@yemi33/minions 0.1.577 → 0.1.579

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## 0.1.579 (2026-04-08)
+
+### Fixes
+-  CC response renderer HTML-escape before innerHTML injection (closes #506) (#525)
+
+## 0.1.578 (2026-04-08)
+
+### Other
+- refactor: extract _spawnProcess helper, fix dep fetch error tracking, cleanup file leak
+
 ## 0.1.577 (2026-04-08)
 
 ### Other

package/dashboard.html

@@ -4732,10 +4732,11 @@ async function _ccDoSend(message, skipUserMsg) {
       ccUpdateSessionIndicator();
     }
 
-    // Render markdown-ish response
+    // Render markdown-ish response (HTML-escape first to prevent XSS + broken rendering)
     const ccElapsed = Math.round((Date.now() - ccStartTime) / 1000);
-    const rendered = (data.text || '').replace(/\*\*(.+?)\*\*/g, '<strong>$1</strong>')
-      .replace(/`([^`]+)`/g, '<code style="background:var(--surface);padding:1px 4px;border-radius:3px;font-size:11px">$1</code>')
+    const safe = escHtml(data.text || '');
+    const rendered = safe.replace(/\*\*([^*\n]+)\*\*/g, '<strong>$1</strong>')
+      .replace(/`([^`\n]+)`/g, '<code style="background:var(--surface);padding:1px 4px;border-radius:3px;font-size:11px">$1</code>')
       .replace(/\n/g, '<br>');
     ccAddMessage('assistant', rendered + '<div style="font-size:9px;color:var(--muted);margin-top:4px;text-align:right">' + ccElapsed + 's</div>');
 

package/engine/llm.js

@@ -68,54 +68,62 @@ function _buildCliArgs({ model, maxTurns, allowedTools, effort, sessionId, sysPr
   return args;
 }
 
+/**
+ * Spawn a claude CLI process. Returns { proc, cleanupFiles } or null if binary not cached.
+ * When direct=true, spawns claude CLI directly (fewer syscalls). Otherwise uses spawn-agent.js.
+ */
+function _spawnProcess(promptText, sysPromptText, { direct, label, model, maxTurns, allowedTools, effort, sessionId }) {
+  const fs = require('fs');
+  const id = uid();
+  const tmpDir = path.join(ENGINE_DIR, 'tmp');
+  if (!fs.existsSync(tmpDir)) fs.mkdirSync(tmpDir, { recursive: true });
+
+  const cleanupFiles = [];
+  const resolved = direct ? _resolveClaudeBin() : null;
+
+  if (resolved) {
+    let sysTmpPath = null;
+    if (!sessionId && sysPromptText) {
+      sysTmpPath = path.join(tmpDir, `direct-sys-${id}.md`);
+      fs.writeFileSync(sysTmpPath, sysPromptText);
+      cleanupFiles.push(sysTmpPath);
+    }
+    const cliArgs = _buildCliArgs({ model, maxTurns, allowedTools, effort, sessionId, sysPromptFile: sysTmpPath });
+    const proc = resolved.native
+      ? runFile(resolved.bin, cliArgs, { cwd: MINIONS_DIR, stdio: ['pipe', 'pipe', 'pipe'], env: cleanChildEnv() })
+      : runFile(process.execPath, [resolved.bin, ...cliArgs], { cwd: MINIONS_DIR, stdio: ['pipe', 'pipe', 'pipe'], env: cleanChildEnv() });
+    try { proc.stdin.write(promptText); proc.stdin.end(); } catch { /* broken pipe */ }
+    return { proc, cleanupFiles };
+  }
+
+  // Indirect: use spawn-agent.js
+  const promptPath = path.join(tmpDir, `${label}-prompt-${id}.md`);
+  const sysPath = path.join(tmpDir, `${label}-sys-${id}.md`);
+  safeWrite(promptPath, promptText);
+  safeWrite(sysPath, sysPromptText || '');
+  cleanupFiles.push(promptPath, sysPath);
+
+  const spawnScript = path.join(ENGINE_DIR, 'spawn-agent.js');
+  const args = [
+    spawnScript, promptPath, sysPath,
+    '--output-format', 'stream-json', '--max-turns', String(maxTurns), '--model', model,
+    '--verbose',
+  ];
+  if (allowedTools) args.push('--allowedTools', allowedTools);
+  if (effort) args.push('--effort', effort);
+  args.push('--permission-mode', 'bypassPermissions');
+  if (sessionId) args.push('--resume', sessionId);
+
+  const proc = runFile(process.execPath, args, { cwd: MINIONS_DIR, stdio: ['pipe', 'pipe', 'pipe'], env: cleanChildEnv() });
+  return { proc, cleanupFiles };
+}
+
 // ── Core LLM Call ───────────────────────────────────────────────────────────
 
