@yemi33/minions 0.1.2048 → 0.1.2050

package/dashboard/js/command-center.js

@@ -81,6 +81,7 @@ function _ccStripActionBlockFromText(value) {
         var firstUser = legacyMessages.find(function(m) { return m.role === 'user'; });
         if (firstUser) {
           var tmp = document.createElement('div');
+          // eslint-disable-next-line no-unsanitized/property -- reason: renderMd()/escHtml() produced the persisted user message HTML before this title extraction (see dashboard/js/utils.js)
           tmp.innerHTML = firstUser.html;
           var txt = (tmp.textContent || tmp.innerText || '').trim();
           if (txt.length > 0) title = txt.slice(0, CC_TITLE_MAX_LENGTH);
@@ -115,6 +116,7 @@ function _ccBuildTranscript(tab) {
     if (!m || (m.role !== 'user' && m.role !== 'assistant' && m.role !== 'action' && m.role !== 'system')) continue;
     var html = typeof m.html === 'string' ? m.html : '';
     var tmp = document.createElement('div');
+    // eslint-disable-next-line no-unsanitized/property -- reason: renderMd()/escHtml() produced persisted message HTML before this transcript text extraction (see dashboard/js/utils.js)
     tmp.innerHTML = html;
     var text = (tmp.textContent || tmp.innerText || '').trim();
     if (text) out.push({ role: m.role, text: text });
@@ -566,6 +568,7 @@ function ccSwitchTab(id) {
     var restoreInterval = setInterval(function() {
       var re = document.getElementById('cc-restore-thinking');
       if (!re || !tab._sending || _ccActiveTabId !== tab.id) { clearInterval(restoreInterval); return; }
+      // eslint-disable-next-line no-unsanitized/property -- reason: renderMd() and renderToolChip() escape user-controlled stream/tool fields before assembling restored stream HTML
       re.innerHTML = _restoreStreamHtml();
       if (el.scrollHeight - el.scrollTop - el.clientHeight < 150) el.scrollTop = el.scrollHeight;
     }, 1000);
@@ -644,6 +647,7 @@ function ccRenderTabBar() {
   }
   html += '<div class="cc-tab cc-tab-new" draggable="false" ondragstart="event.preventDefault();event.stopPropagation();" onclick="ccNewTab()" title="New tab">+</div>';
   html += '</div>';
+  // eslint-disable-next-line no-unsanitized/property -- reason: structural HTML is a string literal; tab titles are wrapped in escHtml() and tab ids are generated internally (fields: t.title)
   bar.innerHTML = html;
 }
 
