@yemi33/minions 0.1.366 → 0.1.368

package/CHANGELOG.md

@@ -1,8 +1,14 @@
 # Changelog
 
-## 0.1.366 (2026-04-06)
+## 0.1.368 (2026-04-06)
 
 ### Fixes
+-  dashboard audit pass 2 — CC error handling, charter edits, archived PRDs (#214)
+
+## 0.1.367 (2026-04-06)
+
+### Fixes
+-  low-severity dashboard polish — null guards, event params, UI gaps (#213)
 -  medium dashboard bugs — settings reset, work items, schedules, plans (#212)
 -  XSS vulnerabilities across dashboard components (#211)
 

package/dashboard/js/command-center.js

@@ -348,6 +348,12 @@ function ccRetryLast() {
   _ccDoSend(text.trim());
 }
 
+async function _ccFetch(url, body) {
+  const res = await fetch(url, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(body) });
+  if (!res.ok) { const d = await res.json().catch(() => ({})); throw new Error(d.error || 'Request failed (' + res.status + ')'); }
+  return res;
+}
+
 async function ccExecuteAction(action) {
   const msgs = document.getElementById('cc-messages');
   const status = document.createElement('div');
@@ -356,13 +362,10 @@ async function ccExecuteAction(action) {
   try {
     switch (action.type) {
       case 'dispatch': {
-        const res = await fetch('/api/work-items', {
-          method: 'POST', headers: { 'Content-Type': 'application/json' },
-          body: JSON.stringify({
+        const res = await _ccFetch('/api/work-items', {
             title: action.title, type: action.workType || 'implement',
             priority: action.priority || 'medium', description: action.description || '',
             project: action.project || '', agents: action.agents || [],
-          })
         });
         const d = await res.json();
         status.innerHTML = '&#10003; Dispatched: <strong>' + escHtml(d.id || action.title) + '</strong>';
@@ -371,49 +374,33 @@ async function ccExecuteAction(action) {
         break;
       }
       case 'note': {
-        const today = new Date().toISOString().slice(0, 10);
-        await fetch('/api/notes', {
-          method: 'POST', headers: { 'Content-Type': 'application/json' },
-          body: JSON.stringify({ title: action.title, what: action.content || action.description, author: 'command-center' })
-        });
+        await _ccFetch('/api/notes', { title: action.title, what: action.content || action.description, author: 'command-center' });
         status.innerHTML = '&#10003; Note saved: <strong>' + escHtml(action.title) + '</strong>';
         status.style.color = 'var(--green)';
         break;
       }
       case 'pin': {
-        await fetch('/api/pinned', {
-          method: 'POST', headers: { 'Content-Type': 'application/json' },
-          body: JSON.stringify({ title: action.title, content: action.content || action.description, level: action.level || '' })
-        });
+        await _ccFetch('/api/pinned', { title: action.title, content: action.content || action.description, level: action.level || '' });
         status.innerHTML = '&#x1F4CC; Pinned: <strong>' + escHtml(action.title) + '</strong> — visible to all agents';
         status.style.color = 'var(--green)';
         refresh();
         break;
       }
       case 'plan': {
-        await fetch('/api/plan', {
-          method: 'POST', headers: { 'Content-Type': 'application/json' },
-          body: JSON.stringify({ title: action.title, description: action.description, project: action.project, branchStrategy: action.branchStrategy || 'parallel' })
-        });
+        await _ccFetch('/api/plan', { title: action.title, description: action.description, project: action.project, branchStrategy: action.branchStrategy || 'parallel' });
         status.innerHTML = '&#10003; Plan queued: <strong>' + escHtml(action.title) + '</strong>';
         status.style.color = 'var(--green)';
         break;
       }
       case 'cancel': {
-        await fetch('/api/agents/cancel', {
-          method: 'POST', headers: { 'Content-Type': 'application/json' },