 function callLLM(promptText, sysPromptText, { timeout = 120000, label = 'llm', model = 'sonnet', maxTurns = 1, allowedTools = '', sessionId = null, effort = null, direct = false } = {}) {
   return new Promise((resolve) => {
     const _startMs = Date.now();
-    const fs = require('fs');
-    const id = uid();
-    const tmpDir = path.join(ENGINE_DIR, 'tmp');
-    if (!fs.existsSync(tmpDir)) fs.mkdirSync(tmpDir, { recursive: true });
-
-    let proc;
-    const cleanupFiles = [];
-    const resolved = direct ? _resolveClaudeBin() : null;
-
-    if (resolved) {
-      // Direct spawn: skip spawn-agent.js — fewer file syscalls, no extra process
-      let sysTmpPath = null;
-      if (!sessionId && sysPromptText) {
-        sysTmpPath = path.join(tmpDir, `direct-sys-${id}.md`);
-        fs.writeFileSync(sysTmpPath, sysPromptText);
-        cleanupFiles.push(sysTmpPath);
-      }
-      const cliArgs = _buildCliArgs({ model, maxTurns, allowedTools, effort, sessionId, sysPromptFile: sysTmpPath });
-      proc = resolved.native
-        ? runFile(resolved.bin, cliArgs, { cwd: MINIONS_DIR, stdio: ['pipe', 'pipe', 'pipe'], env: cleanChildEnv() })
-        : runFile(process.execPath, [resolved.bin, ...cliArgs], { cwd: MINIONS_DIR, stdio: ['pipe', 'pipe', 'pipe'], env: cleanChildEnv() });
-      try { proc.stdin.write(promptText); proc.stdin.end(); } catch { /* broken pipe */ }
-    } else {
-      // Indirect: use spawn-agent.js (for agent dispatches or if binary not cached)
-      const promptPath = path.join(tmpDir, `${label}-prompt-${id}.md`);
-      const sysPath = path.join(tmpDir, `${label}-sys-${id}.md`);
-      safeWrite(promptPath, promptText);
-      safeWrite(sysPath, sysPromptText || '');
-      cleanupFiles.push(promptPath, sysPath);
-
-      const spawnScript = path.join(ENGINE_DIR, 'spawn-agent.js');
-      const args = [
-        spawnScript, promptPath, sysPath,
-        '--output-format', 'stream-json', '--max-turns', String(maxTurns), '--model', model,
-        '--verbose',
-      ];
-      if (allowedTools) args.push('--allowedTools', allowedTools);
-      if (effort) args.push('--effort', effort);
-      args.push('--permission-mode', 'bypassPermissions');
-      if (sessionId) args.push('--resume', sessionId);
-
-      proc = runFile(process.execPath, args, { cwd: MINIONS_DIR, stdio: ['pipe', 'pipe', 'pipe'], env: cleanChildEnv() });
-    }
+    const { proc, cleanupFiles } = _spawnProcess(promptText, sysPromptText, { direct, label, model, maxTurns, allowedTools, effort, sessionId });
 