@@ -739,6 +743,7 @@ function ccRestoreMessages() {
       var thinking = document.createElement('div');
       thinking.id = 'cc-thinking';
       thinking.style.cssText = 'padding:8px 12px;border-radius:8px;font-size:11px;color:var(--muted);align-self:flex-start;display:flex;align-items:center;gap:8px';
+      // eslint-disable-next-line no-unsanitized/property -- reason: composed from elapsed timer and compile-time thinking UI strings (no user data flows in)
       thinking.innerHTML = '<span class="dot-pulse" style="display:inline-flex;gap:3px"><span style="width:4px;height:4px;background:var(--blue);border-radius:50%;animation:dotPulse 1.2s infinite"></span><span style="width:4px;height:4px;background:var(--blue);border-radius:50%;animation:dotPulse 1.2s infinite;animation-delay:0.2s"></span><span style="width:4px;height:4px;background:var(--blue);border-radius:50%;animation:dotPulse 1.2s infinite;animation-delay:0.4s"></span></span> <span id="cc-thinking-text">Still working...</span> <span id="cc-thinking-time" style="font-size:10px;color:var(--border)">' + Math.floor(elapsed / 1000) + 's</span>' +
         ' <button onclick="ccNewTab()" style="font-size:9px;padding:2px 8px;background:var(--surface2);border:1px solid var(--border);border-radius:4px;color:var(--red);cursor:pointer">Reset</button>';
       el.appendChild(thinking);
@@ -828,6 +833,7 @@ function ccAddMessage(role, html, skipSave, targetTabId, meta) {
     if (meta && meta.retryId) div.setAttribute('data-cc-retry-id', meta.retryId);
     div.style.cssText = 'padding:8px 12px;border-radius:8px;font-size:12px;line-height:1.6;max-width:95%;' +
       (isUser ? 'background:var(--blue);color:#fff;align-self:flex-end' : isSystem ? 'align-self:center;max-width:100%' : isAction ? 'align-self:flex-start;padding:2px 0' : 'background:var(--surface2);color:var(--text);align-self:flex-start;border:1px solid var(--border);position:relative');
+    // eslint-disable-next-line no-unsanitized/property -- reason: renderMd()/escHtml() call sites escape user-controlled message HTML before ccAddMessage() assigns it (see dashboard/js/utils.js)
     div.innerHTML = (isAssistant && !html.includes('color:var(--red)') && !html.includes('cc-queued-pill') ? llmCopyBtn() : '') + html;
     var wasNearBottom = el.scrollHeight - el.scrollTop - el.clientHeight < 150;
     el.appendChild(div);
@@ -845,6 +851,7 @@ function ccAddMessage(role, html, skipSave, targetTabId, meta) {
       // current topic, not whatever the user happened to type first.
       if (role === 'user') {
         var tmp = document.createElement('div');
+        // eslint-disable-next-line no-unsanitized/property -- reason: renderMd()/escHtml() produced the saved user message HTML before this title extraction (see dashboard/js/utils.js)
         tmp.innerHTML = html;
         var txt = (tmp.textContent || tmp.innerText || '').trim();
         if (txt.length > 0) {
@@ -902,6 +909,7 @@ function _renderQueueIndicator() {
     var el = document.createElement('div');
     el.className = 'cc-queue-item';
     el.style.cssText = 'padding:8px 12px;border-radius:8px;font-size:12px;line-height:1.6;max-width:95%;align-self:flex-end;background:var(--blue);color:#fff;opacity:0.5;order:9999';
+    // eslint-disable-next-line no-unsanitized/property -- reason: structural HTML is a string literal; queued message text wrapped in escHtml() (fields: m.message)
     el.innerHTML = escHtml(typeof m === 'string' ? m : m.message) + '<div style="font-size:9px;opacity:0.7;font-style:italic;margin-top:2px">queued</div>';
     msgs.appendChild(el);
   });
@@ -1018,6 +1026,7 @@ async function _ccDoSend(message, skipUserMsg, forceTabId, intentMetadata) {
         html += '<div style="margin-top:6px;font-size:10px;color:var(--muted)">' + escHtml(streamStatusNote) + '</div>';
       }
       html += '<div style="margin-top:' + (streamedText ? '6px' : '0') + '">' + _getThinkingHtml() + '</div>';
+      // eslint-disable-next-line no-unsanitized/property -- reason: renderMd() and renderToolChip() escape streamed text/tool fields before assembling live stream HTML
       streamDiv.innerHTML = html;
       // Re-append queue indicators so they stay below the streaming content
       if (activeTab._queue && activeTab._queue.length > 0) _renderQueueIndicator();
@@ -1285,6 +1294,7 @@ function ccRetryLast(tabId, retryId) {
     if (!last) return;
     // Backward-compatible fallback for retry buttons rendered before retry context existed.
     var tmp = document.createElement('div');
+    // eslint-disable-next-line no-unsanitized/property -- reason: renderMd()/escHtml() produced the saved retry message HTML before this text extraction (see dashboard/js/utils.js)
     tmp.innerHTML = last.html;
     text = tmp.textContent || tmp.innerText || '';
   }
@@ -1377,6 +1387,7 @@ function _ccAppendHtmlToMessage(tabOrId, messageId, html) {
   msg.html = (msg.html || '') + html;
   if (typeof _ccActiveTabId !== 'undefined' && tab.id === _ccActiveTabId && typeof document !== 'undefined') {
     var el = document.getElementById(_ccMessageDomId(messageId));
+    // eslint-disable-next-line no-unsanitized/method -- reason: structural HTML is a string literal; appended action status fragments wrap user fields in escHtml() before status.outerHTML is passed here
     if (el && typeof el.insertAdjacentHTML === 'function') el.insertAdjacentHTML('beforeend', html);
   }
   return true;
@@ -1418,12 +1429,14 @@ async function ccExecuteAction(action, targetTabId, opts) {
   if (action._serverExecuted) {
     if (action._serverHidden) return;
     if (action._serverError) {
+      // eslint-disable-next-line no-unsanitized/property -- reason: structural HTML is a string literal; server action type and error wrapped in escHtml() (fields: action.type, action._serverError)
       status.innerHTML = '&#10007; ' + escHtml(action.type) + ' failed: ' + escHtml(action._serverError);
       status.style.color = 'var(--red)';
     } else {
       var label = action._serverId ? escHtml(action._serverId) : escHtml(action.title || action.type);
       var serverActionType = action.type || '';
       var successLabel = serverActionType === 'dispatch' ? 'Dispatched' : serverActionType;
+      // eslint-disable-next-line no-unsanitized/property -- reason: structural HTML is a string literal; label and warning wrapped in escHtml(), success label is a normalized server action type (fields: label, action._serverWarning)
