@yemi33/minions 0.1.363 → 0.1.365

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## 0.1.365 (2026-04-06)
+
+### Fixes
+-  XSS vulnerabilities across dashboard components (#211)
+
+## 0.1.364 (2026-04-06)
+
+### Fixes
+-  critical dashboard bugs — plan pause, PRD tautology, inbox null guard (#210)
+
 ## 0.1.363 (2026-04-06)
 
 ### Features

package/dashboard/js/refresh.js

@@ -41,7 +41,7 @@ function _processStatusUpdate(data) {
   renderAgents(data.agents);
   renderPrdProgress(data.prdProgress);
   _cachePrdItems(data.prdProgress);
-  renderInbox(data.inbox);
+  renderInbox(data.inbox || []);
   cmdUpdateAgentList(data.agents);
   cmdUpdateProjectList(data.projects || []);
   renderNotes(data.notes);

package/dashboard/js/render-agents.js

@@ -4,12 +4,12 @@ function renderAgents(agents) {
   agentData = agents;
   const grid = document.getElementById('agents-grid');
   grid.innerHTML = agents.map(a => `
-    <div class="agent-card ${statusColor(a.status)}" onclick="openAgentDetail('${a.id}')">
+    <div class="agent-card ${statusColor(a.status)}" onclick="openAgentDetail('${escHtml(a.id)}')">
       <div class="agent-card-header">
-        <span class="agent-name"><span class="agent-emoji">${a.emoji}</span>${a.name}</span>
-        <span class="status-badge ${a.status}">${a.status}</span>
+        <span class="agent-name"><span class="agent-emoji">${escHtml(a.emoji)}</span>${escHtml(a.name)}</span>
+        <span class="status-badge ${escHtml(a.status)}">${escHtml(a.status)}</span>
       </div>
-      <div class="agent-role">${a.role}</div>
+      <div class="agent-role">${escHtml(a.role)}</div>
       <div class="agent-action" title="${escHtml(a.lastAction)}">${escHtml(a.lastAction)}</div>
       ${a._warning ? `<div style="margin-top:4px;padding:4px 8px;background:rgba(210,153,34,0.15);border:1px solid rgba(210,153,34,0.3);border-radius:4px;font-size:10px;color:var(--yellow)">&#x26A0; ${escHtml(a._warning)}</div>` : ''}
       ${a._permissionMode && a._permissionMode !== 'bypassPermissions' && !a._warning ? `<div style="margin-top:4px;font-size:9px;color:var(--muted)">Permission mode: ${escHtml(a._permissionMode)}</div>` : ''}
@@ -25,7 +25,7 @@ async function openAgentDetail(id) {
   currentTab = (agent.status === 'working') ? 'live' : 'thought-process';
 
   document.getElementById('detail-agent-name').innerHTML =
-    '<span style="font-size:22px">' + agent.emoji + '</span> ' + agent.name + ' — ' + agent.role;
+    '<span style="font-size:22px">' + escHtml(agent.emoji) + '</span> ' + escHtml(agent.name) + ' — ' + escHtml(agent.role);
 
   const badgeClass = agent.status;
   document.getElementById('detail-status-line').innerHTML =

