@yemi33/minions 0.1.578 → 0.1.580

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## 0.1.580 (2026-04-08)
+
+### Fixes
+-  cleanup prompt files on worktree failure, add TTL to binary cache
+-  CC response renderer HTML-escape before innerHTML injection (closes #506) (#525)
+
 ## 0.1.578 (2026-04-08)
 
 ### Other

package/dashboard.html

@@ -4732,10 +4732,11 @@ async function _ccDoSend(message, skipUserMsg) {
       ccUpdateSessionIndicator();
     }
 
-    // Render markdown-ish response
+    // Render markdown-ish response (HTML-escape first to prevent XSS + broken rendering)
     const ccElapsed = Math.round((Date.now() - ccStartTime) / 1000);
-    const rendered = (data.text || '').replace(/\*\*(.+?)\*\*/g, '<strong>$1</strong>')
-      .replace(/`([^`]+)`/g, '<code style="background:var(--surface);padding:1px 4px;border-radius:3px;font-size:11px">$1</code>')
+    const safe = escHtml(data.text || '');
+    const rendered = safe.replace(/\*\*([^*\n]+)\*\*/g, '<strong>$1</strong>')
+      .replace(/`([^`\n]+)`/g, '<code style="background:var(--surface);padding:1px 4px;border-radius:3px;font-size:11px">$1</code>')
       .replace(/\n/g, '<br>');
     ccAddMessage('assistant', rendered + '<div style="font-size:9px;color:var(--muted);margin-top:4px;text-align:right">' + ccElapsed + 's</div>');
 

package/engine/llm.js

@@ -46,11 +46,15 @@ function trackEngineUsage(category, usage) {
 // ── Claude Binary Resolution (cached by spawn-agent.js) ─────────────────────
 
 let _claudeBinCache = null;
+let _claudeBinCacheTs = 0;
+const _CLAUDE_BIN_TTL = 300000; // 5 min — re-validate binary exists periodically
 function _resolveClaudeBin() {
-  if (_claudeBinCache) return _claudeBinCache;
+  if (_claudeBinCache && Date.now() - _claudeBinCacheTs < _CLAUDE_BIN_TTL) return _claudeBinCache;
+  _claudeBinCache = null;
   const caps = shared.safeJson(path.join(ENGINE_DIR, 'claude-caps.json'));
   if (caps?.claudeBin && require('fs').existsSync(caps.claudeBin)) {
     _claudeBinCache = { bin: caps.claudeBin, native: !!caps.claudeIsNative };
+    _claudeBinCacheTs = Date.now();
     return _claudeBinCache;
   }
   return null;

package/engine.js

@@ -415,6 +415,7 @@ async function spawnAgent(dispatchItem, config) {
           log('warn', `Proceeding with recovered worktree after add failure for ${branchName}`);
         } else {
           log('error', `Failed to create worktree for ${branchName}: ${err.message}${err.stderr ? '\n' + err.stderr.toString().slice(0, 500) : ''}`);
+          _cleanupPromptFiles();
           completeDispatch(id, DISPATCH_RESULT.ERROR, 'Worktree creation failed: ' + (err.message || '').slice(0, 200));
           return null;
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yemi33/minions",
-  "version": "0.1.578",
+  "version": "0.1.580",
   "description": "Multi-agent AI dev team that runs from ~/.minions/ — five autonomous agents share a single engine, dashboard, and knowledge base",
   "bin": {
     "minions": "bin/minions.js"