       status.innerHTML = '&#10003; ' + escHtml(successLabel) + ': <strong>' + label + '</strong>' +
         (action._serverDuplicate ? '<div style="font-size:10px;color:var(--orange);margin-top:2px">Already existed from a previous request; no duplicate work item was created.</div>' : '') +
         (action._serverWarning ? '<div style="font-size:10px;color:var(--muted);margin-top:2px">' + escHtml(action._serverWarning) + '</div>' : '');
@@ -1461,6 +1474,7 @@ async function ccExecuteAction(action, targetTabId, opts) {
             agents: action.agents || [],
         });
         var d = await res.json();
+        // eslint-disable-next-line no-unsanitized/property -- reason: structural HTML is a string literal; dispatch id/title wrapped in escHtml() (fields: d.id, action.title)
         status.innerHTML = '&#10003; Dispatched: <strong>' + escHtml(d.id || action.title) + '</strong>';
         status.style.color = 'var(--green)';
         wakeEngine();
@@ -1468,6 +1482,7 @@ async function ccExecuteAction(action, targetTabId, opts) {
       }
       case 'note': {
         await _ccFetch('/api/notes', { title: action.title, what: action.content || action.description, author: 'command-center' });
+        // eslint-disable-next-line no-unsanitized/property -- reason: structural HTML is a string literal; note title wrapped in escHtml() (fields: action.title)
         status.innerHTML = '&#10003; Note saved: <strong>' + escHtml(action.title) + '</strong>';
         status.style.color = 'var(--green)';
         var notePageLink = document.querySelector('.sidebar-link[data-page="inbox"]');
@@ -1477,6 +1492,7 @@ async function ccExecuteAction(action, targetTabId, opts) {
       case 'pin':
       case 'pin-to-pinned': {
         await _ccFetch('/api/pinned', { title: action.title, content: action.content || action.description, level: action.level || '' });
+        // eslint-disable-next-line no-unsanitized/property -- reason: structural HTML is a string literal; pinned note title wrapped in escHtml() (fields: action.title)
         status.innerHTML = '&#x1F4CC; Pinned: <strong>' + escHtml(action.title) + '</strong> — visible to all agents';
         status.style.color = 'var(--green)';
         break;
@@ -1484,6 +1500,7 @@ async function ccExecuteAction(action, targetTabId, opts) {
       case 'plan': {
         var branchStrategy = action.branch_strategy || action.branchStrategy || 'parallel';
         await _ccFetch('/api/plan', { title: action.title, description: action.description, project: action.project, branch_strategy: branchStrategy, branchStrategy: branchStrategy });
+        // eslint-disable-next-line no-unsanitized/property -- reason: structural HTML is a string literal; plan title wrapped in escHtml() (fields: action.title)
         status.innerHTML = '&#10003; Plan queued: <strong>' + escHtml(action.title) + '</strong>';
         status.style.color = 'var(--green)';
         wakeEngine();
@@ -1492,6 +1509,7 @@ async function ccExecuteAction(action, targetTabId, opts) {
       case 'cancel': {
         var cancelAgent = action.agent || action.agentId || '';
         await _ccFetch('/api/agents/cancel', { agent: cancelAgent, agentId: cancelAgent, task: action.task || action.cancelTask || '', reason: action.reason || 'Cancelled via command center' });
+        // eslint-disable-next-line no-unsanitized/property -- reason: structural HTML is a string literal; cancel target wrapped in escHtml() (fields: cancelAgent, action.task, action.cancelTask)
         status.innerHTML = '&#10003; Cancelled agent: <strong>' + escHtml(cancelAgent || action.task || action.cancelTask || '') + '</strong>';
         status.style.color = 'var(--orange)';
         break;
@@ -1500,6 +1518,7 @@ async function ccExecuteAction(action, targetTabId, opts) {
         for (var ri = 0; ri < (action.ids || []).length; ri++) {
           await _ccFetch('/api/work-items/retry', { id: action.ids[ri], source: '' });
         }
+        // eslint-disable-next-line no-unsanitized/property -- reason: structural HTML is a string literal; retried ids wrapped in escHtml() (fields: action.ids)
         status.innerHTML = '&#10003; Retried: <strong>' + escHtml((action.ids || []).join(', ')) + '</strong>';
         status.style.color = 'var(--green)';
         wakeEngine();
@@ -1507,12 +1526,14 @@ async function ccExecuteAction(action, targetTabId, opts) {
       }
       case 'pause-plan': {
         await _ccFetch('/api/plans/pause', { file: action.file });
+        // eslint-disable-next-line no-unsanitized/property -- reason: structural HTML is a string literal; plan file wrapped in escHtml() (fields: action.file)
         status.innerHTML = '&#10003; Paused plan: <strong>' + escHtml(action.file) + '</strong>';
         status.style.color = 'var(--orange)';
         break;
       }
       case 'approve-plan': {
         await _ccFetch('/api/plans/approve', { file: action.file });
+        // eslint-disable-next-line no-unsanitized/property -- reason: structural HTML is a string literal; plan file wrapped in escHtml() (fields: action.file)
         status.innerHTML = '&#10003; Approved plan: <strong>' + escHtml(action.file) + '</strong>';
         status.style.color = 'var(--green)';
         wakeEngine();
@@ -1534,6 +1555,7 @@ async function ccExecuteAction(action, targetTabId, opts) {
         }
         await _ccFetch('/api/plans/approve', { file: action.file });
         var resumeCount = (action.updates || []).length + (action.newItems || []).length;
+        // eslint-disable-next-line no-unsanitized/property -- reason: structural HTML is a string literal; plan file wrapped in escHtml(), item count is numeric (fields: action.file)
         status.innerHTML = '&#10003; Resumed plan: <strong>' + escHtml(action.file) + '</strong>' + (resumeCount > 0 ? ' (' + resumeCount + ' item(s) updated)' : '');
         status.style.color = 'var(--green)';
         wakeEngine();
@@ -1541,24 +1563,28 @@ async function ccExecuteAction(action, targetTabId, opts) {
       }
       case 'edit-prd-item': {
         await _ccFetch('/api/prd-items/update', { source: action.source, itemId: action.itemId, name: action.name, description: action.description, priority: action.priority, estimated_complexity: action.complexity });
+        // eslint-disable-next-line no-unsanitized/property -- reason: structural HTML is a string literal; PRD item id wrapped in escHtml() (fields: action.itemId)
         status.innerHTML = '&#10003; Updated PRD item: <strong>' + escHtml(action.itemId) + '</strong>';