package/dashboard/js/render-inbox.js

@@ -24,13 +24,13 @@ function renderInbox(inbox) {
     const idx = inboxStart + i;
     return `<div class="inbox-item" data-file="notes/inbox/${escHtml(item.name)}">
       <div class="inbox-name" onclick="openModal(${idx})" style="cursor:pointer">
-        <span>${escHtml(item.name)}</span><span>${item.age}</span>
+        <span>${escHtml(item.name)}</span><span>${escHtml(item.age || '')}</span>
       </div>
       <div class="inbox-preview" onclick="openModal(${idx})" style="cursor:pointer">${escHtml(item.content.slice(0,200))}</div>
       <div style="display:flex;gap:6px;margin-top:6px;align-items:center">
-        <button class="pr-pager-btn" style="font-size:9px;padding:2px 8px" onclick="event.stopPropagation();promoteToKB('${escHtml(item.name)}')">Add to Knowledge Base</button>
-        <button class="pr-pager-btn" style="font-size:9px;padding:2px 8px" onclick="event.stopPropagation();openInboxInExplorer('${escHtml(item.name)}')">Open in Explorer</button>
-        <button class="pr-pager-btn" style="font-size:9px;padding:2px 8px;color:var(--red)" onclick="event.stopPropagation();deleteInboxItem('${escHtml(item.name)}')">Delete</button>
+        <button class="pr-pager-btn" style="font-size:9px;padding:2px 8px" data-inbox-name="${escHtml(item.name)}" onclick="event.stopPropagation();promoteToKB(this.dataset.inboxName)">Add to Knowledge Base</button>
+        <button class="pr-pager-btn" style="font-size:9px;padding:2px 8px" data-inbox-name="${escHtml(item.name)}" onclick="event.stopPropagation();openInboxInExplorer(this.dataset.inboxName)">Open in Explorer</button>
+        <button class="pr-pager-btn" style="font-size:9px;padding:2px 8px;color:var(--red)" data-inbox-name="${escHtml(item.name)}" onclick="event.stopPropagation();deleteInboxItem(this.dataset.inboxName)">Delete</button>
       </div>
     </div>`;
   }).join('');

package/dashboard/js/render-pinned.js

@@ -14,7 +14,7 @@ function renderPinned(entries) {
       ';border-radius:4px">' +
       '<div style="display:flex;justify-content:space-between;align-items:center">' +
         '<strong style="font-size:var(--text-md)">' + escHtml(e.title) + '</strong>' +
-        '<button class="pr-pager-btn" style="font-size:9px;padding:1px 6px;color:var(--red);border-color:var(--red)" onclick="removePinnedNote(\'' + escHtml(e.title) + '\')">Unpin</button>' +
+        '<button class="pr-pager-btn" style="font-size:9px;padding:1px 6px;color:var(--red);border-color:var(--red)" data-pin-title="' + escHtml(e.title) + '" onclick="removePinnedNote(this.dataset.pinTitle)">Unpin</button>' +
       '</div>' +
       '<div style="font-size:var(--text-sm);color:var(--muted);margin-top:4px">' + renderMd(e.content.slice(0, 200)) + '</div>' +
     '</div>'
@@ -28,13 +28,13 @@ function openPinNoteModal() {
       '<label style="color:var(--text);font-size:var(--text-md)">Title<input id="pin-title" style="display:block;width:100%;margin-top:4px;padding:6px 8px;background:var(--bg);border:1px solid var(--border);border-radius:var(--radius-sm);color:var(--text)" placeholder="e.g. API freeze until Friday"></label>' +
       '<label style="color:var(--text);font-size:var(--text-md)">Content<textarea id="pin-content" rows="4" style="display:block;width:100%;margin-top:4px;padding:6px 8px;background:var(--bg);border:1px solid var(--border);border-radius:var(--radius-sm);color:var(--text);resize:vertical;font-family:inherit" placeholder="Context all agents should see..."></textarea></label>' +
       '<label style="color:var(--text);font-size:var(--text-md)">Level<select id="pin-level" style="display:block;width:100%;margin-top:4px;padding:6px 8px;background:var(--bg);border:1px solid var(--border);border-radius:var(--radius-sm);color:var(--text)"><option value="info">Info</option><option value="warning">Warning</option><option value="critical">Critical</option></select></label>' +
-      '<div style="display:flex;justify-content:flex-end;gap:8px"><button onclick="closeModal()" class="pr-pager-btn">Cancel</button><button onclick="submitPinnedNote()" style="padding:6px 16px;background:var(--blue);color:#fff;border:none;border-radius:var(--radius-sm);cursor:pointer">Pin</button></div>' +
+      '<div style="display:flex;justify-content:flex-end;gap:8px"><button onclick="closeModal()" class="pr-pager-btn">Cancel</button><button onclick="submitPinnedNote(event)" style="padding:6px 16px;background:var(--blue);color:#fff;border:none;border-radius:var(--radius-sm);cursor:pointer">Pin</button></div>' +
     '</div>';
   document.getElementById('modal').classList.add('open');
 }
 
