agentgui 1.0.791 → 1.0.793

package/lib/routes-util.js

@@ -57,7 +57,11 @@ export function register(deps) {
     const body = await parseBody(req);
     const folderPath = body.path || STARTUP_CWD;
     try {
-      const expandedPath = folderPath.startsWith('~') ? folderPath.replace('~', os.homedir()) : folderPath;
+      const expandedPath = path.resolve(folderPath.startsWith('~') ? folderPath.replace('~', os.homedir()) : folderPath);
+      if (!expandedPath.startsWith(os.homedir()) && !expandedPath.startsWith(STARTUP_CWD) && expandedPath !== '/') {
+        sendJSON(req, res, 403, { error: 'Path outside allowed directories' });
+        return;
+      }
       const entries = fs.readdirSync(expandedPath, { withFileTypes: true });
       const folders = entries
         .filter(e => e.isDirectory() && !e.name.startsWith('.'))

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentgui",
-  "version": "1.0.791",
+  "version": "1.0.793",
   "description": "Multi-agent ACP client with real-time communication",
   "type": "module",
   "main": "electron/main.js",

package/static/js/client.js

@@ -2233,7 +2233,7 @@ class AgentGUIClient {
         const uDiv = document.createElement('div');
         uDiv.className = 'message message-user';
         uDiv.setAttribute('data-msg-id', m.id);
-        uDiv.innerHTML = `<div class="message-role">User<button class="msg-edit-btn" data-edit-msg="${m.id}" title="Edit and re-run">&#9998;</button></div>${this.renderMessageContent(m.content)}<div class="message-timestamp">${new Date(m.created_at).toLocaleString()}</div>`;
+        uDiv.innerHTML = `<div class="message-role">User<button class="msg-edit-btn" data-edit-msg="${this.escapeHtml(m.id)}" title="Edit and re-run">&#9998;</button></div>${this.renderMessageContent(m.content)}<div class="message-timestamp">${new Date(m.created_at).toLocaleString()}</div>`;
         frag.appendChild(uDiv);
       }
       const isActive = sid === activeSessionId;
@@ -2270,7 +2270,7 @@ class AgentGUIClient {
       const uDiv = document.createElement('div');
       uDiv.className = 'message message-user';
       uDiv.setAttribute('data-msg-id', m.id);
-      uDiv.innerHTML = `<div class="message-role">User</div>${this.renderMessageContent(m.content)}<div class="message-timestamp">${new Date(m.created_at).toLocaleString()}</div>`;
+      uDiv.innerHTML = `<div class="message-role">User<button class="msg-edit-btn" data-edit-msg="${this.escapeHtml(m.id)}" title="Edit and re-run">&#9998;</button></div>${this.renderMessageContent(m.content)}<div class="message-timestamp">${new Date(m.created_at).toLocaleString()}</div>`;
       frag.appendChild(uDiv);
     }
     messagesContainer.appendChild(frag);

package/static/js/streaming-renderer.js

@@ -1425,7 +1425,7 @@ class StreamingRenderer {
     div.innerHTML = `
       <div style="display:flex;align-items:center;gap:0.5rem;padding:0.25rem 0.5rem;font-size:0.75rem;color:var(--color-text-secondary)">
         ${statusIcons[status] || statusIcons.pending}
-        <span>${statusLabels[status] || status}</span>
+        <span>${statusLabels[status] || this.escapeHtml(status)}</span>
       </div>
     `;
     return div;