bigpowers 2.88.17 → 2.88.18

package/.gemini/extensions/bigpowers/gemini-extension.json

@@ -1,6 +1,6 @@
 {
   "name": "bigpowers",
-  "version": "2.88.17",
+  "version": "2.88.18",
   "description": "81 skills — 73 agent skills synthesizing 17 years of software engineering discipline into a prescriptive methodology for solo developers",
   "keywords": [
     "gemini-extension"

package/.pi/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bigpowers",
-  "version": "2.88.17",
+  "version": "2.88.18",
   "description": "81 skills — 73 agent skills synthesizing 17 years of software engineering discipline into a prescriptive methodology for solo developers",
   "keywords": [
     "pi-package"

package/CHANGELOG.md

@@ -1,3 +1,14 @@
+## [2.88.18](https://github.com/danielvm-git/bigpowers/compare/v2.88.17...v2.88.18) (2026-11-02)
+
+
+### Bug Fixes
+
+* **dashboard:** bind the project dashboard to loopback ([#175](https://github.com/danielvm-git/bigpowers/issues/175)) ([b796b17](https://github.com/danielvm-git/bigpowers/commit/b796b17f3b077a36d725018d3ad6f2fb5cc0426f))
+* **dashboard:** escape project metadata before rendering HTML ([#178](https://github.com/danielvm-git/bigpowers/issues/178)) ([f905d5b](https://github.com/danielvm-git/bigpowers/commit/f905d5b30753e715d8675401aeceefa98d850476))
+* **mcp:** filter every diff before returning its contents ([#174](https://github.com/danielvm-git/bigpowers/issues/174)) ([d0b9f70](https://github.com/danielvm-git/bigpowers/commit/d0b9f70a7319d396858890e2abfa1253b68837ff))
+* **migrate:** treat version metadata and preview paths as data ([#177](https://github.com/danielvm-git/bigpowers/issues/177)) ([2b0649c](https://github.com/danielvm-git/bigpowers/commit/2b0649c0a8723695e2c1f078112bca3993b8b383))
+* **scripts:** escape AGENTS commands when emitting Bash exports ([#176](https://github.com/danielvm-git/bigpowers/issues/176)) ([1800dd5](https://github.com/danielvm-git/bigpowers/commit/1800dd5f682cb98afdbbdce06cbcc8cae2a6eb9f))
+
 ## [2.88.17](https://github.com/danielvm-git/bigpowers/compare/v2.88.16...v2.88.17) (2026-10-30)
 
 

package/bigpowers-mcp/build/lib/git-context.js

@@ -6,17 +6,15 @@ import { GIT_SCOPE_DIRS } from "../config.js";
 import { isSecretPath } from "./paths.js";
 function inScope(filePath) {
     const norm = filePath.replace(/\\/g, "/");
-    if (isSecretPath(norm))
-        return false;
-    return GIT_SCOPE_DIRS.some((d) => norm === d || norm.startsWith(`${d}/`));
+    if (isSecretPath(norm)) return false;
+    return GIT_SCOPE_DIRS.some((d)=>norm === d || norm.startsWith(`${d}/`));
 }
 function groupByDir(files) {
     const grouped = {};
-    for (const f of files) {
+    for (const f of files){
         const parts = f.split("/");
         const dir = parts.length > 1 ? parts[0] : ".";
-        if (!grouped[dir])
-            grouped[dir] = [];
+        if (!grouped[dir]) grouped[dir] = [];
         grouped[dir].push(f);
     }
     return grouped;
@@ -25,18 +23,20 @@ function git(repoRoot, args) {
     return execFileSync("git", args, {
         cwd: repoRoot,
         encoding: "utf8",
-        maxBuffer: 10 * 1024 * 1024,
+        maxBuffer: 10 * 1024 * 1024
     }).trim();
 }
 export function getGitContext(repoRoot, action) {
     if (action === "status") {
-        const out = git(repoRoot, ["status", "--porcelain"]);
-        const files = out
-            .split("\n")
-            .filter(Boolean)
-            .map((line) => line.slice(3).trim())
-            .filter(inScope);
-        return { action, changed_files: groupByDir(files) };
+        const out = git(repoRoot, [
+            "status",
+            "--porcelain"
+        ]);
+        const files = out.split("\n").filter(Boolean).map((line)=>line.slice(3).trim()).filter(inScope);
+        return {
+            action,
+            changed_files: groupByDir(files)
+        };
     }
     if (action === "log") {
         const out = git(repoRoot, [
@@ -45,48 +45,64 @@ export function getGitContext(repoRoot, action) {
             "--pretty=format:%H|%s",
             "--name-only",
             "--",
-            ...GIT_SCOPE_DIRS,
+            ...GIT_SCOPE_DIRS
         ]);
         const commits = [];
         let current = null;
-        for (const line of out.split("\n")) {
+        for (const line of out.split("\n")){
             if (line.includes("|")) {
-                if (current)
-                    commits.push(current);
+                if (current) commits.push(current);
                 const [hash, subject] = line.split("|");
-                current = { hash, subject, files: [] };
-            }
-            else if (line.trim() && current && inScope(line.trim())) {
+                current = {
+                    hash,
+                    subject,
+                    files: []
+                };
+            } else if (line.trim() && current && inScope(line.trim())) {
                 current.files.push(line.trim());
             }
         }
-        if (current)
-            commits.push(current);
-        return { action, changed_files: {}, commits };
+        if (current) commits.push(current);
+        return {
+            action,
+            changed_files: {},
+            commits
+        };
     }
-    const diffOut = git(repoRoot, ["diff", "--", ...GIT_SCOPE_DIRS]);
+    const diffOut = git(repoRoot, [
+        "diff",
+        "--",
+        ...GIT_SCOPE_DIRS
+    ]);
     const diffs = {};
     let currentFile = "";
     let buf = [];
-    for (const line of diffOut.split("\n")) {
+    const flushDiff = ()=>{
+        if (currentFile && buf.length && inScope(currentFile)) {
+            diffs[currentFile] = buf.join("\n");
+        }
+    };
+    for (const line of diffOut.split("\n")){
         if (line.startsWith("diff --git")) {
-            if (currentFile && buf.length)
-                diffs[currentFile] = buf.join("\n");
+            flushDiff();
             const match = / b\/(.+)$/.exec(line);
             currentFile = match?.[1] ?? "";
-            buf = [line];
-        }
-        else {
+            buf = [
+                line
+            ];
+        } else {
             buf.push(line);
         }
     }
-    if (currentFile && buf.length && inScope(currentFile) && !isSecretPath(currentFile)) {
-        diffs[currentFile] = buf.join("\n");
-    }
+    flushDiff();
     const changed = Object.keys(diffs);
-    return { action, changed_files: groupByDir(changed), diffs };
+    return {
+        action,
+        changed_files: groupByDir(changed),
+        diffs
+    };
 }
 export function isGitRepo(repoRoot) {
     return fs.existsSync(path.join(repoRoot, ".git"));
 }
-//# sourceMappingURL=git-context.js.map
+//# sourceMappingURL=git-context.js.map