-          body: JSON.stringify({ agentId: action.agent, reason: action.reason || 'Cancelled via command center' })
-        });
+        await _ccFetch('/api/agents/cancel', { agentId: action.agent, reason: action.reason || 'Cancelled via command center' });
         status.innerHTML = '&#10003; Cancelled agent: <strong>' + escHtml(action.agent) + '</strong>';
         status.style.color = 'var(--orange)';
         break;
       }
       case 'retry': {
         for (const id of (action.ids || [])) {
-          await fetch('/api/work-items/retry', {
-            method: 'POST', headers: { 'Content-Type': 'application/json' },
-            body: JSON.stringify({ id, source: '' })
-          });
+          await _ccFetch('/api/work-items/retry', { id, source: '' });
         }
         status.innerHTML = '&#10003; Retried: <strong>' + escHtml((action.ids || []).join(', ')) + '</strong>';
         status.style.color = 'var(--green)';
@@ -421,46 +408,31 @@ async function ccExecuteAction(action) {
         break;
       }
       case 'pause-plan': {
-        await fetch('/api/plans/pause', {
-          method: 'POST', headers: { 'Content-Type': 'application/json' },
-          body: JSON.stringify({ file: action.file })
-        });
+        await _ccFetch('/api/plans/pause', { file: action.file });
         status.innerHTML = '&#10003; Paused plan: <strong>' + escHtml(action.file) + '</strong>';
         status.style.color = 'var(--orange)';
         break;
       }
       case 'approve-plan': {
-        await fetch('/api/plans/approve', {
-          method: 'POST', headers: { 'Content-Type': 'application/json' },
-          body: JSON.stringify({ file: action.file })
-        });
+        await _ccFetch('/api/plans/approve', { file: action.file });
         status.innerHTML = '&#10003; Approved plan: <strong>' + escHtml(action.file) + '</strong>';
         status.style.color = 'var(--green)';
         break;
       }
       case 'edit-prd-item': {
-        await fetch('/api/prd-items/update', {
-          method: 'POST', headers: { 'Content-Type': 'application/json' },
-          body: JSON.stringify({ source: action.source, itemId: action.itemId, name: action.name, description: action.description, priority: action.priority, estimated_complexity: action.complexity })
-        });
+        await _ccFetch('/api/prd-items/update', { source: action.source, itemId: action.itemId, name: action.name, description: action.description, priority: action.priority, estimated_complexity: action.complexity });
         status.innerHTML = '&#10003; Updated PRD item: <strong>' + escHtml(action.itemId) + '</strong>';
         status.style.color = 'var(--green)';
         break;
       }
       case 'remove-prd-item': {
-        await fetch('/api/prd-items/remove', {
-          method: 'POST', headers: { 'Content-Type': 'application/json' },
-          body: JSON.stringify({ source: action.source, itemId: action.itemId })
-        });
+        await _ccFetch('/api/prd-items/remove', { source: action.source, itemId: action.itemId });
         status.innerHTML = '&#10003; Removed PRD item: <strong>' + escHtml(action.itemId) + '</strong>';
         status.style.color = 'var(--orange)';
         break;
       }
       case 'delete-work-item': {
-        await fetch('/api/work-items/delete', {
-          method: 'POST', headers: { 'Content-Type': 'application/json' },
-          body: JSON.stringify({ id: action.id, source: action.source || '' })
-        });
+        await _ccFetch('/api/work-items/delete', { id: action.id, source: action.source || '' });
         status.innerHTML = '&#10003; Deleted work item: <strong>' + escHtml(action.id) + '</strong>';
         status.style.color = 'var(--orange)';
         break;
@@ -585,48 +557,33 @@ async function ccExecuteAction(action) {
         break;
       }
       case 'unpin': {
-        await fetch('/api/pinned/remove', {
-          method: 'POST', headers: { 'Content-Type': 'application/json' },
-          body: JSON.stringify({ title: action.title })
-        });
