@yemi33/minions 0.1.364 → 0.1.366

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## 0.1.366 (2026-04-06)
+
+### Fixes
+-  medium dashboard bugs — settings reset, work items, schedules, plans (#212)
+-  XSS vulnerabilities across dashboard components (#211)
+
 ## 0.1.364 (2026-04-06)
 
 ### Fixes

package/dashboard/js/render-agents.js

@@ -4,12 +4,12 @@ function renderAgents(agents) {
   agentData = agents;
   const grid = document.getElementById('agents-grid');
   grid.innerHTML = agents.map(a => `
-    <div class="agent-card ${statusColor(a.status)}" onclick="openAgentDetail('${a.id}')">
+    <div class="agent-card ${statusColor(a.status)}" onclick="openAgentDetail('${escHtml(a.id)}')">
       <div class="agent-card-header">
-        <span class="agent-name"><span class="agent-emoji">${a.emoji}</span>${a.name}</span>
-        <span class="status-badge ${a.status}">${a.status}</span>
+        <span class="agent-name"><span class="agent-emoji">${escHtml(a.emoji)}</span>${escHtml(a.name)}</span>
+        <span class="status-badge ${escHtml(a.status)}">${escHtml(a.status)}</span>
       </div>
-      <div class="agent-role">${a.role}</div>
+      <div class="agent-role">${escHtml(a.role)}</div>
       <div class="agent-action" title="${escHtml(a.lastAction)}">${escHtml(a.lastAction)}</div>
       ${a._warning ? `<div style="margin-top:4px;padding:4px 8px;background:rgba(210,153,34,0.15);border:1px solid rgba(210,153,34,0.3);border-radius:4px;font-size:10px;color:var(--yellow)">&#x26A0; ${escHtml(a._warning)}</div>` : ''}
       ${a._permissionMode && a._permissionMode !== 'bypassPermissions' && !a._warning ? `<div style="margin-top:4px;font-size:9px;color:var(--muted)">Permission mode: ${escHtml(a._permissionMode)}</div>` : ''}
@@ -25,7 +25,7 @@ async function openAgentDetail(id) {
   currentTab = (agent.status === 'working') ? 'live' : 'thought-process';
 
   document.getElementById('detail-agent-name').innerHTML =
-    '<span style="font-size:22px">' + agent.emoji + '</span> ' + agent.name + ' — ' + agent.role;
+    '<span style="font-size:22px">' + escHtml(agent.emoji) + '</span> ' + escHtml(agent.name) + ' — ' + escHtml(agent.role);
 
   const badgeClass = agent.status;
   document.getElementById('detail-status-line').innerHTML =

package/dashboard/js/render-inbox.js

@@ -24,13 +24,13 @@ function renderInbox(inbox) {
     const idx = inboxStart + i;
     return `<div class="inbox-item" data-file="notes/inbox/${escHtml(item.name)}">
       <div class="inbox-name" onclick="openModal(${idx})" style="cursor:pointer">
-        <span>${escHtml(item.name)}</span><span>${item.age}</span>
+        <span>${escHtml(item.name)}</span><span>${escHtml(item.age || '')}</span>
       </div>
       <div class="inbox-preview" onclick="openModal(${idx})" style="cursor:pointer">${escHtml(item.content.slice(0,200))}</div>
       <div style="display:flex;gap:6px;margin-top:6px;align-items:center">
-        <button class="pr-pager-btn" style="font-size:9px;padding:2px 8px" onclick="event.stopPropagation();promoteToKB('${escHtml(item.name)}')">Add to Knowledge Base</button>
-        <button class="pr-pager-btn" style="font-size:9px;padding:2px 8px" onclick="event.stopPropagation();openInboxInExplorer('${escHtml(item.name)}')">Open in Explorer</button>
-        <button class="pr-pager-btn" style="font-size:9px;padding:2px 8px;color:var(--red)" onclick="event.stopPropagation();deleteInboxItem('${escHtml(item.name)}')">Delete</button>
+        <button class="pr-pager-btn" style="font-size:9px;padding:2px 8px" data-inbox-name="${escHtml(item.name)}" onclick="event.stopPropagation();promoteToKB(this.dataset.inboxName)">Add to Knowledge Base</button>
+        <button class="pr-pager-btn" style="font-size:9px;padding:2px 8px" data-inbox-name="${escHtml(item.name)}" onclick="event.stopPropagation();openInboxInExplorer(this.dataset.inboxName)">Open in Explorer</button>
+        <button class="pr-pager-btn" style="font-size:9px;padding:2px 8px;color:var(--red)" data-inbox-name="${escHtml(item.name)}" onclick="event.stopPropagation();deleteInboxItem(this.dataset.inboxName)">Delete</button>
       </div>
     </div>`;
   }).join('');