     let stdout = '';
     let stderr = '';
@@ -167,47 +175,7 @@ function callLLMStreaming(promptText, sysPromptText, { timeout = 120000, label =
   let _abort = null;
   const promise = new Promise((resolve) => {
     const _startMs = Date.now();
-    const fs = require('fs');
-    const id = uid();
-    const tmpDir = path.join(ENGINE_DIR, 'tmp');
-    if (!fs.existsSync(tmpDir)) fs.mkdirSync(tmpDir, { recursive: true });
-
-    let proc;
-    const cleanupFiles = [];
-    const resolved = direct ? _resolveClaudeBin() : null;
-
-    if (resolved) {
-      let sysTmpPath = null;
-      if (!sessionId && sysPromptText) {
-        sysTmpPath = path.join(tmpDir, `direct-sys-${id}.md`);
-        fs.writeFileSync(sysTmpPath, sysPromptText);
-        cleanupFiles.push(sysTmpPath);
-      }
-      const cliArgs = _buildCliArgs({ model, maxTurns, allowedTools, effort, sessionId, sysPromptFile: sysTmpPath });
-      proc = resolved.native
-        ? runFile(resolved.bin, cliArgs, { cwd: MINIONS_DIR, stdio: ['pipe', 'pipe', 'pipe'], env: cleanChildEnv() })
-        : runFile(process.execPath, [resolved.bin, ...cliArgs], { cwd: MINIONS_DIR, stdio: ['pipe', 'pipe', 'pipe'], env: cleanChildEnv() });
-      try { proc.stdin.write(promptText); proc.stdin.end(); } catch { /* broken pipe */ }
-    } else {
-      const promptPath = path.join(tmpDir, `${label}-prompt-${id}.md`);
-      const sysPath = path.join(tmpDir, `${label}-sys-${id}.md`);
-      safeWrite(promptPath, promptText);
-      safeWrite(sysPath, sysPromptText || '');
-      cleanupFiles.push(promptPath, sysPath);
-
-      const spawnScript = path.join(ENGINE_DIR, 'spawn-agent.js');
-      const args = [
-        spawnScript, promptPath, sysPath,
-        '--output-format', 'stream-json', '--max-turns', String(maxTurns), '--model', model,
-        '--verbose',
-      ];
-      if (allowedTools) args.push('--allowedTools', allowedTools);
-      if (effort) args.push('--effort', effort);
-      args.push('--permission-mode', 'bypassPermissions');
-      if (sessionId) args.push('--resume', sessionId);
-
-      proc = runFile(process.execPath, args, { cwd: MINIONS_DIR, stdio: ['pipe', 'pipe', 'pipe'], env: cleanChildEnv() });
-    }
+    const { proc, cleanupFiles } = _spawnProcess(promptText, sysPromptText, { direct, label, model, maxTurns, allowedTools, effort, sessionId });
 
     _abort = () => { shared.killImmediate(proc); };
 

package/engine.js

@@ -292,6 +292,7 @@ async function spawnAgent(dispatchItem, config) {
   safeWrite(promptPath, fullTaskPrompt);
   const sysPromptPath = path.join(tmpDir, `sysprompt-${safeId}.md`);
   safeWrite(sysPromptPath, systemPrompt);
+  const _cleanupPromptFiles = () => { safeUnlink(promptPath); safeUnlink(sysPromptPath); };
 
   if (branchName) {
     const wtSuffix = id ? id.split('-').pop() : shared.uid();
@@ -440,11 +441,11 @@ async function spawnAgent(dispatchItem, config) {
               execAsync(`git fetch origin "${depBranch}"`, { ..._gitOpts, cwd: rootDir }).then(() => depBranch)
             )
           );
-          for (const r of fetchResults) {
-            if (r.status === 'rejected') {
-              const failedBranch = fetchable.find(d => r.reason?.message?.includes(d.branch))?.branch || 'unknown';
+          for (let i = 0; i < fetchResults.length; i++) {
+            if (fetchResults[i].status === 'rejected') {
+              const failedBranch = fetchable[i].branch;
               _failedRefCache.add(failedBranch);
-              log('warn', `Failed to fetch dependency ${failedBranch}: ${r.reason?.message}`);
+              log('warn', `Failed to fetch dependency ${failedBranch}: ${fetchResults[i].reason?.message}`);
               depMergeFailed = true;
             }
           }
@@ -462,6 +463,7 @@ async function spawnAgent(dispatchItem, config) {
             }
           }
           if (depMergeFailed) {
+            _cleanupPromptFiles();
             completeDispatch(id, DISPATCH_RESULT.ERROR, `Dependency merge failed — will retry next tick`);
             return;
           }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yemi33/minions",
-  "version": "0.1.577",
+  "version": "0.1.579",
   "description": "Multi-agent AI dev team that runs from ~/.minions/ — five autonomous agents share a single engine, dashboard, and knowledge base",
   "bin": {
     "minions": "bin/minions.js"