         status.style.color = 'var(--green)';
         break;
       }
       case 'remove-prd-item': {
         await _ccFetch('/api/prd-items/remove', { source: action.source, itemId: action.itemId });
+        // eslint-disable-next-line no-unsanitized/property -- reason: structural HTML is a string literal; PRD item id wrapped in escHtml() (fields: action.itemId)
         status.innerHTML = '&#10003; Removed PRD item: <strong>' + escHtml(action.itemId) + '</strong>';
         status.style.color = 'var(--orange)';
         break;
       }
       case 'delete-work-item': {
         await _ccFetch('/api/work-items/delete', { id: action.id, source: action.source || '' });
+        // eslint-disable-next-line no-unsanitized/property -- reason: structural HTML is a string literal; work item id wrapped in escHtml() (fields: action.id)
         status.innerHTML = '&#10003; Deleted work item: <strong>' + escHtml(action.id) + '</strong>';
         status.style.color = 'var(--orange)';
         break;
       }
       case 'cancel-work-item': {
         await _ccFetch('/api/work-items/cancel', { id: action.id, source: action.source || '', reason: action.reason || 'cc' });
+        // eslint-disable-next-line no-unsanitized/property -- reason: structural HTML is a string literal; work item id wrapped in escHtml() (fields: action.id)
         status.innerHTML = '&#10003; Cancelled work item: <strong>' + escHtml(action.id) + '</strong>';
         status.style.color = 'var(--orange)';
         wakeEngine();
@@ -1579,9 +1605,11 @@ async function ccExecuteAction(action, targetTabId, opts) {
         });
         var data = await res2.json();
         if (data.ok && data.edited) {
+          // eslint-disable-next-line no-unsanitized/property -- reason: structural HTML is a string literal; plan file wrapped in escHtml() (fields: action.file)
           status.innerHTML = '&#10003; Plan edited: <strong>' + escHtml(action.file) + '</strong>';
           status.style.color = 'var(--green)';
         } else {
+          // eslint-disable-next-line no-unsanitized/property -- reason: renderMd() escapes doc-chat answer text before assembling HTML (see dashboard/js/utils.js)
           status.innerHTML = data.answer ? renderMd(data.answer) : '&#10007; Could not edit plan';
           status.style.color = data.answer ? 'var(--muted)' : 'var(--red)';
         }
@@ -1589,6 +1617,7 @@ async function ccExecuteAction(action, targetTabId, opts) {
       }
       case 'execute-plan': {
         await _ccFetch('/api/plans/execute', { file: action.file, project: action.project || '' });
+        // eslint-disable-next-line no-unsanitized/property -- reason: structural HTML is a string literal; plan file wrapped in escHtml() (fields: action.file)
         status.innerHTML = '&#10003; Plan execution queued: <strong>' + escHtml(action.file) + '</strong>';
         status.style.color = 'var(--green)';
         wakeEngine();
@@ -1607,9 +1636,11 @@ async function ccExecuteAction(action, targetTabId, opts) {
         });
         var data3 = await res3.json();
         if (data3.ok && data3.edited) {
+          // eslint-disable-next-line no-unsanitized/property -- reason: structural HTML is a string literal; file path wrapped in escHtml() (fields: action.file)
           status.innerHTML = '&#10003; Edited: <strong>' + escHtml(action.file) + '</strong>';
           status.style.color = 'var(--green)';
         } else {
+          // eslint-disable-next-line no-unsanitized/property -- reason: renderMd() escapes doc-chat answer text before assembling HTML (see dashboard/js/utils.js)
           status.innerHTML = data3.answer ? renderMd(data3.answer) : '&#10007; Could not edit file';
           status.style.color = data3.answer ? 'var(--muted)' : 'var(--red)';
         }
@@ -1628,6 +1659,7 @@ async function ccExecuteAction(action, targetTabId, opts) {
           })
         });
         if (!res4.ok) { var d4 = await res4.json().catch(function() { return {}; }); throw new Error(d4.error || 'Schedule create failed'); }
+        // eslint-disable-next-line no-unsanitized/property -- reason: structural HTML is a string literal; schedule id wrapped in escHtml() and action label is a fixed branch (fields: action.id)
         status.innerHTML = '&#10003; Schedule ' + (action._update ? 'updated' : 'created') + ': <strong>' + escHtml(action.id) + '</strong>';
         status.style.color = 'var(--green)';
         break;
@@ -1638,6 +1670,7 @@ async function ccExecuteAction(action, targetTabId, opts) {
           body: JSON.stringify({ id: action.id })
         });
         if (!res5.ok) { var d5 = await res5.json().catch(function() { return {}; }); throw new Error(d5.error || 'Schedule delete failed'); }
+        // eslint-disable-next-line no-unsanitized/property -- reason: structural HTML is a string literal; schedule id wrapped in escHtml() (fields: action.id)
         status.innerHTML = '&#10003; Deleted schedule: <strong>' + escHtml(action.id) + '</strong>';
         status.style.color = 'var(--orange)';
         break;
@@ -1650,6 +1683,7 @@ async function ccExecuteAction(action, targetTabId, opts) {
         });
         if (!res6.ok) { var d6 = await res6.json().catch(function() { return {}; }); throw new Error(d6.error || 'Meeting create failed'); }
         var d6r = await res6.json();
+        // eslint-disable-next-line no-unsanitized/property -- reason: structural HTML is a string literal; meeting title and returned id wrapped in escHtml() (fields: action.title, d6r.id)
         status.innerHTML = '&#10003; Meeting started: <strong>' + escHtml(action.title) + '</strong>' + (d6r.id ? ' (' + escHtml(d6r.id) + ')' : '');
         status.style.color = 'var(--green)';
         wakeEngine();
@@ -1663,6 +1697,7 @@ async function ccExecuteAction(action, targetTabId, opts) {
           body: JSON.stringify(payload)
         });
         if (!res7.ok) { var d7 = await res7.json().catch(function() { return {}; }); throw new Error(d7.error || 'Config update failed'); }
+        // eslint-disable-next-line no-unsanitized/property -- reason: structural HTML is a string literal; setting name/value wrapped in escHtml() (fields: action.setting, action.value)
         status.innerHTML = '&#10003; Set <strong>' + escHtml(action.setting) + '</strong> = ' + escHtml(String(action.value));
         status.style.color = 'var(--green)';
         break;
@@ -1677,36 +1712,42 @@ async function ccExecuteAction(action, targetTabId, opts) {