package/dashboard/js/render-pinned.js

@@ -14,7 +14,7 @@ function renderPinned(entries) {
       ';border-radius:4px">' +
       '<div style="display:flex;justify-content:space-between;align-items:center">' +
         '<strong style="font-size:var(--text-md)">' + escHtml(e.title) + '</strong>' +
-        '<button class="pr-pager-btn" style="font-size:9px;padding:1px 6px;color:var(--red);border-color:var(--red)" onclick="removePinnedNote(\'' + escHtml(e.title) + '\')">Unpin</button>' +
+        '<button class="pr-pager-btn" style="font-size:9px;padding:1px 6px;color:var(--red);border-color:var(--red)" data-pin-title="' + escHtml(e.title) + '" onclick="removePinnedNote(this.dataset.pinTitle)">Unpin</button>' +
       '</div>' +
       '<div style="font-size:var(--text-sm);color:var(--muted);margin-top:4px">' + renderMd(e.content.slice(0, 200)) + '</div>' +
     '</div>'
@@ -28,13 +28,13 @@ function openPinNoteModal() {
       '<label style="color:var(--text);font-size:var(--text-md)">Title<input id="pin-title" style="display:block;width:100%;margin-top:4px;padding:6px 8px;background:var(--bg);border:1px solid var(--border);border-radius:var(--radius-sm);color:var(--text)" placeholder="e.g. API freeze until Friday"></label>' +
       '<label style="color:var(--text);font-size:var(--text-md)">Content<textarea id="pin-content" rows="4" style="display:block;width:100%;margin-top:4px;padding:6px 8px;background:var(--bg);border:1px solid var(--border);border-radius:var(--radius-sm);color:var(--text);resize:vertical;font-family:inherit" placeholder="Context all agents should see..."></textarea></label>' +
       '<label style="color:var(--text);font-size:var(--text-md)">Level<select id="pin-level" style="display:block;width:100%;margin-top:4px;padding:6px 8px;background:var(--bg);border:1px solid var(--border);border-radius:var(--radius-sm);color:var(--text)"><option value="info">Info</option><option value="warning">Warning</option><option value="critical">Critical</option></select></label>' +
-      '<div style="display:flex;justify-content:flex-end;gap:8px"><button onclick="closeModal()" class="pr-pager-btn">Cancel</button><button onclick="submitPinnedNote()" style="padding:6px 16px;background:var(--blue);color:#fff;border:none;border-radius:var(--radius-sm);cursor:pointer">Pin</button></div>' +
+      '<div style="display:flex;justify-content:flex-end;gap:8px"><button onclick="closeModal()" class="pr-pager-btn">Cancel</button><button onclick="submitPinnedNote(event)" style="padding:6px 16px;background:var(--blue);color:#fff;border:none;border-radius:var(--radius-sm);cursor:pointer">Pin</button></div>' +
     '</div>';
   document.getElementById('modal').classList.add('open');
 }
 
-async function submitPinnedNote() {
-  var btn = event?.target; if (btn) { btn.disabled = true; btn.textContent = 'Pinning...'; }
+async function submitPinnedNote(e) {
+  var btn = (e || window.event)?.target; if (btn) { btn.disabled = true; btn.textContent = 'Pinning...'; }
   const title = document.getElementById('pin-title').value;
   const content = document.getElementById('pin-content').value;
   const level = document.getElementById('pin-level').value;
@@ -50,7 +50,7 @@ async function submitPinnedNote() {
 async function removePinnedNote(title) {
   if (!confirm('Unpin "' + title + '"?')) return;
   markDeleted('pin:' + title);
-  const btn = event?.target; if (btn) { const card = btn.closest('.pinned-card') || btn.parentElement?.parentElement; if (card) card.remove(); }
+  const btn = (window.event)?.target; if (btn) { const card = btn.closest('.pinned-card') || btn.parentElement?.parentElement; if (card) card.remove(); }
   try {
     const res = await fetch('/api/pinned/remove', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ title }) });
     if (!res.ok) { alert('Unpin failed'); refresh(); }