-async function submitPinnedNote() {
-  var btn = event?.target; if (btn) { btn.disabled = true; btn.textContent = 'Pinning...'; }
+async function submitPinnedNote(e) {
+  var btn = (e || window.event)?.target; if (btn) { btn.disabled = true; btn.textContent = 'Pinning...'; }
   const title = document.getElementById('pin-title').value;
   const content = document.getElementById('pin-content').value;
   const level = document.getElementById('pin-level').value;
@@ -50,7 +50,7 @@ async function submitPinnedNote() {
 async function removePinnedNote(title) {
   if (!confirm('Unpin "' + title + '"?')) return;
   markDeleted('pin:' + title);
-  const btn = event?.target; if (btn) { const card = btn.closest('.pinned-card') || btn.parentElement?.parentElement; if (card) card.remove(); }
+  const btn = (window.event)?.target; if (btn) { const card = btn.closest('.pinned-card') || btn.parentElement?.parentElement; if (card) card.remove(); }
   try {
     const res = await fetch('/api/pinned/remove', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ title }) });
     if (!res.ok) { alert('Unpin failed'); refresh(); }

package/dashboard/js/render-prd.js

@@ -200,7 +200,7 @@ function renderPrdProgress(prog) {
 
   const renderGroupHeader = (g) => {
     const done = g.items.filter(i => i.status === 'done').length;
-    const wip = g.items.filter(i => i.status === 'dispatched' || i.status === 'dispatched').length;
+    const wip = g.items.filter(i => i.status === 'dispatched' || i.status === 'pending').length;
     const summary = (g.summary || '').replace(/^Convert plan to PRD:\s*/i, '').slice(0, 80);
     const isAwaitingApproval = g.planStatus === 'awaiting-approval';
     const isPaused = g.planStatus === 'paused';
@@ -564,7 +564,7 @@ async function prdItemEdit(source, itemId) {
   let completionHtml = '';
   const isDone = item.status === 'done';
   const isFailed = item.status === 'failed';
-  const isActive = item.status === 'dispatched' || item.status === 'dispatched';
+  const isActive = item.status === 'dispatched' || item.status === 'pending';
 
   if (isDone || isFailed || isActive) {
     const agent = wi?.dispatched_to || completedEntry?.agent || '';
@@ -604,9 +604,9 @@ async function prdItemEdit(source, itemId) {
         '</select></div>' +
       '<div><label style="font-size:11px;color:var(--muted);display:block;margin-bottom:4px">Complexity</label>' +
         '<select id="prd-edit-complexity" style="padding:4px 8px;background:var(--surface);border:1px solid var(--border);border-radius:4px;color:var(--text)">' +
-          '<option value="small"' + (item.complexity === 'small' ? ' selected' : '') + '>Small</option>' +
-          '<option value="medium"' + (item.complexity === 'medium' ? ' selected' : '') + '>Medium</option>' +
-          '<option value="large"' + (item.complexity === 'large' ? ' selected' : '') + '>Large</option>' +
+          '<option value="small"' + ((item.estimated_complexity || item.complexity) === 'small' ? ' selected' : '') + '>Small</option>' +
+          '<option value="medium"' + ((item.estimated_complexity || item.complexity) === 'medium' ? ' selected' : '') + '>Medium</option>' +
+          '<option value="large"' + ((item.estimated_complexity || item.complexity) === 'large' ? ' selected' : '') + '>Large</option>' +
         '</select></div>' +
     '</div>' +
     '<div style="display:flex;gap:8px">' +