package/bigpowers-mcp/build/lib/git-context.js.map

@@ -1 +1 @@
-{"version":3,"file":"git-context.js","sourceRoot":"","sources":["../../src/lib/git-context.ts"],"names":[],"mappings":"AAAA,gBAAgB;AAChB,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,cAAc,EAAmB,MAAM,cAAc,CAAC;AAC/D,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAS1C,SAAS,OAAO,CAAC,QAAgB;IAC/B,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC1C,IAAI,YAAY,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACrC,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,KAAK,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;AAC5E,CAAC;AAED,SAAS,UAAU,CAAC,KAAe;IACjC,MAAM,OAAO,GAA6B,EAAE,CAAC;IAC7C,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC3B,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QAC9C,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC;QACrC,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,GAAG,CAAC,QAAgB,EAAE,IAAc;IAC3C,OAAO,YAAY,CAAC,KAAK,EAAE,IAAI,EAAE;QAC/B,GAAG,EAAE,QAAQ;QACb,QAAQ,EAAE,MAAM;QAChB,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;KAC5B,CAAC,CAAC,IAAI,EAAE,CAAC;AACZ,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,QAAgB,EAAE,MAAiC;IAC/E,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;QACxB,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC,CAAC;QACrD,MAAM,KAAK,GAAG,GAAG;aACd,KAAK,CAAC,IAAI,CAAC;aACX,MAAM,CAAC,OAAO,CAAC;aACf,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;aACnC,MAAM,CAAC,OAAO,CAAC,CAAC;QACnB,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;IACtD,CAAC;IAED,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;QACrB,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,EAAE;YACxB,KAAK;YACL,KAAK;YACL,uBAAuB;YACvB,aAAa;YACb,IAAI;YACJ,GAAG,cAAc;SAClB,CAAC,CAAC;QACH,MAAM,OAAO,GAAgC,EAAE,CAAC;QAChD,IAAI,OAAO,GAA8D,IAAI,CAAC;QAC9E,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACnC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBACvB,IAAI,OAAO;oBAAE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBACnC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBACxC,OAAO,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;YACzC,CAAC;iBAAM,IAAI,IAAI,CAAC,IAAI,EAAE,IAAI,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;gBAC1D,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;YAClC,CAAC;QACH,CAAC;QACD,IAAI,OAAO;YAAE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACnC,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC;IAChD,CAAC;IAED,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,cAAc,CAAC,CAAC,CAAC;IACjE,MAAM,KAAK,GAA2B,EAAE,CAAC;IACzC,IAAI,WAAW,GAAG,EAAE,CAAC;IACrB,IAAI,GAAG,GAAa,EAAE,CAAC;IACvB,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,IAAI,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;YAClC,IAAI,WAAW,IAAI,GAAG,CAAC,MAAM;gBAAE,KAAK,CAAC,WAAW,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACnE,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACrC,WAAW,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC/B,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;QACf,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjB,CAAC;IACH,CAAC;IACD,IAAI,WAAW,IAAI,GAAG,CAAC,MAAM,IAAI,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,EAAE,CAAC;QACpF,KAAK,CAAC,WAAW,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtC,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACnC,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,UAAU,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,CAAC;AAC/D,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,QAAgB;IACxC,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;AACpD,CAAC"}