+        await _ccFetch('/api/pinned/remove', { title: action.title });
         status.innerHTML = '&#10003; Unpinned: <strong>' + escHtml(action.title) + '</strong>';
         status.style.color = 'var(--green)';
         refresh();
         break;
       }
       case 'archive-plan': {
-        await fetch('/api/plans/archive', {
-          method: 'POST', headers: { 'Content-Type': 'application/json' },
-          body: JSON.stringify({ file: action.file })
-        });
+        await _ccFetch('/api/plans/archive', { file: action.file });
         status.innerHTML = '&#10003; Archived plan: <strong>' + escHtml(action.file) + '</strong>';
         status.style.color = 'var(--green)';
         refresh();
         break;
       }
       case 'reject-plan': {
-        await fetch('/api/plans/reject', {
-          method: 'POST', headers: { 'Content-Type': 'application/json' },
-          body: JSON.stringify({ file: action.file, reason: action.reason || '' })
-        });
+        await _ccFetch('/api/plans/reject', { file: action.file, reason: action.reason || '' });
         status.innerHTML = '&#10003; Rejected plan: <strong>' + escHtml(action.file) + '</strong>';
         status.style.color = 'var(--orange)';
         break;
       }
       case 'steer-agent': {
-        await fetch('/api/agents/steer', {
-          method: 'POST', headers: { 'Content-Type': 'application/json' },
-          body: JSON.stringify({ agent: action.agent, message: action.message || action.content })
-        });
+        await _ccFetch('/api/agents/steer', { agent: action.agent, message: action.message || action.content });
         status.innerHTML = '&#10003; Steering message sent to <strong>' + escHtml(action.agent) + '</strong>';
         status.style.color = 'var(--green)';
         break;
       }
       case 'add-meeting-note': {
-        await fetch('/api/meetings/note', {
-          method: 'POST', headers: { 'Content-Type': 'application/json' },
-          body: JSON.stringify({ id: action.id, note: action.note || action.content })
-        });
+        await _ccFetch('/api/meetings/note', { id: action.id, note: action.note || action.content });
         status.innerHTML = '&#10003; Note added to meeting <strong>' + escHtml(action.id) + '</strong>';
         status.style.color = 'var(--green)';
         break;
@@ -643,30 +600,21 @@ async function ccExecuteAction(action) {
         break;
       }
       case 'link-pr': {
-        await fetch('/api/pull-requests/link', {
-          method: 'POST', headers: { 'Content-Type': 'application/json' },
-          body: JSON.stringify({ url: action.url, title: action.title || '', project: action.project || '', autoObserve: action.autoObserve !== false })
-        });
+        await _ccFetch('/api/pull-requests/link', { url: action.url, title: action.title || '', project: action.project || '', autoObserve: action.autoObserve !== false });
         status.innerHTML = '&#10003; PR linked: <strong>' + escHtml(action.url) + '</strong>';
         status.style.color = 'var(--green)';
         refresh();
         break;
       }
       case 'archive-meeting': {
-        await fetch('/api/meetings/archive', {
-          method: 'POST', headers: { 'Content-Type': 'application/json' },
-          body: JSON.stringify({ id: action.id })
-        });
+        await _ccFetch('/api/meetings/archive', { id: action.id });
         status.innerHTML = '&#10003; Meeting archived: <strong>' + escHtml(action.id) + '</strong>';
         status.style.color = 'var(--green)';
         refresh();
         break;
       }
       case 'update-routing': {
-        await fetch('/api/settings/routing', {
-          method: 'POST', headers: { 'Content-Type': 'application/json' },
-          body: JSON.stringify({ content: action.content })
-        });
+        await _ccFetch('/api/settings/routing', { content: action.content });
         status.innerHTML = '&#10003; Routing updated';
         status.style.color = 'var(--green)';
         break;

