@yemi33/minions 0.1.364 → 0.1.365

package/CHANGELOG.md

@@ -1,5 +1,10 @@
 # Changelog
 
+## 0.1.365 (2026-04-06)
+
+### Fixes
+-  XSS vulnerabilities across dashboard components (#211)
+
 ## 0.1.364 (2026-04-06)
 
 ### Fixes

package/dashboard/js/render-agents.js

@@ -4,12 +4,12 @@ function renderAgents(agents) {
   agentData = agents;
   const grid = document.getElementById('agents-grid');
   grid.innerHTML = agents.map(a => `
-    <div class="agent-card ${statusColor(a.status)}" onclick="openAgentDetail('${a.id}')">
+    <div class="agent-card ${statusColor(a.status)}" onclick="openAgentDetail('${escHtml(a.id)}')">
       <div class="agent-card-header">
-        <span class="agent-name"><span class="agent-emoji">${a.emoji}</span>${a.name}</span>
-        <span class="status-badge ${a.status}">${a.status}</span>
+        <span class="agent-name"><span class="agent-emoji">${escHtml(a.emoji)}</span>${escHtml(a.name)}</span>
+        <span class="status-badge ${escHtml(a.status)}">${escHtml(a.status)}</span>
       </div>
-      <div class="agent-role">${a.role}</div>
+      <div class="agent-role">${escHtml(a.role)}</div>
       <div class="agent-action" title="${escHtml(a.lastAction)}">${escHtml(a.lastAction)}</div>
       ${a._warning ? `<div style="margin-top:4px;padding:4px 8px;background:rgba(210,153,34,0.15);border:1px solid rgba(210,153,34,0.3);border-radius:4px;font-size:10px;color:var(--yellow)">&#x26A0; ${escHtml(a._warning)}</div>` : ''}
       ${a._permissionMode && a._permissionMode !== 'bypassPermissions' && !a._warning ? `<div style="margin-top:4px;font-size:9px;color:var(--muted)">Permission mode: ${escHtml(a._permissionMode)}</div>` : ''}
@@ -25,7 +25,7 @@ async function openAgentDetail(id) {
   currentTab = (agent.status === 'working') ? 'live' : 'thought-process';
 
   document.getElementById('detail-agent-name').innerHTML =
-    '<span style="font-size:22px">' + agent.emoji + '</span> ' + agent.name + ' — ' + agent.role;
+    '<span style="font-size:22px">' + escHtml(agent.emoji) + '</span> ' + escHtml(agent.name) + ' — ' + escHtml(agent.role);
 
   const badgeClass = agent.status;
   document.getElementById('detail-status-line').innerHTML =

package/dashboard/js/render-inbox.js

@@ -24,13 +24,13 @@ function renderInbox(inbox) {
     const idx = inboxStart + i;
     return `<div class="inbox-item" data-file="notes/inbox/${escHtml(item.name)}">
       <div class="inbox-name" onclick="openModal(${idx})" style="cursor:pointer">
-        <span>${escHtml(item.name)}</span><span>${item.age}</span>
+        <span>${escHtml(item.name)}</span><span>${escHtml(item.age || '')}</span>
       </div>
       <div class="inbox-preview" onclick="openModal(${idx})" style="cursor:pointer">${escHtml(item.content.slice(0,200))}</div>
       <div style="display:flex;gap:6px;margin-top:6px;align-items:center">
-        <button class="pr-pager-btn" style="font-size:9px;padding:2px 8px" onclick="event.stopPropagation();promoteToKB('${escHtml(item.name)}')">Add to Knowledge Base</button>
-        <button class="pr-pager-btn" style="font-size:9px;padding:2px 8px" onclick="event.stopPropagation();openInboxInExplorer('${escHtml(item.name)}')">Open in Explorer</button>
-        <button class="pr-pager-btn" style="font-size:9px;padding:2px 8px;color:var(--red)" onclick="event.stopPropagation();deleteInboxItem('${escHtml(item.name)}')">Delete</button>
+        <button class="pr-pager-btn" style="font-size:9px;padding:2px 8px" data-inbox-name="${escHtml(item.name)}" onclick="event.stopPropagation();promoteToKB(this.dataset.inboxName)">Add to Knowledge Base</button>
+        <button class="pr-pager-btn" style="font-size:9px;padding:2px 8px" data-inbox-name="${escHtml(item.name)}" onclick="event.stopPropagation();openInboxInExplorer(this.dataset.inboxName)">Open in Explorer</button>
+        <button class="pr-pager-btn" style="font-size:9px;padding:2px 8px;color:var(--red)" data-inbox-name="${escHtml(item.name)}" onclick="event.stopPropagation();deleteInboxItem(this.dataset.inboxName)">Delete</button>
       </div>
     </div>`;
   }).join('');