+{"version":3,"sources":["../../src/lib/git-context.ts"],"names":[],"mappings":"AAAA,gBAAgB;AAChB,SAAS,YAAY,QAAQ,qBAAqB;AAClD,OAAO,QAAQ,UAAU;AACzB,OAAO,UAAU,YAAY;AAC7B,SAAS,cAAc,QAAQ,eAAe;AAC9C,SAAS,YAAY,QAAQ,aAAa;AAS1C,SAAS,QAAQ,QAAgB;IAC/B,MAAM,OAAO,SAAS,OAAO,CAAC,OAAO;IACrC,IAAI,aAAa,OAAO,OAAO;IAC/B,OAAO,eAAe,IAAI,CAAC,CAAC,IAAM,SAAS,KAAK,KAAK,UAAU,CAAC,GAAG,EAAE,CAAC,CAAC;AACzE;AAEA,SAAS,WAAW,KAAe;IACjC,MAAM,UAAoC,CAAC;IAC3C,KAAK,MAAM,KAAK,MAAO;QACrB,MAAM,QAAQ,EAAE,KAAK,CAAC;QACtB,MAAM,MAAM,MAAM,MAAM,GAAG,IAAI,KAAK,CAAC,EAAE,GAAG;QAC1C,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,GAAG,EAAE;QACpC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;IACpB;IACA,OAAO;AACT;AAEA,SAAS,IAAI,QAAgB,EAAE,IAAc;IAC3C,OAAO,aAAa,OAAO,MAAM;QAC/B,KAAK;QACL,UAAU;QACV,WAAW,KAAK,OAAO;IACzB,GAAG,IAAI;AACT;AAEA,OAAO,SAAS,cAAc,QAAgB,EAAE,MAAiC;IAC/E,IAAI,WAAW,UAAU;QACvB,MAAM,MAAM,IAAI,UAAU;YAAC;YAAU;SAAc;QACnD,MAAM,QAAQ,IACX,KAAK,CAAC,MACN,MAAM,CAAC,SACP,GAAG,CAAC,CAAC,OAAS,KAAK,KAAK,CAAC,GAAG,IAAI,IAChC,MAAM,CAAC;QACV,OAAO;YAAE;YAAQ,eAAe,WAAW;QAAO;IACpD;IAEA,IAAI,WAAW,OAAO;QACpB,MAAM,MAAM,IAAI,UAAU;YACxB;YACA;YACA;YACA;YACA;eACG;SACJ;QACD,MAAM,UAAuC,EAAE;QAC/C,IAAI,UAAqE;QACzE,KAAK,MAAM,QAAQ,IAAI,KAAK,CAAC,MAAO;YAClC,IAAI,KAAK,QAAQ,CAAC,MAAM;gBACtB,IAAI,SAAS,QAAQ,IAAI,CAAC;gBAC1B,MAAM,CAAC,MAAM,QAAQ,GAAG,KAAK,KAAK,CAAC;gBACnC,UAAU;oBAAE;oBAAM;oBAAS,OAAO,EAAE;gBAAC;YACvC,OAAO,IAAI,KAAK,IAAI,MAAM,WAAW,QAAQ,KAAK,IAAI,KAAK;gBACzD,QAAQ,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI;YAC9B;QACF;QACA,IAAI,SAAS,QAAQ,IAAI,CAAC;QAC1B,OAAO;YAAE;YAAQ,eAAe,CAAC;YAAG;QAAQ;IAC9C;IAEA,MAAM,UAAU,IAAI,UAAU;QAAC;QAAQ;WAAS;KAAe;IAC/D,MAAM,QAAgC,CAAC;IACvC,IAAI,cAAc;IAClB,IAAI,MAAgB,EAAE;IACtB,MAAM,YAAY;QAChB,IAAI,eAAe,IAAI,MAAM,IAAI,QAAQ,cAAc;YACrD,KAAK,CAAC,YAAY,GAAG,IAAI,IAAI,CAAC;QAChC;IACF;IACA,KAAK,MAAM,QAAQ,QAAQ,KAAK,CAAC,MAAO;QACtC,IAAI,KAAK,UAAU,CAAC,eAAe;YACjC;YACA,MAAM,QAAQ,YAAY,IAAI,CAAC;YAC/B,cAAc,OAAO,CAAC,EAAE,IAAI;YAC5B,MAAM;gBAAC;aAAK;QACd,OAAO;YACL,IAAI,IAAI,CAAC;QACX;IACF;IACA;IAEA,MAAM,UAAU,OAAO,IAAI,CAAC;IAC5B,OAAO;QAAE;QAAQ,eAAe,WAAW;QAAU;IAAM;AAC7D;AAEA,OAAO,SAAS,UAAU,QAAgB;IACxC,OAAO,GAAG,UAAU,CAAC,KAAK,IAAI,CAAC,UAAU;AAC3C","file":"git-context.js","sourceRoot":""}

package/bigpowers-mcp/src/lib/git-context.ts

@@ -2,7 +2,7 @@
 import { execFileSync } from "node:child_process";
 import fs from "node:fs";
 import path from "node:path";
-import { GIT_SCOPE_DIRS, SECRET_DENYLIST } from "../config.js";
+import { GIT_SCOPE_DIRS } from "../config.js";
 import { isSecretPath } from "./paths.js";
 
 export interface GitContextResult {
@@ -76,9 +76,14 @@ export function getGitContext(repoRoot: string, action: "status" | "log" | "diff
   const diffs: Record<string, string> = {};
   let currentFile = "";
   let buf: string[] = [];
+  const flushDiff = () => {
+    if (currentFile && buf.length && inScope(currentFile)) {
+      diffs[currentFile] = buf.join("\n");
+    }
+  };
   for (const line of diffOut.split("\n")) {
     if (line.startsWith("diff --git")) {
-      if (currentFile && buf.length) diffs[currentFile] = buf.join("\n");
+      flushDiff();
       const match = / b\/(.+)$/.exec(line);
       currentFile = match?.[1] ?? "";
       buf = [line];
@@ -86,9 +91,7 @@ export function getGitContext(repoRoot: string, action: "status" | "log" | "diff
       buf.push(line);
     }
   }
-  if (currentFile && buf.length && inScope(currentFile) && !isSecretPath(currentFile)) {
-    diffs[currentFile] = buf.join("\n");
-  }
+  flushDiff();
 
