@yemi33/minions 0.1.578 → 0.1.579

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/CHANGELOG.md CHANGED
@@ -1,5 +1,10 @@
1
1
  # Changelog
2
2
 
3
+ ## 0.1.579 (2026-04-08)
4
+
5
+ ### Fixes
6
+ - CC response renderer HTML-escape before innerHTML injection (closes #506) (#525)
7
+
3
8
  ## 0.1.578 (2026-04-08)
4
9
 
5
10
  ### Other
package/dashboard.html CHANGED
@@ -4732,10 +4732,11 @@ async function _ccDoSend(message, skipUserMsg) {
4732
4732
  ccUpdateSessionIndicator();
4733
4733
  }
4734
4734
 
4735
- // Render markdown-ish response
4735
+ // Render markdown-ish response (HTML-escape first to prevent XSS + broken rendering)
4736
4736
  const ccElapsed = Math.round((Date.now() - ccStartTime) / 1000);
4737
- const rendered = (data.text || '').replace(/\*\*(.+?)\*\*/g, '<strong>$1</strong>')
4738
- .replace(/`([^`]+)`/g, '<code style="background:var(--surface);padding:1px 4px;border-radius:3px;font-size:11px">$1</code>')
4737
+ const safe = escHtml(data.text || '');
4738
+ const rendered = safe.replace(/\*\*([^*\n]+)\*\*/g, '<strong>$1</strong>')
4739
+ .replace(/`([^`\n]+)`/g, '<code style="background:var(--surface);padding:1px 4px;border-radius:3px;font-size:11px">$1</code>')
4739
4740
  .replace(/\n/g, '<br>');
4740
4741
  ccAddMessage('assistant', rendered + '<div style="font-size:9px;color:var(--muted);margin-top:4px;text-align:right">' + ccElapsed + 's</div>');
4741
4742
 
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@yemi33/minions",
3
- "version": "0.1.578",
3
+ "version": "0.1.579",
4
4
  "description": "Multi-agent AI dev team that runs from ~/.minions/ — five autonomous agents share a single engine, dashboard, and knowledge base",
5
5
  "bin": {
6
6
  "minions": "bin/minions.js"