           body: JSON.stringify(body)
         });
         if (!res8.ok) { var d8 = await res8.json().catch(function() { return {}; }); throw new Error(d8.error || 'Pipeline update failed'); }
+        // eslint-disable-next-line no-unsanitized/property -- reason: structural HTML is a string literal; pipeline id wrapped in escHtml() (fields: action.id)
         status.innerHTML = '&#10003; Updated pipeline: <strong>' + escHtml(action.id) + '</strong>';
         status.style.color = 'var(--green)';
         break;
       }
       case 'unpin': {
         await _ccFetch('/api/pinned/remove', { title: action.title });
+        // eslint-disable-next-line no-unsanitized/property -- reason: structural HTML is a string literal; pinned title wrapped in escHtml() (fields: action.title)
         status.innerHTML = '&#10003; Unpinned: <strong>' + escHtml(action.title) + '</strong>';
         status.style.color = 'var(--green)';
         break;
       }
       case 'archive-plan': {
         await _ccFetch('/api/plans/archive', { file: action.file });
+        // eslint-disable-next-line no-unsanitized/property -- reason: structural HTML is a string literal; plan file wrapped in escHtml() (fields: action.file)
         status.innerHTML = '&#10003; Archived plan: <strong>' + escHtml(action.file) + '</strong>';
         status.style.color = 'var(--green)';
         break;
       }
       case 'reject-plan': {
         await _ccFetch('/api/plans/reject', { file: action.file, reason: action.reason || '' });
+        // eslint-disable-next-line no-unsanitized/property -- reason: structural HTML is a string literal; plan file wrapped in escHtml() (fields: action.file)
         status.innerHTML = '&#10003; Rejected plan: <strong>' + escHtml(action.file) + '</strong>';
         status.style.color = 'var(--orange)';
         break;
       }
       case 'steer-agent': {
         await _ccFetch('/api/agents/steer', { agent: action.agent, message: action.message || action.content });
+        // eslint-disable-next-line no-unsanitized/property -- reason: structural HTML is a string literal; agent id wrapped in escHtml() (fields: action.agent)
         status.innerHTML = '&#10003; Steering message sent to <strong>' + escHtml(action.agent) + '</strong>';
         status.style.color = 'var(--green)';
         break;
       }
       case 'add-meeting-note': {
         await _ccFetch('/api/meetings/note', { id: action.id, note: action.note || action.content });
+        // eslint-disable-next-line no-unsanitized/property -- reason: structural HTML is a string literal; meeting id wrapped in escHtml() (fields: action.id)
         status.innerHTML = '&#10003; Note added to meeting <strong>' + escHtml(action.id) + '</strong>';
         status.style.color = 'var(--green)';
         break;
@@ -1717,6 +1758,7 @@ async function ccExecuteAction(action, targetTabId, opts) {
           body: JSON.stringify({ id: action.id })
         });
         if (!res9.ok) { var d9 = await res9.json().catch(function() { return {}; }); throw new Error(d9.error || 'Pipeline trigger failed'); }
+        // eslint-disable-next-line no-unsanitized/property -- reason: structural HTML is a string literal; pipeline id wrapped in escHtml() (fields: action.id)
         status.innerHTML = '&#10003; Pipeline triggered: <strong>' + escHtml(action.id) + '</strong>';
         status.style.color = 'var(--green)';
         wakeEngine();
@@ -1725,6 +1767,7 @@ async function ccExecuteAction(action, targetTabId, opts) {
       case 'link-pr': {
         var prLinkRes = await _ccFetch('/api/pull-requests/link', { url: action.url, title: action.title || '', project: action.project || '', autoObserve: action.autoObserve !== false });
         var prLinkData = await prLinkRes.json().catch(function() { return {}; });
+        // eslint-disable-next-line no-unsanitized/property -- reason: structural HTML is a string literal; PR URL and server message wrapped in escHtml() (fields: action.url, prLinkData.message)
         status.innerHTML = '&#10003; PR linked: <strong>' + escHtml(action.url) + '</strong>' +
           (prLinkData.message ? '<div style="font-size:11px;color:var(--muted);margin-top:4px">' + escHtml(prLinkData.message) + '</div>' : '');
         status.style.color = 'var(--green)';
@@ -1732,6 +1775,7 @@ async function ccExecuteAction(action, targetTabId, opts) {
       }
       case 'archive-meeting': {
         await _ccFetch('/api/meetings/archive', { id: action.id });
+        // eslint-disable-next-line no-unsanitized/property -- reason: structural HTML is a string literal; meeting id wrapped in escHtml() (fields: action.id)
         status.innerHTML = '&#10003; Meeting archived: <strong>' + escHtml(action.id) + '</strong>';
         status.style.color = 'var(--green)';
         break;
@@ -1747,8 +1791,10 @@ async function ccExecuteAction(action, targetTabId, opts) {
         var d10 = await res10.json();
         var labelWarning = d10.warning ? ' <span style="color:var(--orange)">(' + escHtml(d10.warning) + ')</span>' : '';
         if (d10.url) {
+          // eslint-disable-next-line no-unsanitized/property -- reason: structural HTML is a string literal; issue URL, title, and warning wrapped in escHtml() (fields: d10.url, action.title, d10.warning)
           status.innerHTML = '&#128027; Bug filed: <a href="' + escHtml(d10.url) + '" target="_blank" style="color:var(--blue)">' + escHtml(action.title) + '</a>' + labelWarning;
         } else {
+          // eslint-disable-next-line no-unsanitized/property -- reason: structural HTML is a string literal; issue title and warning wrapped in escHtml(), fallback URL is static (fields: action.title, d10.warning)
           status.innerHTML = '&#128027; Bug filed: <strong>' + escHtml(action.title) + '</strong> — <a href="https://github.com/yemi33/minions/issues" target="_blank" style="color:var(--blue)">view issues</a>' + labelWarning;
         }
         status.style.color = 'var(--green)';
@@ -1757,10 +1803,12 @@ async function ccExecuteAction(action, targetTabId, opts) {
       case 'create-pipeline': {
         try {
           await _ccFetch('/api/pipelines', { id: action.id, title: action.title, stages: action.stages || [], trigger: action.trigger || null, stopWhen: action.stopWhen || null, monitoredResources: action.monitoredResources || null });
+          // eslint-disable-next-line no-unsanitized/property -- reason: structural HTML is a string literal; pipeline id wrapped in escHtml() (fields: action.id)