   const changed = Object.keys(diffs);
   return { action, changed_files: groupByDir(changed), diffs };
@@ -97,3 +100,4 @@ export function getGitContext(repoRoot: string, action: "status" | "log" | "diff
 export function isGitRepo(repoRoot: string): boolean {
   return fs.existsSync(path.join(repoRoot, ".git"));
 }
+

package/dashboard/src/web/client.html

@@ -218,6 +218,12 @@
     let eventSource = null;
     let pollInterval = null;
 
+    // Project metadata belongs in HTML text content, never in markup.
+    function escapeHtml(value) {
+      const entities = { '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' };
+      return String(value).replace(/[&<>"']/g, char => entities[char]);
+    }
+
     function render(data) {
       if (!data) return;
       renderPipeline(data);
@@ -246,14 +252,14 @@
 
       let html = '';
       if (metrics) {
-        html += `<div class="metric-row"><span class="metric-label">Total BCPs</span><span class="metric-value">${metrics.totalBcps}</span></div>`;
+        html += `<div class="metric-row"><span class="metric-label">Total BCPs</span><span class="metric-value">${escapeHtml(metrics.totalBcps)}</span></div>`;
         html += `<div class="metric-row"><span class="metric-label">Avg BCP/Hour</span><span class="metric-value">${metrics.avgBcpPerHour.toFixed(2)}</span></div>`;
       }
       if (velocity) {
         html += `<div class="metric-row"><span class="metric-label">Current Velocity</span><span class="metric-value">${velocity.avgBcpPerHour.toFixed(2)} BCP/h</span></div>`;
       }
       if (data.state?.release?.version) {
-        html += `<div class="metric-row"><span class="metric-label">Version</span><span class="metric-value">${data.state.release.version}</span></div>`;
+        html += `<div class="metric-row"><span class="metric-label">Version</span><span class="metric-value">${escapeHtml(data.state.release.version)}</span></div>`;
       }
       if (timestamp) {
         html += `<div class="metric-row"><span class="metric-label">Updated</span><span class="metric-value" style="font-size: 10px;">${new Date(timestamp).toLocaleTimeString()}</span></div>`;
@@ -271,7 +277,7 @@
         { key: 'Git Branch', value: state.gitBranch }
       ];
       container.innerHTML = pairs.map(pair => {
-        const val = pair.value || '(none)';
+        const val = escapeHtml(pair.value || '(none)');
         return `<div class="state-pair"><span class="state-key">${pair.key}</span><span class="state-value">${val}</span></div>`;
       }).join('');
     }
@@ -288,8 +294,8 @@
         const storyCount = stories.length;
         return `
           <div class="epic-item">
-            <div class="epic-title">${epic.id || 'Unknown'}</div>
-            <div style="color: var(--ink-soft); font-size: 11px; margin-bottom: 0;">${epic.title || 'Untitled'}</div>
+            <div class="epic-title">${escapeHtml(epic.id || 'Unknown')}</div>
+            <div style="color: var(--ink-soft); font-size: 11px; margin-bottom: 0;">${escapeHtml(epic.title || 'Untitled')}</div>
             <div class="epic-stories">${storyCount} stories</div>
           </div>
         `;
@@ -308,10 +314,10 @@
         const end = row.end ? new Date(row.end).toLocaleDateString() : '(active)';
         return `
           <div class="ledger-row">
-            <div class="ledger-id">${row.id}</div>
+            <div class="ledger-id">${escapeHtml(row.id)}</div>
             <div style="text-align: right;">
-              <div class="ledger-value">${row.bcps} BCP</div>
-              <div class="ledger-meta">${row.cycleMin}min | ${row.bcpPerHour.toFixed(2)}/h</div>
+              <div class="ledger-value">${escapeHtml(row.bcps)} BCP</div>
+              <div class="ledger-meta">${escapeHtml(row.cycleMin)}min | ${row.bcpPerHour.toFixed(2)}/h</div>
             </div>
           </div>
         `;
@@ -417,3 +423,4 @@
   </script>
 </body>
 </html>
+

package/dashboard/src/web/server.js

@@ -104,9 +104,10 @@ function createServer(projectRoot, port = 7742) {
 
   return {
     listen(portNum = port, cb) {
-      return app.listen(portNum, cb);
+      return app.listen(portNum, '127.0.0.1', cb);
     }
   };
 }
 
 module.exports = { createServer };
+

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bigpowers",
-  "version": "2.88.17",
+  "version": "2.88.18",
   "description": "73 agent skills synthesizing 17 years of software engineering discipline into a prescriptive methodology for solo developers",
   "main": "index.js",
   "scripts": {