package/dashboard/js/detail-panel.js

@@ -1,5 +1,7 @@
 // dashboard/js/detail-panel.js — Agent detail panel extracted from dashboard.html
 
+let _charterRawCache = ''; // stored outside DOM to survive innerHTML rewrites on tab switch
+
 function closeDetail() {
   document.getElementById('detail-overlay').classList.remove('open');
   document.getElementById('detail-panel').classList.remove('open');
@@ -88,7 +90,7 @@ function renderDetailContent(detail, tab) {
       '</div>' +
       '<div id="charter-view" class="section">' + renderMd(charterContent || 'No charter found. Click Edit to create one.') + '</div>' +
       '<textarea id="charter-editor" style="display:none;width:100%;min-height:300px;padding:8px;background:var(--bg);border:1px solid var(--border);border-radius:var(--radius-sm);color:var(--text);font-family:Consolas,monospace;font-size:12px;resize:vertical">' + escHtml(charterContent) + '</textarea>';
-    el._charterRaw = charterContent;
+    _charterRawCache = charterContent;
   } else if (tab === 'history') {
     let html = '';
     // Recent dispatch results
@@ -126,7 +128,7 @@ function _toggleCharterEdit() {
 
 function _cancelCharterEdit() {
   const el = document.getElementById('detail-content');
-  document.getElementById('charter-editor').value = el._charterRaw || '';
+  document.getElementById('charter-editor').value = _charterRawCache || '';
   document.getElementById('charter-view').style.display = '';
   document.getElementById('charter-editor').style.display = 'none';
   document.getElementById('charter-edit-btn').style.display = '';
@@ -146,7 +148,7 @@ async function _saveCharter() {
     });
     if (res.ok) {
       document.getElementById('charter-view').innerHTML = renderMd(content);
-      document.getElementById('detail-content')._charterRaw = content;
+      _charterRawCache = content;
       _cancelCharterEdit();
       showToast('cmd-toast', 'Charter saved', true);
     } else {

package/dashboard/js/render-dispatch.js

@@ -6,9 +6,9 @@ let _completedPage = 0;
 let _logPage = 0;
 
 function _completedPrev() { if (_completedPage > 0) { _completedPage--; refresh(); } }
-function _completedNext() { _completedPage++; refresh(); }
+function _completedNext() { _completedPage++; refresh(); } // clamped in renderDispatch
 function _logPrev() { if (_logPage > 0) { _logPage--; refresh(); } }
-function _logNext() { _logPage++; refresh(); }
+function _logNext() { _logPage++; refresh(); } // clamped in renderEngineLog
 
 function renderEngineStatus(engine) {
   const badge = document.getElementById('engine-badge');
@@ -153,6 +153,7 @@ function renderDispatch(dispatch) {
 
 function renderEngineLog(log) {
   const el = document.getElementById('engine-log');
+  if (!el) return;
   if (!log || log.length === 0) {
     el.innerHTML = '<div class="empty">No log entries yet.</div>';
     return;

package/dashboard/js/render-inbox.js

@@ -140,7 +140,7 @@ async function modalSaveEdit() {
 function modalCancelEdit() {
   const body = document.getElementById('modal-body');
   body.contentEditable = 'false';
-  body.textContent = _modalDocContext.content; // revert
+  body.innerHTML = renderMd(_modalDocContext.content); // revert (render Markdown, not raw text)
   body.style.border = '';
   body.style.padding = '';
   document.getElementById('modal-edit-btn').style.display = '';

package/dashboard/js/render-kb.js

@@ -62,7 +62,7 @@ function renderKnowledgeBase() {
       if (!Array.isArray(catItems)) continue;
       for (const item of catItems) items.push({ ...item, category: cat });
     }
-    items.sort((a, b) => b.date.localeCompare(a.date));
+    items.sort((a, b) => (b.date || '').localeCompare(a.date || ''));
   } else {
     items = (_kbData[_kbActiveTab] || []).map(i => ({ ...i, category: _kbActiveTab }));
   }

package/dashboard/js/render-plans.js

@@ -400,7 +400,11 @@ function _renderPlanModal(normalizedFile, raw, lastMod) {
   let text = '';
 
   if (normalizedFile.endsWith('.json')) {
-    const plan = JSON.parse(raw);
+    let plan;
+    try { plan = JSON.parse(raw); } catch (e) {
+      document.getElementById('modal-body').innerHTML = '<p style="color:var(--red)">Failed to parse plan JSON: ' + escHtml(e.message) + '</p><pre style="font-size:10px;max-height:200px;overflow:auto">' + escHtml((raw || '').slice(0, 500)) + '</pre>';
+      return;
+    }
     title = plan.plan_summary || normalizedFile;
     const items = (plan.missing_features || []).map((f, i) =>
       (i + 1) + '. [' + f.id + '] ' + f.name + ' (' + (f.estimated_complexity || '?') + ', ' + (f.priority || '?') + ')' +

package/dashboard/js/render-prd.js

@@ -550,7 +550,14 @@ function showArchivedPrdDetail(idxOrFile) {
 }
 
 async function prdItemEdit(source, itemId) {
-  const item = _prdItems.find(i => i.source === source && i.id === itemId);
+  let item = _prdItems.find(i => i.source === source && i.id === itemId);
+  // Also search archived groups if not found in active items
+  if (!item && window._archivedPrdGroups) {
+    for (const g of window._archivedPrdGroups) {
+      item = (g.items || []).find(i => i.source === source && i.id === itemId);
+      if (item) break;
+    }
+  }
   if (!item) return;
 