           status.innerHTML = '&#10003; Pipeline created: <strong>' + escHtml(action.id) + '</strong>';
           status.style.color = 'var(--green)';
         } catch (e) {
           if (e.status === 409) {
+            // eslint-disable-next-line no-unsanitized/property -- reason: structural HTML is a string literal; pipeline id wrapped in escHtml() (fields: action.id)
             status.innerHTML = '&#10003; Pipeline already exists: <strong>' + escHtml(action.id) + '</strong>';
             status.style.color = 'var(--orange)';
           } else {
@@ -1771,18 +1819,21 @@ async function ccExecuteAction(action, targetTabId, opts) {
       }
       case 'delete-pipeline': {
         await _ccFetch('/api/pipelines/delete', { id: action.id });
+        // eslint-disable-next-line no-unsanitized/property -- reason: structural HTML is a string literal; pipeline id wrapped in escHtml() (fields: action.id)
         status.innerHTML = '&#10003; Pipeline deleted: <strong>' + escHtml(action.id) + '</strong>';
         status.style.color = 'var(--green)';
         break;
       }
       case 'abort-pipeline': {
         await _ccFetch('/api/pipelines/abort', { id: action.id });
+        // eslint-disable-next-line no-unsanitized/property -- reason: structural HTML is a string literal; pipeline id wrapped in escHtml() (fields: action.id)
         status.innerHTML = '&#10003; Pipeline aborted: <strong>' + escHtml(action.id) + '</strong>';
         status.style.color = 'var(--green)';
         break;
       }
       case 'retrigger-pipeline': {
         await _ccFetch('/api/pipelines/retrigger', { id: action.id });
+        // eslint-disable-next-line no-unsanitized/property -- reason: structural HTML is a string literal; pipeline id wrapped in escHtml() (fields: action.id)
         status.innerHTML = '&#10003; Pipeline retriggered: <strong>' + escHtml(action.id) + '</strong>';
         status.style.color = 'var(--green)';
         wakeEngine();
@@ -1790,6 +1841,7 @@ async function ccExecuteAction(action, targetTabId, opts) {
       }
       case 'advance-meeting': {
         await _ccFetch('/api/meetings/advance', { id: action.id });
+        // eslint-disable-next-line no-unsanitized/property -- reason: structural HTML is a string literal; meeting id wrapped in escHtml() (fields: action.id)
         status.innerHTML = '&#10003; Meeting advanced: <strong>' + escHtml(action.id) + '</strong>';
         status.style.color = 'var(--green)';
         wakeEngine();
@@ -1797,18 +1849,21 @@ async function ccExecuteAction(action, targetTabId, opts) {
       }
       case 'end-meeting': {
         await _ccFetch('/api/meetings/end', { id: action.id });
+        // eslint-disable-next-line no-unsanitized/property -- reason: structural HTML is a string literal; meeting id wrapped in escHtml() (fields: action.id)
         status.innerHTML = '&#10003; Meeting ended: <strong>' + escHtml(action.id) + '</strong>';
         status.style.color = 'var(--green)';
         break;
       }
       case 'delete-meeting': {
         await _ccFetch('/api/meetings/delete', { id: action.id });
+        // eslint-disable-next-line no-unsanitized/property -- reason: structural HTML is a string literal; meeting id wrapped in escHtml() (fields: action.id)
         status.innerHTML = '&#10003; Meeting deleted: <strong>' + escHtml(action.id) + '</strong>';
         status.style.color = 'var(--green)';
         break;
       }
       case 'trigger-verify': {
         await _ccFetch('/api/plans/trigger-verify', { file: action.file });
+        // eslint-disable-next-line no-unsanitized/property -- reason: structural HTML is a string literal; plan file wrapped in escHtml() (fields: action.file)
         status.innerHTML = '&#10003; Verification triggered for: <strong>' + escHtml(action.file) + '</strong>';
         status.style.color = 'var(--green)';
         wakeEngine();
@@ -1816,6 +1871,7 @@ async function ccExecuteAction(action, targetTabId, opts) {
       }
       case 'regenerate-plan': {
         await _ccFetch('/api/plans/approve', { file: action.file, forceRegen: true });
+        // eslint-disable-next-line no-unsanitized/property -- reason: structural HTML is a string literal; plan file wrapped in escHtml() (fields: action.file)
         status.innerHTML = '&#10003; PRD regeneration queued: <strong>' + escHtml(action.file) + '</strong>';
         status.style.color = 'var(--green)';
         wakeEngine();
@@ -1823,12 +1879,14 @@ async function ccExecuteAction(action, targetTabId, opts) {
       }
       case 'unarchive-plan': {
         await _ccFetch('/api/plans/unarchive', { file: action.file });
+        // eslint-disable-next-line no-unsanitized/property -- reason: structural HTML is a string literal; plan file wrapped in escHtml() (fields: action.file)
         status.innerHTML = '&#10003; Plan unarchived: <strong>' + escHtml(action.file) + '</strong>';
         status.style.color = 'var(--green)';
         break;
       }
       case 'continue-pipeline': {
         await _ccFetch('/api/pipelines/continue', { id: action.id });
+        // eslint-disable-next-line no-unsanitized/property -- reason: structural HTML is a string literal; pipeline id wrapped in escHtml() (fields: action.id)
         status.innerHTML = '&#10003; Pipeline continued: <strong>' + escHtml(action.id) + '</strong>';
         status.style.color = 'var(--green)';
         wakeEngine();
@@ -1836,18 +1894,21 @@ async function ccExecuteAction(action, targetTabId, opts) {
       }
       case 'work-item-feedback': {
         await _ccFetch('/api/work-items/feedback', { id: action.id, rating: action.rating || 'up', comment: action.comment || '' });
+        // eslint-disable-next-line no-unsanitized/property -- reason: structural HTML is a string literal; feedback id and rating wrapped in escHtml() (fields: action.id, action.rating)
         status.innerHTML = '&#10003; Feedback submitted for: <strong>' + escHtml(action.id) + '</strong> (' + escHtml(action.rating || 'up') + ')';
         status.style.color = 'var(--green)';
         break;
       }
       case 'archive-work-item': {
         await _ccFetch('/api/work-items/archive', { id: action.id });
+        // eslint-disable-next-line no-unsanitized/property -- reason: structural HTML is a string literal; work item id wrapped in escHtml() (fields: action.id)
         status.innerHTML = '&#10003; Work item archived: <strong>' + escHtml(action.id) + '</strong>';