package/scripts/bp-read-agents.sh

@@ -53,9 +53,11 @@ if $PRINT_MODE; then
   if [ -n "$BP_LINT" ];      then echo "Lint:      $BP_LINT"; fi
   if [ -n "$BP_DEPLOY" ];    then echo "Deploy:    $BP_DEPLOY"; fi
 else
-  if [ -n "$BP_PREFLIGHT" ]; then echo "export BP_PREFLIGHT='$BP_PREFLIGHT'"; fi
-  if [ -n "$BP_TEST" ];      then echo "export BP_TEST='$BP_TEST'"; fi
-  if [ -n "$BP_BUILD" ];     then echo "export BP_BUILD='$BP_BUILD'"; fi
-  if [ -n "$BP_LINT" ];      then echo "export BP_LINT='$BP_LINT'"; fi
-  if [ -n "$BP_DEPLOY" ];    then echo "export BP_DEPLOY='$BP_DEPLOY'"; fi
+  # Bash %q preserves the command as data when the caller evaluates exports.
+  if [ -n "$BP_PREFLIGHT" ]; then printf 'export BP_PREFLIGHT=%q\n' "$BP_PREFLIGHT"; fi
+  if [ -n "$BP_TEST" ];      then printf 'export BP_TEST=%q\n' "$BP_TEST"; fi
+  if [ -n "$BP_BUILD" ];     then printf 'export BP_BUILD=%q\n' "$BP_BUILD"; fi
+  if [ -n "$BP_LINT" ];      then printf 'export BP_LINT=%q\n' "$BP_LINT"; fi
+  if [ -n "$BP_DEPLOY" ];    then printf 'export BP_DEPLOY=%q\n' "$BP_DEPLOY"; fi
 fi
+

package/scripts/lib/golden-suite-gates.sh

@@ -9,6 +9,7 @@ GOLDEN_GATES=(
   "compliance:npm run compliance:false"
   "g04-selftest:bash scripts/golden-g04-selftest.sh:true"
   "g06-migrate-version:bash tests/run-golden-migrate-version.sh:true"
+  "security-migration:node tests/security/migration.cjs:false"
   "g07-negative-path:bash scripts/golden-g07-negative-path.sh:false"
   "g08-anti-vacuity:bash scripts/golden-g08-anti-vacuity.sh:false"
   "g09-yaml-roundtrip:bash scripts/golden-g09-yaml-roundtrip.sh:false"
@@ -66,10 +67,14 @@ GOLDEN_GATES=(
   "golden-g11-worktree-venv:bash scripts/test-golden-g11-worktree-venv.sh:false"
   "install-helpers:bash scripts/test-install-helpers.sh:false"
   "project-runtime:bash scripts/test-project-runtime.sh:false"
+  "security-agents-import:node tests/security/agents-import.cjs:false"
   "omp-extension:bash scripts/validate-omp-extension.sh:false"
   "mcp-package:bash scripts/validate-mcp-package.sh:false"
+  "security-git-context:node tests/security/git-context.cjs:false"
   "docs-base-path:bash scripts/validate-docs-base-path.sh:false"
+  "security-dashboard-bind:node tests/security/dashboard-bind.cjs:false"
   "import-boundaries:bash scripts/check-import-boundaries.sh:false"
+  "security-dashboard-render:node tests/security/dashboard-render.cjs:false"
   "skill-catalog:bash scripts/validate-skill-catalog.sh:false"
   "specs-parse:bash scripts/validate-specs-yaml.sh:false"
   # The runner itself: failing output is shown, skips are named and reasoned.
@@ -204,3 +209,4 @@ golden_run_deterministic_gates() {
     fi
   done
 }
+

package/scripts/lib/migrate-version-common.sh

@@ -21,23 +21,32 @@ EOF
 }
 
 migrate_installed_version() {
-  node -e "console.log(require('$BIGPOWERS_ROOT/package.json').version)" 2>/dev/null || echo "unknown"
+  node -e 'console.log(require(process.argv[1]).version)' "$BIGPOWERS_ROOT/package.json" 2>/dev/null || echo "unknown"
+}
+
+migrate_validate_version() {
+  local version="$1" label="$2"
+  local pattern='^[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?(\+[0-9A-Za-z.-]+)?$'
+  if [[ ! "$version" =~ $pattern ]]; then
+    echo "migrate-version: invalid $label version; expected major.minor.patch with optional prerelease/build metadata" >&2
+    return 4
+  fi
 }
 
 migrate_yaml_get() {
   local file="$1" key="$2"
-  $PYTHON -c "
+  "$PYTHON" -c "
 import yaml, sys
 try:
-    d = yaml.safe_load(open('$file'))
+    d = yaml.safe_load(open(sys.argv[1]))
     val = d
-    for k in '$key'.split('.'):
+    for k in sys.argv[2].split('.'):
         if not isinstance(val, dict): sys.exit(1)
         val = val.get(k)
     if val is None: sys.exit(1)
     print(val)
 except: sys.exit(1)
-" 2>/dev/null
+" "$file" "$key" 2>/dev/null
 }
 
 log_info()  { echo "  [INFO] $*"; }
@@ -111,3 +120,4 @@ migrate_detect_version() {
   fi
   return 0
 }
+

package/scripts/lib/migrate-version-plan.sh

@@ -8,15 +8,14 @@ MIGRATE_VERSION_PLAN_LOADED=1
 migrate_build_plan() {
   echo "migrate-version: building migration plan from $REGISTRY …"
 
-  MIGRATION_PLAN="$($PYTHON -c "
+  MIGRATION_PLAN="$("$PYTHON" -c "
 import yaml, json, sys
 
-with open('$REGISTRY') as f:
+with open(sys.argv[1]) as f:
     parts = f.read().split('---')
     fm = yaml.safe_load(parts[1])
 