package/dashboard/js/render-pinned.js

@@ -14,7 +14,7 @@ function renderPinned(entries) {
       ';border-radius:4px">' +
       '<div style="display:flex;justify-content:space-between;align-items:center">' +
         '<strong style="font-size:var(--text-md)">' + escHtml(e.title) + '</strong>' +
-        '<button class="pr-pager-btn" style="font-size:9px;padding:1px 6px;color:var(--red);border-color:var(--red)" onclick="removePinnedNote(\'' + escHtml(e.title) + '\')">Unpin</button>' +
+        '<button class="pr-pager-btn" style="font-size:9px;padding:1px 6px;color:var(--red);border-color:var(--red)" data-pin-title="' + escHtml(e.title) + '" onclick="removePinnedNote(this.dataset.pinTitle)">Unpin</button>' +
       '</div>' +
       '<div style="font-size:var(--text-sm);color:var(--muted);margin-top:4px">' + renderMd(e.content.slice(0, 200)) + '</div>' +
     '</div>'
@@ -28,13 +28,13 @@ function openPinNoteModal() {
       '<label style="color:var(--text);font-size:var(--text-md)">Title<input id="pin-title" style="display:block;width:100%;margin-top:4px;padding:6px 8px;background:var(--bg);border:1px solid var(--border);border-radius:var(--radius-sm);color:var(--text)" placeholder="e.g. API freeze until Friday"></label>' +
       '<label style="color:var(--text);font-size:var(--text-md)">Content<textarea id="pin-content" rows="4" style="display:block;width:100%;margin-top:4px;padding:6px 8px;background:var(--bg);border:1px solid var(--border);border-radius:var(--radius-sm);color:var(--text);resize:vertical;font-family:inherit" placeholder="Context all agents should see..."></textarea></label>' +
       '<label style="color:var(--text);font-size:var(--text-md)">Level<select id="pin-level" style="display:block;width:100%;margin-top:4px;padding:6px 8px;background:var(--bg);border:1px solid var(--border);border-radius:var(--radius-sm);color:var(--text)"><option value="info">Info</option><option value="warning">Warning</option><option value="critical">Critical</option></select></label>' +
-      '<div style="display:flex;justify-content:flex-end;gap:8px"><button onclick="closeModal()" class="pr-pager-btn">Cancel</button><button onclick="submitPinnedNote()" style="padding:6px 16px;background:var(--blue);color:#fff;border:none;border-radius:var(--radius-sm);cursor:pointer">Pin</button></div>' +
+      '<div style="display:flex;justify-content:flex-end;gap:8px"><button onclick="closeModal()" class="pr-pager-btn">Cancel</button><button onclick="submitPinnedNote(event)" style="padding:6px 16px;background:var(--blue);color:#fff;border:none;border-radius:var(--radius-sm);cursor:pointer">Pin</button></div>' +
     '</div>';
   document.getElementById('modal').classList.add('open');
 }
 
-async function submitPinnedNote() {
-  var btn = event?.target; if (btn) { btn.disabled = true; btn.textContent = 'Pinning...'; }
+async function submitPinnedNote(e) {
+  var btn = (e || window.event)?.target; if (btn) { btn.disabled = true; btn.textContent = 'Pinning...'; }
   const title = document.getElementById('pin-title').value;
   const content = document.getElementById('pin-content').value;
   const level = document.getElementById('pin-level').value;
@@ -50,7 +50,7 @@ async function submitPinnedNote() {
 async function removePinnedNote(title) {
   if (!confirm('Unpin "' + title + '"?')) return;
   markDeleted('pin:' + title);
-  const btn = event?.target; if (btn) { const card = btn.closest('.pinned-card') || btn.parentElement?.parentElement; if (card) card.remove(); }
+  const btn = (window.event)?.target; if (btn) { const card = btn.closest('.pinned-card') || btn.parentElement?.parentElement; if (card) card.remove(); }
   try {
     const res = await fetch('/api/pinned/remove', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ title }) });
     if (!res.ok) { alert('Unpin failed'); refresh(); }

package/dashboard/js/render-prs.js

@@ -20,7 +20,7 @@ function prRow(pr) {
   const prId = pr.id || '—';
   return '<tr>' +
     '<td><span class="pr-id">' + escHtml(String(prId)) + '</span></td>' +
-    '<td><a class="pr-title" href="' + escHtml(url) + '" target="_blank">' + escHtml(pr.title || 'Untitled') + '</a></td>' +
+    '<td><a class="pr-title" href="' + escHtml(safeUrl(url)) + '" target="_blank" rel="noopener">' + escHtml(pr.title || 'Untitled') + '</a></td>' +
     '<td><span class="pr-agent">' + escHtml(pr.agent || '—') + '</span></td>' +
     '<td><span class="pr-branch">' + escHtml(pr.branch || '—') + '</span></td>' +
     '<td><span class="pr-badge ' + reviewClass + '">' + escHtml(reviewLabel) + '</span></td>' +
@@ -33,7 +33,7 @@ function prRow(pr) {
 
 function prTableHtml(rows) {
   return '<div class="pr-table-wrap"><table class="pr-table"><thead><tr>' +
-    '<th>PR</th><th>Title</th><th>Agent</th><th>Branch</th><th>Review</th><th>Signed Off By</th><th>Build</th><th>Status</th><th>Created</th><th></th>' +
+    '<th>PR</th><th>Title</th><th>Agent</th><th>Branch</th><th>Review</th><th>Signed Off By</th><th>Build</th><th>Status</th><th>Created</th>' +
     '</tr></thead><tbody>' + rows + '</tbody></table></div>';
 }
 

package/dashboard/js/utils.js

@@ -12,6 +12,13 @@ function escHtml(s) {
   return String(s).replace(/&/g,'&amp;').replace(/</g,'&lt;').replace(/>/g,'&gt;').replace(/"/g,'&quot;').replace(/'/g,'&#39;');
 }
 
+function safeUrl(url) {
+  const s = String(url || '').trim();
+  if (/^https?:\/\//i.test(s)) return s;
+  if (s === '#' || s === '') return '#';
+  return '#'; // block javascript:, data:, etc.
+}
+
 function normalizePlanFile(file) {
   return String(file || '').replace(/\\/g, '/').split('/').pop();
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yemi33/minions",
-  "version": "0.1.364",
+  "version": "0.1.365",
   "description": "Multi-agent AI dev team that runs from ~/.minions/ — five autonomous agents share a single engine, dashboard, and knowledge base",
   "bin": {
     "minions": "bin/minions.js"