         status.style.color = 'var(--green)';
         break;
       }
       case 'reopen-work-item': {
         await _ccFetch('/api/work-items/reopen', { id: action.id, project: action.project || action.source || '', description: action.description });
+        // eslint-disable-next-line no-unsanitized/property -- reason: structural HTML is a string literal; work item id wrapped in escHtml() (fields: action.id)
         status.innerHTML = '&#10003; Work item reopened: <strong>' + escHtml(action.id) + '</strong>';
         status.style.color = 'var(--green)';
         wakeEngine();
@@ -1855,6 +1916,7 @@ async function ccExecuteAction(action, targetTabId, opts) {
       }
       case 'reopen-prd-item': {
         await _ccFetch('/api/prd-items/update', { source: action.file, itemId: action.id, status: 'updated' });
+        // eslint-disable-next-line no-unsanitized/property -- reason: structural HTML is a string literal; PRD item id wrapped in escHtml() (fields: action.id)
         status.innerHTML = '&#10003; PRD item reopened: <strong>' + escHtml(action.id) + '</strong>';
         status.style.color = 'var(--green)';
         wakeEngine();
@@ -1862,12 +1924,14 @@ async function ccExecuteAction(action, targetTabId, opts) {
       }
       case 'promote-to-kb': {
         await _ccFetch('/api/inbox/promote-kb', { name: action.file, category: action.category || 'project-notes' });
+        // eslint-disable-next-line no-unsanitized/property -- reason: structural HTML is a string literal; inbox file name wrapped in escHtml() (fields: action.file)
         status.innerHTML = '&#10003; Promoted to KB: <strong>' + escHtml(action.file) + '</strong>';
         status.style.color = 'var(--green)';
         break;
       }
       case 'revise-plan': {
         await _ccFetch('/api/plans/revise', { file: action.file, feedback: action.feedback || action.description, requestedBy: 'command-center' });
+        // eslint-disable-next-line no-unsanitized/property -- reason: structural HTML is a string literal; plan file wrapped in escHtml() (fields: action.file)
         status.innerHTML = '&#10003; Plan revision dispatched: <strong>' + escHtml(action.file) + '</strong>';
         status.style.color = 'var(--green)';
         wakeEngine();
@@ -1881,6 +1945,7 @@ async function ccExecuteAction(action, targetTabId, opts) {
       }
       case 'toggle-kb-pin': {
         await _ccFetch('/api/kb-pins/toggle', { key: action.key });
+        // eslint-disable-next-line no-unsanitized/property -- reason: structural HTML is a string literal; KB key wrapped in escHtml() (fields: action.key)
         status.innerHTML = '&#10003; KB pin toggled: <strong>' + escHtml(action.key) + '</strong>';
         status.style.color = 'var(--green)';
         break;
@@ -1888,6 +1953,7 @@ async function ccExecuteAction(action, targetTabId, opts) {
       case 'add-project': {
         var projectPath = action.path || action.localPath;
         await _ccFetch('/api/projects/add', { path: projectPath, localPath: projectPath, name: action.name || '', repoHost: action.repoHost || 'github', allowNonRepo: action.allowNonRepo, confirmToken: action.confirmToken });
+        // eslint-disable-next-line no-unsanitized/property -- reason: structural HTML is a string literal; project name/path wrapped in escHtml() (fields: action.name, projectPath)
         status.innerHTML = '&#10003; Project added: <strong>' + escHtml(action.name || projectPath) + '</strong>';
         status.style.color = 'var(--green)';
         break;
@@ -1900,12 +1966,14 @@ async function ccExecuteAction(action, targetTabId, opts) {
       }
       case 'delete-pr': {
         await _ccFetch('/api/pull-requests/delete', { id: action.id, project: action.project || '' });
+        // eslint-disable-next-line no-unsanitized/property -- reason: structural HTML is a string literal; PR id wrapped in escHtml() (fields: action.id)
         status.innerHTML = '&#10003; PR unlinked: <strong>' + escHtml(action.id) + '</strong>';
         status.style.color = 'var(--green)';
         break;
       }
       case 'unarchive-meeting': {
         await _ccFetch('/api/meetings/unarchive', { id: action.id });
+        // eslint-disable-next-line no-unsanitized/property -- reason: structural HTML is a string literal; meeting id wrapped in escHtml() (fields: action.id)
         status.innerHTML = '&#10003; Meeting unarchived: <strong>' + escHtml(action.id) + '</strong>';
         status.style.color = 'var(--green)';
         break;
@@ -1929,9 +1997,11 @@ async function ccExecuteAction(action, targetTabId, opts) {
             summary = 'response — ' + preview + (preview.length >= 240 ? '...' : '');
           }
           if (summary) {
+            // eslint-disable-next-line no-unsanitized/property -- reason: structural HTML is a string literal; generic action type and response summary wrapped in escHtml() (fields: action.type, summary)
             status.innerHTML = '&#10003; ' + escHtml(action.type) + ': ' + escHtml(summary);
             status.style.color = 'var(--green)';
           } else {
+            // eslint-disable-next-line no-unsanitized/property -- reason: structural HTML is a string literal; generic action type and endpoint wrapped in escHtml() (fields: action.type, action.endpoint)
             status.innerHTML = '? <strong>' + escHtml(action.type) + '</strong> hit ' + escHtml(action.endpoint) + ' but returned no data — answer inline next time, do not invent actions for read-only queries';
             status.style.color = 'var(--orange)';
           }
@@ -1939,12 +2009,14 @@ async function ccExecuteAction(action, targetTabId, opts) {
           status.innerHTML = '&#10007; Blocked: endpoint must be a local /api/ path';
           status.style.color = 'var(--red)';
         } else {
+          // eslint-disable-next-line no-unsanitized/property -- reason: structural HTML is a string literal; unknown action type wrapped in escHtml() (fields: action.type)
           status.innerHTML = '? Unknown action: <strong>' + escHtml(action.type) + '</strong>';
           status.style.color = 'var(--muted)';
         }
       }
     }
   } catch (e) {
+    // eslint-disable-next-line no-unsanitized/property -- reason: structural HTML is a string literal; action error message wrapped in escHtml() (fields: e.message)
     status.innerHTML = '&#10007; Action failed: ' + escHtml(e.message);
     status.style.color = 'var(--red)';
   }