-detected = '$DETECTED'
-installed = '$INSTALLED'
+detected, installed = sys.argv[2:4]
 
 plan = []
 for m in sorted(fm.get('migrations', []), key=lambda x: x.get('order', 99)):
@@ -30,7 +29,7 @@ for m in sorted(fm.get('migrations', []), key=lambda x: x.get('order', 99)):
 
 applicable = [m for m in plan if m['since_version'] > detected and m['since_version'] <= installed]
 print(json.dumps(applicable))
-" 2>/dev/null)"
+" "$REGISTRY" "$DETECTED" "$INSTALLED")"
 
   MIGRATION_COUNT="$(echo "$MIGRATION_PLAN" | $PYTHON -c "import json,sys; print(len(json.load(sys.stdin)))" 2>/dev/null)"
 
@@ -79,7 +78,7 @@ for m in json.load(sys.stdin):
   echo "$MIGRATION_PLAN" | $PYTHON -c "
 import json, sys, os
 for m in json.load(sys.stdin):
-    bundle_path = os.path.join('$MIGRATIONS_DIR', m['file'])
+    bundle_path = os.path.join(sys.argv[1], m['file'])
     if not os.path.exists(bundle_path):
         print(f\"  WARN {m['id']}: bundle file not found ({m['file']})\")
         continue
@@ -112,8 +111,9 @@ for m in json.load(sys.stdin):
     for a in fm.get('actions_needed', []):
         v = a.get('verify', '')
         if v: print(f\"  verify: {v}\")
-" 2>/dev/null
+" "$MIGRATIONS_DIR" 2>/dev/null
 
   echo ""
   echo "Run without --dry-run to apply these migrations."
 }
+

package/scripts/lib/migrate-version-run.sh

@@ -28,6 +28,8 @@ migrate_version_main() {
 
   INSTALLED="$(migrate_installed_version)"
   migrate_detect_version || exit $?
+  migrate_validate_version "$DETECTED" detected || exit $?
+  migrate_validate_version "$INSTALLED" installed || exit $?
 
   echo "migrate-version: detected=$DETECTED installed=$INSTALLED"
 
@@ -51,3 +53,4 @@ migrate_version_main() {
   migrate_finalize
   exit 0
 }
+

package/tests/security/agents-import.cjs

@@ -0,0 +1,36 @@
+// story: e21s03
+const assert = require('assert');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const { execFileSync } = require('child_process');
+
+const root = fs.mkdtempSync(path.join(os.tmpdir(), 'bp-agents-'));
+const script = path.resolve(__dirname, '../../scripts/bp-read-agents.sh');
+const commands = [
+  "echo'; printf IMPORT_RAN > import-marker; #",
+  "node -e 'console.log(\"quoted value\")'",
+  'echo $(touch substitution-marker) `touch backtick-marker` "$HOME"; echo done',
+  "printf '%s\\n' 'spaces & symbols | < >'",
+  'echo "deploy" && echo finished'
+];
+const names = ['PREFLIGHT', 'TEST', 'BUILD', 'LINT', 'DEPLOY'];
+const sections = ['Preflight', 'Test', 'Build', 'Lint', 'Deploy'];
+try {
+  for (const source of ['AGENTS.md', 'CLAUDE.md', 'CURSOR.md']) {
+    fs.writeFileSync(path.join(root, source), commands.map((c, i) =>
+      `## ${sections[i]}\n\n\`\`\`bash\n${c}\n\`\`\`\n`).join('\n'));
+    const output = execFileSync('bash', ['-c',
+      'eval "$(bash "$1")"; printf "%s\\0" "$BP_PREFLIGHT" "$BP_TEST" "$BP_BUILD" "$BP_LINT" "$BP_DEPLOY"',
+      'import-test', script], { cwd: root, encoding: 'utf8' });
+    for (const marker of ['import-marker', 'substitution-marker', 'backtick-marker']) {
+      assert(!fs.existsSync(path.join(root, marker)), `${source}: importing executed ${marker}`);
+    }
+    assert.deepStrictEqual(output.split('\0').slice(0, -1), commands, `${source}: exact values`);
+    const printed = execFileSync('bash', [script, '--print'], { cwd: root, encoding: 'utf8' });
+    for (const command of commands) assert(printed.includes(command));
+    fs.unlinkSync(path.join(root, source));
+  }
+  assert.strictEqual(execFileSync('bash', [script], { cwd: root, encoding: 'utf8' }), '');
+  console.log(`PASS: ${names.length} command exports round-trip without execution in all 3 source formats`);
+} finally { fs.rmSync(root, { recursive: true, force: true }); }

package/tests/security/dashboard-bind.cjs

@@ -0,0 +1,31 @@
+const assert = require('assert');
+const fs = require('fs');
+const http = require('http');
+const path = require('path');
+const vm = require('vm');
+
+// Replace filesystem watching and Express routing at the I/O boundary, but
+// exercise a real TCP listener with the arguments supplied by createServer.
+const filename = path.resolve(__dirname, '../../dashboard/src/web/server.js');
+const moduleStub = { exports: {} };
+const sandbox = {
+  module: moduleStub, __dirname: path.dirname(filename), console, setTimeout, clearTimeout,
+  require(name) {
+    if (name === 'path') return path;
+    if (name === '../loaders/watcher') return { watch: () => ({ on() {} }) };
+    if (name.startsWith('../loaders/')) return {};
+    assert.strictEqual(name, 'express');
+    return () => ({ get() {}, listen: (...args) => http.createServer().listen(...args) });
+  }
+};
+vm.runInNewContext(fs.readFileSync(filename, 'utf8'), sandbox, { filename });
+const app = moduleStub.exports.createServer('/unused', 0);
+const server = app.listen(0, () => {
+  try {
+    assert.strictEqual(server.address().address, '127.0.0.1');
+    assert(server.address().port > 0, 'ephemeral port and callback remain supported');
+    console.log('PASS: dashboard binds only to IPv4 loopback');
+  } catch (error) { console.error(error); process.exitCode = 1; }
+  finally { server.close(); }
+});
+server.on('error', error => { console.error(error); process.exitCode = 1; });