package/dashboard/js/render-plans.js

@@ -255,7 +255,7 @@ function renderPlans(plans) {
         '<div><div class="plan-card-title">' + escHtml(p.summary || p.file) + versionBadge + '</div>' +
           '<div class="plan-card-meta">' +
             '<span style="font-weight:600;color:' + (statusColors[effectiveStatus] || 'var(--muted)') + '">' + label + '</span>' +
-            '<span>' + escHtml(p.project) + '</span>' +
+            (p.project ? '<span>' + escHtml(p.project) + '</span>' : '') +
             '<span>' + p.itemCount + ' items</span>' +
             (p.updatedAt ? '<span title="Last updated: ' + p.updatedAt + '">Updated ' + timeAgo(p.updatedAt) + '</span>' : '') +
             (p.completedAt ? '<span>' + p.completedAt.slice(0, 10) + '</span>' : '') +
@@ -370,6 +370,7 @@ async function planSubmitRevise(file) {
   try {
     const res = await fetch('/api/plans/revise', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ file, feedback }) });
     const data = await res.json();
+    if (!res.ok) { showToast('cmd-toast', 'Revision failed: ' + (data.error || 'unknown'), false); return; }
     showToast('cmd-toast', 'Revision requested — agent will update the plan (' + data.workItemId + ')', true);
     planHideRevise(file);
     refreshPlans();

package/dashboard/js/render-prs.js

@@ -20,7 +20,7 @@ function prRow(pr) {
   const prId = pr.id || '—';
   return '<tr>' +
     '<td><span class="pr-id">' + escHtml(String(prId)) + '</span></td>' +
-    '<td><a class="pr-title" href="' + escHtml(url) + '" target="_blank">' + escHtml(pr.title || 'Untitled') + '</a></td>' +
+    '<td><a class="pr-title" href="' + escHtml(safeUrl(url)) + '" target="_blank" rel="noopener">' + escHtml(pr.title || 'Untitled') + '</a></td>' +
     '<td><span class="pr-agent">' + escHtml(pr.agent || '—') + '</span></td>' +
     '<td><span class="pr-branch">' + escHtml(pr.branch || '—') + '</span></td>' +
     '<td><span class="pr-badge ' + reviewClass + '">' + escHtml(reviewLabel) + '</span></td>' +
@@ -33,7 +33,7 @@ function prRow(pr) {
 
 function prTableHtml(rows) {
   return '<div class="pr-table-wrap"><table class="pr-table"><thead><tr>' +
-    '<th>PR</th><th>Title</th><th>Agent</th><th>Branch</th><th>Review</th><th>Signed Off By</th><th>Build</th><th>Status</th><th>Created</th><th></th>' +
+    '<th>PR</th><th>Title</th><th>Agent</th><th>Branch</th><th>Review</th><th>Signed Off By</th><th>Build</th><th>Status</th><th>Created</th>' +
     '</tr></thead><tbody>' + rows + '</tbody></table></div>';
 }
 
@@ -96,9 +96,10 @@ function openModal(i) {
 }
 
 function openAddPrModal() {
-  const projOpts = (typeof cmdProjects !== 'undefined' ? cmdProjects : []).map(p =>
-    '<option value="' + escHtml(p) + '">' + escHtml(p) + '</option>'
-  ).join('');
+  const projOpts = (typeof cmdProjects !== 'undefined' ? cmdProjects : []).map(p => {
+    const name = typeof p === 'object' ? p.name : p;
+    return '<option value="' + escHtml(name) + '">' + escHtml(name) + '</option>';
+  }).join('');
   const inputStyle = 'display:block;width:100%;margin-top:4px;padding:6px 8px;background:var(--bg);border:1px solid var(--border);border-radius:var(--radius-sm);color:var(--text);font-size:var(--text-md);font-family:inherit';
 
   document.getElementById('modal-title').textContent = 'Link Pull Request';