package/dashboard/js/command-history.js

@@ -27,6 +27,7 @@ function cmdShowHistory() {
   } else {
     const intentColors = { 'work-item': 'var(--blue)', 'note': 'var(--green)', 'plan': 'var(--purple,#a855f7)' };
     const intentLabels = { 'work-item': 'Work Item', 'note': 'Note', 'plan': 'Plan' };
+    // eslint-disable-next-line no-unsanitized/property -- reason: structural HTML is a string literal; all user data wrapped in escHtml() (fields: command text, intent label)
     body.innerHTML = '<ul class="cmd-history-list">' + history.map((item, i) => {
       const date = new Date(item.timestamp);
       const ago = timeSinceStr(date);
@@ -36,7 +37,7 @@ function cmdShowHistory() {
         '<div class="cmd-history-item-body">' +
           '<div class="cmd-history-item-text">' + escHtml(item.text) + '</div>' +
           '<div class="cmd-history-item-meta">' +
-            '<span class="chip" style="color:' + intentColor + '">' + intentLabel + '</span>' +
+            '<span class="chip" style="color:' + intentColor + '">' + escHtml(intentLabel) + '</span>' +
             '<span>' + ago + '</span>' +
             '<span>' + formatLocalDateTime(date) + '</span>' +
           '</div>' +

package/dashboard/js/command-input.js

@@ -18,6 +18,7 @@ function cmdUpdateHighlight() {
   html = html.replace(/(![a-z]+\b)/gi, '<span class="hl-priority">$1</span>');
   html = html.replace(/(#\S+)/g, '<span class="hl-project">$1</span>');
   html = html.replace(/(--(?:stack|parallel)\b)/gi, '<span class="hl-flag">$1</span>');
+  // eslint-disable-next-line no-unsanitized/property -- reason: cmdUpdateHighlight() escapes all user-controlled text before assembling fixed highlight spans
   hl.innerHTML = html + '\n'; // trailing newline prevents layout shift
 }
 
@@ -179,7 +180,7 @@ function cmdRenderMeta() {
   for (const agentId of parsed.agents) {
     const agent = cmdAgents.find(a => a.id === agentId);
     if (agent) {
-      chips.push('<span class="cmd-chip agent-chip">' + agent.emoji + ' @' + agent.name + '</span>');
+      chips.push('<span class="cmd-chip agent-chip">' + escHtml(agent.emoji || '') + ' @' + escHtml(agent.name) + '</span>');
     }
   }
 
@@ -190,6 +191,7 @@ function cmdRenderMeta() {
     chips.push('<span class="cmd-chip project-chip">#' + escHtml(parsed.project) + '</span>');
   }
 
+  // eslint-disable-next-line no-unsanitized/property -- reason: structural HTML is a string literal; all user data wrapped in escHtml() (fields: project names, agent emoji, agent name)
   el.innerHTML = chips.join('');
 }
 
@@ -214,9 +216,10 @@ function cmdShowMentions(query) {
   if (items.length === 0) { popup.classList.remove('visible'); return; }
 
   cmdMentionIdx = 0;
+  // eslint-disable-next-line no-unsanitized/property -- reason: structural HTML is a string literal; all user data wrapped in escHtml() (fields: agent id, emoji, name, role)
   popup.innerHTML = items.map((a, i) =>
-    '<div class="cmd-mention-item' + (i === 0 ? ' active' : '') + '" data-id="' + a.id + '" onclick="cmdInsertPopupItem(\'' + escHtml(a.id) + '\')">' +
-      '<span class="mention-emoji">' + a.emoji + '</span>' +
+    '<div class="cmd-mention-item' + (i === 0 ? ' active' : '') + '" data-id="' + escHtml(a.id) + '" onclick="cmdInsertPopupItem(\'' + escHtml(a.id) + '\')">' +
+      '<span class="mention-emoji">' + escHtml(a.emoji || '') + '</span>' +
       '<span class="mention-name">@' + escHtml(a.name) + '</span>' +
       '<span class="mention-role">' + escHtml(a.role) + '</span>' +
     '</div>'
@@ -234,6 +237,7 @@ function cmdShowProjects(query) {
   if (items.length === 0) { popup.classList.remove('visible'); return; }
 
   cmdMentionIdx = 0;
+  // eslint-disable-next-line no-unsanitized/property -- reason: structural HTML is a string literal; all user data wrapped in escHtml() (fields: project name, description)
   popup.innerHTML = items.map((p, i) =>
     '<div class="cmd-mention-item' + (i === 0 ? ' active' : '') + '" data-id="' + escHtml(p.name) + '" onclick="cmdInsertPopupItem(\'' + escHtml(p.name) + '\')">' +
       '<span class="mention-emoji">\u{1F4C1}</span>' +

package/dashboard/js/command-parser.js

@@ -25,6 +25,7 @@ function showToast(id, msg, ok, durationMs) {
   el.classList.remove('success', 'error');
   el.classList.add(ok ? 'success' : 'error');
   if (msg.includes('<a ') || msg.includes('<strong>')) {
+    // eslint-disable-next-line no-unsanitized/property -- reason: structural HTML is a string literal; all user data wrapped in escHtml() before showToast() is invoked (fields: rich toast labels and URLs)
     el.innerHTML = msg;
   } else {
     el.textContent = msg;