package/tests/security/dashboard-render.cjs

@@ -0,0 +1,60 @@
+const assert = require('assert');
+const fs = require('fs');
+const path = require('path');
+const vm = require('vm');
+
+// Execute the shipped client and feed its public fetch/SSE inputs. Capture
+// generated HTML at the DOM boundary; this is not a browser execution test.
+const nodes = new Map(['pipeline', 'metrics', 'state', 'epics', 'ledger', 'status']
+  .map(id => [id, { innerHTML: '', classList: { add() {}, remove() {} } }]));
+const events = new Map();
+let stream;
+const payload = '<img src=x onerror="window.__bpXss=1"> & \'quoted\'';
+const escaped = '&lt;img src=x onerror=&quot;window.__bpXss=1&quot;&gt; &amp; &#39;quoted&#39;';
+const snapshot = {
+  state: { activeFlow: payload, activeEpic: payload, activeStory: payload,
+    gitBranch: payload, release: { version: payload } },
+  projectMetrics: { totalBcps: payload, avgBcpPerHour: 1.5 },
+  currentVelocity: { avgBcpPerHour: 2 },
+  epics: [{ id: payload, title: payload, stories: [] }],
+  cycleTimes: [{ id: payload, bcps: payload, cycleMin: payload, bcpPerHour: 3 }]
+};
+const sandbox = {
+  console,
+  document: {
+    getElementById: id => nodes.get(id), querySelectorAll: () => [],
+    addEventListener() {}, createElement: () => ({ getContext: () => ({}) })
+  },
+  window: { addEventListener: (name, fn) => events.set(name, fn) },
+  fetch: async () => ({ json: async () => JSON.parse(JSON.stringify(snapshot)) }),
+  EventSource: class { constructor() { stream = this; } },
+  setInterval() { throw new Error('unexpected polling fallback'); }
+};
+const filename = path.resolve(__dirname, '../../dashboard/src/web/client.html');
+const html = fs.readFileSync(filename, 'utf8');
+for (const match of html.matchAll(/<script>([\s\S]*?)<\/script>/g)) {
+  vm.runInNewContext(match[1], sandbox, { filename });
+}
+function assertEscaped() {
+  for (const [panel, count] of [['state', 4], ['metrics', 2], ['epics', 2], ['ledger', 3]]) {
+    const output = nodes.get(panel).innerHTML;
+    assert(!output.includes('<img'), `${panel}: project metadata became HTML`);
+    assert.strictEqual(output.split(escaped).length - 1, count, `${panel}: literal text preserved`);
+  }
+}
+async function main() {
+  events.get('load')();
+  await new Promise(resolve => setImmediate(resolve));
+  assertEscaped();
+  assert(stream, 'initial fetch should connect SSE');
+  stream.onmessage({ data: JSON.stringify(snapshot) });
+  assertEscaped();
+  stream.onmessage({ data: JSON.stringify({ state: { gitBranch: 'feature/example' },
+    projectMetrics: { totalBcps: 0, avgBcpPerHour: 0 } }) });
+  assert(nodes.get('state').innerHTML.includes('feature/example'));
+  assert(nodes.get('metrics').innerHTML.includes('>0</span>'));
+  assert(nodes.get('epics').innerHTML.includes('No epics available'));
+  assert(nodes.get('ledger').innerHTML.includes('No cycle-time data available'));
+  console.log('PASS: fetch and SSE render all project metadata as escaped text');
+}
+main().catch(error => { console.error(error); process.exitCode = 1; });

package/tests/security/git-context.cjs

@@ -0,0 +1,44 @@
+// story: e32s04
+const assert = require('assert');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const { execFileSync } = require('child_process');
+
+const root = fs.mkdtempSync(path.join(os.tmpdir(), 'bp-diff-'));
+const git = (...args) => execFileSync('git', args, { cwd: root, stdio: 'pipe' });
+const put = (name, value) => {
+  fs.mkdirSync(path.dirname(path.join(root, name)), { recursive: true });
+  fs.writeFileSync(path.join(root, name), value);
+};
+
+async function main() {
+  const { getGitContext } = await import('../../bigpowers-mcp/build/lib/git-context.js');
+  git('init', '-q');
+  const secret = 'specs/m-secret.pem';
+  const before = 'specs/a-public.md';
+  const after = 'specs/z-public.md';
+  const outside = 'private/readme.md';
+  for (const file of [secret, before, after, outside]) put(file, 'baseline\n');
+  git('add', '.');
+  git('-c', 'user.name=Test', '-c', 'user.email=test@example.invalid',
+    'commit', '-qm', 'fixture');
+  for (const allowed of [[after], [before, after], [before], []]) {
+    git('reset', '--hard', 'HEAD');
+    put(secret, 'DUMMY_SECRET_VALUE\n');
+    put(outside, 'OUT_OF_SCOPE_VALUE\n');
+    for (const file of allowed) put(file, 'PUBLIC_CHANGE\n');
+    const result = getGitContext(root, 'diff');
+    assert.deepStrictEqual(Object.keys(result.diffs).sort(), [...allowed].sort());
+    assert.deepStrictEqual(Object.values(result.changed_files).flat().sort(), [...allowed].sort());
+    assert(!JSON.stringify(result).includes('DUMMY_SECRET_VALUE'));
+    assert(!JSON.stringify(result).includes('OUT_OF_SCOPE_VALUE'));
+    for (const file of allowed) assert(result.diffs[file].includes('+PUBLIC_CHANGE'));
+  }
+  git('reset', '--hard', 'HEAD');
+  assert.deepStrictEqual(getGitContext(root, 'diff').diffs, {});
+  console.log('PASS: secret diffs excluded in first, middle, last and only positions');
+}
+
+main().catch(error => { console.error(error); process.exitCode = 1; })
+  .finally(() => fs.rmSync(root, { recursive: true, force: true }));