   // Look up work item and dispatch completion info

package/dashboard/js/render-work-items.js

@@ -151,14 +151,14 @@ function editWorkItem(id, source) {
       '</label>' +
       '<div style="display:flex;justify-content:flex-end;gap:8px;margin-top:8px">' +
         '<button onclick="closeModal()" class="pr-pager-btn" style="padding:6px 16px;font-size:var(--text-md)">Cancel</button>' +
-        '<button onclick="submitWorkItemEdit(\'' + escHtml(id) + '\',\'' + escHtml(source || '') + '\')" style="padding:6px 16px;font-size:var(--text-md);background:var(--blue);color:#fff;border:none;border-radius:var(--radius-sm);cursor:pointer">Save</button>' +
+        '<button onclick="submitWorkItemEdit(\'' + escHtml(id) + '\',\'' + escHtml(source || '') + '\',event)" style="padding:6px 16px;font-size:var(--text-md);background:var(--blue);color:#fff;border:none;border-radius:var(--radius-sm);cursor:pointer">Save</button>' +
       '</div>' +
     '</div>';
   document.getElementById('modal').classList.add('open');
 }
 
-async function submitWorkItemEdit(id, source) {
-  var btn = event?.target; if (btn) { btn.disabled = true; btn.textContent = 'Saving...'; }
+async function submitWorkItemEdit(id, source, e) {
+  var btn = (e || window.event)?.target; if (btn) { btn.disabled = true; btn.textContent = 'Saving...'; }
   const title = document.getElementById('wi-edit-title').value.trim();
   const description = document.getElementById('wi-edit-desc').value;
   const type = document.getElementById('wi-edit-type').value;
@@ -320,7 +320,7 @@ function openCreateWorkItemModal() {
   const typeOpts = ['implement', 'fix', 'explore', 'test', 'review', 'ask', 'plan', 'verify', 'decompose', 'meeting'].map(t =>
     '<option value="' + t + '"' + (t === 'implement' ? ' selected' : '') + '>' + t + '</option>'
   ).join('');
-  const priOpts = ['high', 'medium', 'low'].map(p =>
+  const priOpts = ['critical', 'high', 'medium', 'low'].map(p =>
     '<option value="' + p + '"' + (p === 'medium' ? ' selected' : '') + '>' + p + '</option>'
   ).join('');
   const agentOpts = (typeof cmdAgents !== 'undefined' ? cmdAgents : []).map(a =>
@@ -349,7 +349,7 @@ function openCreateWorkItemModal() {
       '<label id="wi-new-skippr-row" style="color:var(--text);font-size:var(--text-md);display:flex;gap:8px;align-items:center;cursor:pointer"><input type="checkbox" id="wi-new-skippr"> Skip PR creation (push branch only)</label>' +
       '<div style="display:flex;justify-content:flex-end;gap:8px;margin-top:4px">' +
         '<button onclick="closeModal()" class="pr-pager-btn">Cancel</button>' +
-        '<button onclick="_submitCreateWorkItem()" style="padding:6px 16px;background:var(--blue);color:#fff;border:none;border-radius:var(--radius-sm);cursor:pointer">Create</button>' +
+        '<button onclick="_submitCreateWorkItem(event)" style="padding:6px 16px;background:var(--blue);color:#fff;border:none;border-radius:var(--radius-sm);cursor:pointer">Create</button>' +
       '</div>' +
     '</div>';
   document.getElementById('modal').classList.add('open');
@@ -365,8 +365,8 @@ function openCreateWorkItemModal() {
   setTimeout(() => document.getElementById('wi-new-title')?.focus(), 100);
 }
 
-async function _submitCreateWorkItem() {
-  var btn = event?.target; if (btn) { btn.disabled = true; btn.textContent = 'Creating...'; }
+async function _submitCreateWorkItem(e) {
+  var btn = (e || window.event)?.target; if (btn) { btn.disabled = true; btn.textContent = 'Creating...'; }
   const title = document.getElementById('wi-new-title')?.value?.trim();
   if (!title) { if (btn) { btn.disabled = false; btn.textContent = 'Create'; } alert('Title is required'); return; }
   const desc = document.getElementById('wi-new-desc')?.value || '';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yemi33/minions",
-  "version": "0.1.366",
+  "version": "0.1.368",
   "description": "Multi-agent AI dev team that runs from ~/.minions/ — five autonomous agents share a single engine, dashboard, and knowledge base",
   "bin": {
     "minions": "bin/minions.js"