package/dashboard/js/render-prs.js

@@ -20,7 +20,7 @@ function prRow(pr) {
   const prId = pr.id || '—';
   return '<tr>' +
     '<td><span class="pr-id">' + escHtml(String(prId)) + '</span></td>' +
-    '<td><a class="pr-title" href="' + escHtml(url) + '" target="_blank">' + escHtml(pr.title || 'Untitled') + '</a></td>' +
+    '<td><a class="pr-title" href="' + escHtml(safeUrl(url)) + '" target="_blank" rel="noopener">' + escHtml(pr.title || 'Untitled') + '</a></td>' +
     '<td><span class="pr-agent">' + escHtml(pr.agent || '—') + '</span></td>' +
     '<td><span class="pr-branch">' + escHtml(pr.branch || '—') + '</span></td>' +
     '<td><span class="pr-badge ' + reviewClass + '">' + escHtml(reviewLabel) + '</span></td>' +
@@ -33,7 +33,7 @@ function prRow(pr) {
 
 function prTableHtml(rows) {
   return '<div class="pr-table-wrap"><table class="pr-table"><thead><tr>' +
-    '<th>PR</th><th>Title</th><th>Agent</th><th>Branch</th><th>Review</th><th>Signed Off By</th><th>Build</th><th>Status</th><th>Created</th><th></th>' +
+    '<th>PR</th><th>Title</th><th>Agent</th><th>Branch</th><th>Review</th><th>Signed Off By</th><th>Build</th><th>Status</th><th>Created</th>' +
     '</tr></thead><tbody>' + rows + '</tbody></table></div>';
 }
 

package/dashboard/js/state.js

@@ -89,6 +89,7 @@ function prunePrdRequeueState(workItems) {
 
 function rerenderPrdFromCache() {
   if (!window._lastStatus || !window._lastStatus.prdProgress) return;
+  renderPrdProgress(window._lastStatus.prdProgress);
   renderPrd(window._lastStatus.prd, window._lastStatus.prdProgress);
 }
 

package/dashboard/js/utils.js

@@ -12,6 +12,13 @@ function escHtml(s) {
   return String(s).replace(/&/g,'&amp;').replace(/</g,'&lt;').replace(/>/g,'&gt;').replace(/"/g,'&quot;').replace(/'/g,'&#39;');
 }
 
+function safeUrl(url) {
+  const s = String(url || '').trim();
+  if (/^https?:\/\//i.test(s)) return s;
+  if (s === '#' || s === '') return '#';
+  return '#'; // block javascript:, data:, etc.
+}
+
 function normalizePlanFile(file) {
   return String(file || '').replace(/\\/g, '/').split('/').pop();
 }

package/dashboard.js

@@ -1898,9 +1898,9 @@ If nothing to do: { "duplicates": [], "reclassify": [], "remove": [] }`;
                 }
               }
 
-              if (w.status !== 'pending') reset++;
-              w.status = 'pending';
-              delete w._pausedBy;
+              if (w.status !== 'paused') reset++;
+              w.status = 'paused';
+              w._pausedBy = 'prd-pause';
               delete w._resumedAt;
               delete w.dispatched_at;
               delete w.dispatched_to;
@@ -3202,8 +3202,8 @@ What would you like to discuss or change? When you're happy, say "approve" and I
       const config = queries.getConfig();
       const routing = safeRead(path.join(MINIONS_DIR, 'routing.md')) || '';
       return jsonReply(res, 200, {
-        engine: config.engine || {},
-        claude: config.claude || {},
+        engine: { ...shared.ENGINE_DEFAULTS, ...(config.engine || {}) },
+        claude: { ...shared.DEFAULT_CLAUDE, ...(config.claude || {}) },
         agents: config.agents || {},
         routing,
       });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yemi33/minions",
-  "version": "0.1.363",
+  "version": "0.1.365",
   "description": "Multi-agent AI dev team that runs from ~/.minions/ — five autonomous agents share a single engine, dashboard, and knowledge base",
   "bin": {
     "minions": "bin/minions.js"