package/tests/security/migration.cjs

@@ -0,0 +1,76 @@
+// story: e44s03 e44s06
+const assert = require('assert');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const { execFileSync, spawnSync } = require('child_process');
+
+const root = fs.mkdtempSync(path.join(os.tmpdir(), 'bp-migration-'));
+const repo = path.resolve(__dirname, '../..');
+const project = path.join(root, 'project');
+const specs = path.join(project, 'specs');
+const marker = path.join(root, 'executed-marker');
+const git = (...args) => execFileSync('git', args, { cwd: project, stdio: 'pipe' });
+function stamp(version) {
+  fs.writeFileSync(path.join(specs, 'state.yaml'),
+    `bigpowers_version: ${JSON.stringify(version)}\nactive_flow: null\n`);
+  git('add', '.');
+  git('-c', 'user.name=Test', '-c', 'user.email=test@example.invalid',
+    'commit', '--allow-empty', '-qm', 'fixture');
+}
+function preview(script) {
+  const before = fs.readFileSync(path.join(specs, 'state.yaml'), 'utf8');
+  const result = spawnSync('bash', [script, '--project', project, '--dry-run'],
+    { cwd: project, encoding: 'utf8' });
+  assert(!result.error, String(result.error));
+  assert(!fs.existsSync(marker), 'dry run executed version metadata');
+  assert.strictEqual(fs.readFileSync(path.join(specs, 'state.yaml'), 'utf8'), before);
+  assert.deepStrictEqual(fs.readdirSync(specs), ['state.yaml'], 'dry run wrote files');
+  return result;
+}
+function copyFile(relative, destination) {
+  const target = path.join(destination, relative);
+  fs.mkdirSync(path.dirname(target), { recursive: true });
+  fs.copyFileSync(path.join(repo, relative), target);
+}
+function installFixture(destination) {
+  for (const relative of ['package.json', 'scripts/migrate-version.sh',
+    'scripts/lib/python-env.sh', ...['common', 'plan', 'run', 'post', 'execute', 'transforms']
+      .map(name => `scripts/lib/migrate-version-${name}.sh`)]) copyFile(relative, destination);
+  const migrations = path.join(destination, 'specs/migrations');
+  fs.mkdirSync(migrations, { recursive: true });
+  fs.writeFileSync(path.join(migrations, 'registry.okf.md'),
+    '---\nmigrations:\n  - id: test\n    since_version: "2.80.0"\n    order: 1\n---\n');
+  fs.writeFileSync(path.join(migrations, 'test.okf.md'),
+    '---\ntransforms: []\nactions_needed: []\n---\n');
+  return path.join(destination, 'scripts/migrate-version.sh');
+}
+try {
+  fs.mkdirSync(specs, { recursive: true });
+  git('init', '-q', '-b', 'main');
+  const script = installFixture(path.join(root, 'installation'));
+  stamp(`0.0.0'; open('${marker}', 'w').write('DUMMY'); #`);
+  const hostile = preview(script);
+  assert.notStrictEqual(hostile.status, 0, 'invalid version must fail closed');
+  assert(/invalid.*version/i.test(hostile.stderr), hostile.stderr);
+  for (const version of ['1.0.0', '2.0.0', '2.20.0', '2.20.0-rc.1+build.2']) {
+    stamp(version);
+    const result = preview(script);
+    assert.strictEqual(result.status, 0, result.stderr);
+    assert(result.stdout.includes(`Detected version: ${version}`), result.stdout);
+  }
+  // The same data boundary applies to legitimate installation/project paths.
+  const installation = path.join(root, "install's directory");
+  const quotedScript = installFixture(installation);
+  stamp('1.0.0');
+  const quotedProject = path.join(root, "project's directory");
+  fs.symlinkSync(project, quotedProject, 'dir');
+  const result = spawnSync('bash', [quotedScript,
+    '--project', quotedProject, '--dry-run'], { encoding: 'utf8' });
+  assert.strictEqual(result.status, 0, result.stderr);
+  assert(result.stdout.includes('Detected version: 1.0.0'), result.stdout);
+  assert(result.stdout.includes('Transforms preview:'), result.stdout);
+  assert(result.stdout.includes('-- test: test --'), result.stdout);
+  assert(!result.stdout.includes('installed=unknown'), result.stdout);
+  console.log('PASS: migration preview rejects executable stamps and supports quoted paths');
+} finally { fs.rmSync(root, { recursive: true, force: true }); }