agentgui 1.0.790 → 1.0.792

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentgui",
-  "version": "1.0.790",
+  "version": "1.0.792",
   "description": "Multi-agent ACP client with real-time communication",
   "type": "module",
   "main": "electron/main.js",

package/static/js/client.js

@@ -1379,9 +1379,11 @@ class AgentGUIClient {
     }
 
     outputEl.querySelectorAll('p.text-secondary').forEach(p => p.remove());
+    const safeRole = this.escapeHtml(data.message.role || 'user');
+    const safeId = this.escapeHtml(data.message.id || '');
     const messageHtml = `
-      <div class="message message-${data.message.role}" data-msg-id="${data.message.id}">
-        <div class="message-role">${data.message.role.charAt(0).toUpperCase() + data.message.role.slice(1)}</div>
+      <div class="message message-${safeRole}" data-msg-id="${safeId}">
+        <div class="message-role">${safeRole.charAt(0).toUpperCase() + safeRole.slice(1)}</div>
         ${this.renderMessageContent(data.message.content)}
         <div class="message-timestamp">${new Date(data.message.created_at).toLocaleString()}</div>
       </div>
@@ -1893,7 +1895,9 @@ class AgentGUIClient {
       const dedupedChunks = chunks.filter(c => !seenSeqs || !seenSeqs.has(c.sequence));
 
       if (dedupedChunks.length > 0) {
-        for (const chunk of dedupedChunks) this.renderChunk(chunk);
+        for (const chunk of dedupedChunks) {
+          try { this.renderChunk(chunk); } catch (chunkErr) { console.warn('Skipping bad chunk:', chunkErr.message); }
+        }
       }
     } catch (e) {
       console.warn('Chunk recovery failed:', e.message);
@@ -2229,7 +2233,7 @@ class AgentGUIClient {
         const uDiv = document.createElement('div');
         uDiv.className = 'message message-user';
         uDiv.setAttribute('data-msg-id', m.id);
-        uDiv.innerHTML = `<div class="message-role">User<button class="msg-edit-btn" data-edit-msg="${m.id}" title="Edit and re-run">&#9998;</button></div>${this.renderMessageContent(m.content)}<div class="message-timestamp">${new Date(m.created_at).toLocaleString()}</div>`;
+        uDiv.innerHTML = `<div class="message-role">User<button class="msg-edit-btn" data-edit-msg="${this.escapeHtml(m.id)}" title="Edit and re-run">&#9998;</button></div>${this.renderMessageContent(m.content)}<div class="message-timestamp">${new Date(m.created_at).toLocaleString()}</div>`;
         frag.appendChild(uDiv);
       }
       const isActive = sid === activeSessionId;
@@ -2266,7 +2270,7 @@ class AgentGUIClient {
       const uDiv = document.createElement('div');
       uDiv.className = 'message message-user';
       uDiv.setAttribute('data-msg-id', m.id);
-      uDiv.innerHTML = `<div class="message-role">User</div>${this.renderMessageContent(m.content)}<div class="message-timestamp">${new Date(m.created_at).toLocaleString()}</div>`;
+      uDiv.innerHTML = `<div class="message-role">User<button class="msg-edit-btn" data-edit-msg="${this.escapeHtml(m.id)}" title="Edit and re-run">&#9998;</button></div>${this.renderMessageContent(m.content)}<div class="message-timestamp">${new Date(m.created_at).toLocaleString()}</div>`;
       frag.appendChild(uDiv);
     }
     messagesContainer.appendChild(frag);

package/static/js/streaming-renderer.js

@@ -1425,7 +1425,7 @@ class StreamingRenderer {
     div.innerHTML = `
       <div style="display:flex;align-items:center;gap:0.5rem;padding:0.25rem 0.5rem;font-size:0.75rem;color:var(--color-text-secondary)">
         ${statusIcons[status] || statusIcons.pending}
-        <span>${statusLabels[status] || status}</span>
+        <span>${statusLabels[status] || this.escapeHtml(status)}</span>
       </div>
     `;
     return div;