package/dashboard/js/render-schedules.js

@@ -484,6 +484,7 @@ function openEditScheduleModal(id) {
   document.getElementById('modal-body').innerHTML = _scheduleFormHtml(sched, true);
   window._editScheduleId = id;
   document.getElementById('modal').classList.add('open');
+  _updateCronPreview();
 }
 
 async function submitSchedule(isEdit) {

package/dashboard/js/render-work-items.js

@@ -84,7 +84,7 @@ function renderWorkItems(items) {
   allWorkItems = items;
   const el = document.getElementById('work-items-content');
   const countEl = document.getElementById('wi-count');
-  countEl.textContent = items.length;
+  if (countEl) countEl.textContent = items.length;
   if (!items.length) {
     el.innerHTML = '<p class="empty">No work items. Add tasks via Command Center above.</p>';
     return;

package/dashboard/js/utils.js

@@ -12,6 +12,13 @@ function escHtml(s) {
   return String(s).replace(/&/g,'&amp;').replace(/</g,'&lt;').replace(/>/g,'&gt;').replace(/"/g,'&quot;').replace(/'/g,'&#39;');
 }
 
+function safeUrl(url) {
+  const s = String(url || '').trim();
+  if (/^https?:\/\//i.test(s)) return s;
+  if (s === '#' || s === '') return '#';
+  return '#'; // block javascript:, data:, etc.
+}
+
 function normalizePlanFile(file) {
   return String(file || '').replace(/\\/g, '/').split('/').pop();
 }
@@ -31,7 +38,7 @@ function timeAgo(isoStr) {
 }
 
 function statusColor(s) {
-  return s === 'working' ? 'working' : s === 'done' ? 'done' : '';
+  return s === 'working' ? 'working' : s === 'done' ? 'done' : s === 'error' ? 'error' : '';
 }
 
 function llmCopyBtn() {

package/dashboard.js

@@ -959,15 +959,18 @@ const server = http.createServer(async (req, res) => {
       }
       if (!wiPath) return jsonReply(res, 404, { error: 'source not found' });
 
-      const items = JSON.parse(safeRead(wiPath) || '[]');
-      const idx = items.findIndex(i => i.id === id);
-      if (idx === -1) return jsonReply(res, 404, { error: 'item not found' });
-
-      const item = items[idx];
-
-      // Remove item from work-items file
-      items.splice(idx, 1);
-      safeWrite(wiPath, items);
+      let item = null;
+      let found = false;
+      mutateJsonFileLocked(wiPath, (items) => {
+        if (!Array.isArray(items)) return items;
+        const idx = items.findIndex(i => i.id === id);
+        if (idx === -1) return items;
+        item = items[idx];
+        items.splice(idx, 1);
+        found = true;
+        return items;
+      }, { defaultValue: [] });
+      if (!found) return jsonReply(res, 404, { error: 'item not found' });
 
       // Clean dispatch entries + kill running agent
       const dispatchRemoved = cleanDispatchEntries(d =>
@@ -1080,6 +1083,7 @@ const server = http.createServer(async (req, res) => {
       if (body.agents) item.agents = body.agents;
       if (body.references) item.references = body.references;
       if (body.acceptanceCriteria) item.acceptanceCriteria = body.acceptanceCriteria;
+      if (body.skipPr) item.skipPr = true;
       items.push(item);
       safeWrite(wiPath, items);
       return jsonReply(res, 200, { ok: true, id });
@@ -3297,6 +3301,8 @@ What would you like to discuss or change? When you're happy, say "approve" and I
       config.claude = { ...shared.DEFAULT_CLAUDE };
       config.agents = { ...shared.DEFAULT_AGENTS };
       safeWrite(path.join(MINIONS_DIR, 'config.json'), config);
+      reloadConfig();
+      invalidateStatusCache();
       return jsonReply(res, 200, { ok: true });
     } catch (e) { return jsonReply(res, 500, { error: e.message }); }
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yemi33/minions",
-  "version": "0.1.364",
+  "version": "0.1.366",
   "description": "Multi-agent AI dev team that runs from ~/.minions/ — five autonomous agents share a single engine, dashboard, and knowledge base",
   "bin": {
     "minions": "bin/minions.js"