: agentId, model id, model label, currentValue, runtimeName)
   cell.innerHTML = '<select ' + baseAttrs + ' style="' + baseStyle + '">' + opts + '</select>';
 }
 

package/dashboard/slim.html

@@ -919,10 +919,10 @@
       var flags = (data && data.features) || [];
 
       // Build the body as a document fragment so we avoid .innerHTML for
-      // the dynamic parts (SEC-03 ratchet — see DYNAMIC_INNERHTML_BASELINE
-      // in test/unit.test.js). Static intro paragraph uses innerHTML
-      // because it carries a <code> tag and is a pure string literal
-      // (exempted by _isStaticInnerHtmlRhs).
+      // the dynamic parts. Static intro paragraph uses innerHTML because
+      // it carries a <code> tag and is a pure string literal (exempted
+      // by the no-unsanitized rule).
+      // (Comment retained for legibility; ratchet test is being retired.)
       var intro = document.createElement('p');
       intro.innerHTML = 'Toggle <code>slim-ux</code> off to return to the original dashboard. Advanced settings (agents, projects, runtime) live there for now.';
       var frag = document.createDocumentFragment();
@@ -1342,8 +1342,8 @@
   // Zero-project: a hint to add one. Selection persists per-browser in
   // localStorage and is included in every /api/command-center/stream call.
   // Build the "+ Add" button as a real DOM node (was an HTML string + innerHTML
-  // injection — SEC-03 ratchet prefers we avoid that pattern, see
-  // test/unit.test.js DYNAMIC_INNERHTML_BASELINE).
+  // injection — the no-unsanitized/property rule prefers we avoid that pattern
+  // entirely for dynamic data).
   function makeContextAddBtn() {
     var btn = document.createElement('button');
     btn.type = 'button';
@@ -1911,8 +1911,8 @@
       listEl.innerHTML = '<div class="history-empty">Nothing has happened yet — Command Center will fill this in.</div>';
       return;
     }
-    // Build the feed as DOM nodes so SEC-03's .innerHTML ratchet stays happy
-    // (test/unit.test.js DYNAMIC_INNERHTML_BASELINE). Each event becomes
+    // Build the feed as DOM nodes to avoid dynamic .innerHTML
+    // (no-unsanitized/property rule). Each event becomes
     // .history-item > .history-head + .history-title + .history-meta, with
     // the optional PR "open" link constructed as a real <a> node.
     var frag = document.createDocumentFragment();

package/docs/deprecated.json

@@ -19,10 +19,14 @@
     "id": "completion-fallback-parsers",
     "description": "parseStructuredCompletion and parseCompletionFieldSummary in engine/lifecycle.js",
     "file": "engine/lifecycle.js",
-    "lines": "2747, 2848",
-    "telemetryGate": "_engine.completionFallbacks must read 0 across sweep window",
+    "lines": "2856, 3054",
+    "telemetryGate": "_engine.completionFallbacks must read 0 (both fenced and summary counters) across sweepWindowDays starting from sweepStartDate",
+    "sweepWindowDays": 14,
+    "sweepStartDate": "2026-05-27",
+    "sweepRationale": "14 days matches the dead-code audit cadence (one full weekly audit cycle plus a buffer week). Policy decision pending confirmation in open-question #1 of the 2026-05-27 Bug Audit Review meeting conclusion — if the human teammate prefers a different cadence, repin this field and the matching enforcingSweepWindowTest fixture.",
     "enforcingTest": "test/unit/completion-fallback-telemetry.test.js:217-234",
-    "notes": "Do NOT set removedAt until telemetry confirms zero usage"
+    "enforcingSweepWindowTest": "test/unit/completion-fallback-sweep-window.test.js",
+    "notes": "Do NOT set removedAt until telemetry confirms zero usage across the sweepWindowDays from sweepStartDate. The follow-up code-removal PR (dropping parseStructuredCompletion at engine/lifecycle.js:2856, parseCompletionFieldSummary at :3054, and the gated fallback at :3852-3877) is dispatched separately once the window is observed clean."
   }
 ]
 

package/engine/cleanup.js

@@ -1075,7 +1075,30 @@ async function runCleanup(config, verbose = false) {
       mutateWorkItems(wiPath, items => {
         for (const item of items) if (_migrateLegacyItem(item)) migrated++;
       });
-      if (migrated > 0) log('info', `Migrated ${migrated} legacy status(es) in ${label}`);
+      if (migrated > 0) {
+        log('info', `Migrated ${migrated} legacy status(es) in ${label}`);
+        // P-dcc27d-legacy-status-counter — make the docs/deprecated.json
+        // gate ("legacy-done-aliases" removal after 30 consecutive days zero
+        // migrations) measurable by bumping a rolling-daily counter under
+        // `_engine.legacyStatusMigrations[YYYY-MM-DD]`. Parallel to
+        // `_engine.completionFallbacks` at engine/lifecycle.js:3870-3871.
+        // Inline mutateJsonFileLocked by design — promote to a shared
+        // `mutateMetrics(key, date)` helper if more N-day-silence gates land.
+        try {
+          const metricsPath = path.join(ENGINE_DIR, 'metrics.json');
+          const dateKey = new Date().toISOString().slice(0, 10);
+          mutateJsonFileLocked(metricsPath, (metrics) => {
+            metrics = metrics || {};
+            if (!metrics._engine) metrics._engine = {};
+            if (!metrics._engine.legacyStatusMigrations) metrics._engine.legacyStatusMigrations = {};
+            metrics._engine.legacyStatusMigrations[dateKey] =
+              (metrics._engine.legacyStatusMigrations[dateKey] || 0) + migrated;
+            return metrics;
+          });
+        } catch (err) {
+          log('warn', `telemetry: legacy-status-migration metrics write failed: ${err.message}`);
+        }
+      }
     } catch (e) { log('warn', `migrate legacy statuses (${label}): ${e.message}`); }
   }
   for (const project of projects) _migrateLegacyItemsAt(projectWorkItemsPath(project), `${project.name} work items`);

package/engine/lifecycle.js

@@ -4685,7 +4685,6 @@ module.exports = {
   checkForLearnings,
   extractSkillsFromOutput,
   updateAgentHistory,
-  reviewFeedbackSourceMatches,
   createReviewFeedbackForAuthor,
   updateMetrics,
   parseAgentOutput,