ccakashic 0.2.8 → 0.3.0

package/dist/template-assets.js

@@ -573,19 +573,23 @@ body {
 function getAppJS() {
     return `
 (function() {
-  // Simple markdown renderer (no external dependency)
+  function esc(s) {
+    return s.replace(/&/g,'&amp;').replace(/</g,'&lt;').replace(/>/g,'&gt;').replace(/"/g,'&quot;');
+  }
+
+  // Simple markdown renderer (no external dependency).
+  // SECURITY: callers pass el.textContent, which DECODES the server's HTML
+  // entities back to raw characters, so session content (semi-untrusted: it can
+  // contain text from fetched pages/files/tool output) arrives unescaped. We
+  // re-escape it up front before applying markdown — markdown syntax chars
+  // ([ ] ( ) * \` # -) are untouched by escaping so markdown still renders,
+  // while <, >, " stay inert as &lt; &gt; &quot; and cannot inject HTML.
   function renderMarkdown(text) {
-    // Escape HTML first (already escaped by server, but for client-side re-render)
-    // Actually the text is already HTML-escaped, so we need to unescape first
-    text = text
-      .replace(/&amp;/g, '&')
-      .replace(/&lt;/g, '<')
-      .replace(/&gt;/g, '>')
-      .replace(/&quot;/g, '"');
-
-    // Code blocks (fenced)
+    text = esc(text);
+
+    // Code blocks (fenced) — content is already escaped, do not re-escape
     text = text.replace(/\`\`\`(\\w*)?\\n([\\s\\S]*?)\`\`\`/g, function(m, lang, code) {
-      return '<pre><code class="language-' + (lang || '') + '">' + esc(code.trim()) + '</code></pre>';
+      return '<pre><code class="language-' + (lang || '') + '">' + code.trim() + '</code></pre>';
     });
 
     // Inline code
@@ -606,8 +610,15 @@ function getAppJS() {
     text = text.replace(/^[\\-*] (.+)$/gm, '<li>$1</li>');
     text = text.replace(/(<li>.*<\\/li>\\n?)+/g, '<ul>$&</ul>');
 
-    // Links
-    text = text.replace(/\\[([^\\]]+)\\]\\(([^)]+)\\)/g, '<a href="$2" target="_blank">$1</a>');
+    // Links — href is already escaped (so " is &quot; and can't break out of
+    // the attribute), but still allowlist safe schemes to block javascript:.
+    // The leading-slash branch uses (?!\\/) so protocol-relative //evil.com
+    // (which navigates off-site) is rejected — only same-origin /path passes.
+    text = text.replace(/\\[([^\\]]+)\\]\\(([^)]+)\\)/g, function(m, label, href) {
+      return /^(https?:\\/\\/|\\/(?!\\/)|#)/i.test(href)
+        ? '<a href="' + href + '" target="_blank" rel="noopener">' + label + '</a>'
+        : label;
+    });
 
     // Paragraphs (simple: double newlines)
     text = text.replace(/\\n\\n/g, '</p><p>');
@@ -625,14 +636,15 @@ function getAppJS() {
     return text;
   }
 
-  function esc(s) {
-    return s.replace(/&/g,'&amp;').replace(/</g,'&lt;').replace(/>/g,'&gt;');
+  // Render markdown in all [data-markdown] elements. Exposed globally so the
+  // dashboard can re-apply it to pane content replaced after a poll.
+  function applyMarkdown(root) {
+    root.querySelectorAll('[data-markdown]').forEach(function(el) {
+      el.innerHTML = renderMarkdown(el.textContent);
+    });
   }
-
-  // Render markdown in all [data-markdown] elements
-  document.querySelectorAll('[data-markdown]').forEach(function(el) {
-    el.innerHTML = renderMarkdown(el.textContent);
-  });
+  window.ccakashicApplyMarkdown = applyMarkdown;
+  applyMarkdown(document);
 
   // Scroll to bottom when hash is #session-bottom. We re-scroll here (after
   // markdown rendering) because the DOM height grows when markdown expands,

package/dist/util.js

@@ -0,0 +1,80 @@
+"use strict";
+// Shared helpers used across the HTML generators and the server.
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ACTIVE_THRESHOLD_MS = void 0;
+exports.getOrCreateToken = getOrCreateToken;
+exports.escapeHtml = escapeHtml;
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const crypto = __importStar(require("crypto"));
+const CONFIG_DIR = path.join(os.homedir(), '.config', 'ccakashic');
+const TOKEN_FILE = path.join(CONFIG_DIR, 'token');
+// The /api/resume CSRF token, persisted so it survives a server restart and the
+// buttons on already-open tabs keep working without a reload. Falls back to an
+// in-memory token if the file can't be read/written. DNS rebinding is already
+// blocked by the Host-header check, so this token is defense-in-depth.
+function getOrCreateToken() {
+    try {
+        const existing = fs.readFileSync(TOKEN_FILE, 'utf-8').trim();
+        if (/^[a-f0-9]{32,}$/.test(existing))
+            return existing;
+    }
+    catch {
+        // not created yet
+    }
+    const token = crypto.randomBytes(16).toString('hex');
+    try {
+        fs.mkdirSync(CONFIG_DIR, { recursive: true });
+        fs.writeFileSync(TOKEN_FILE, token, { mode: 0o600 });
+    }
+    catch {
+        // fall back to an ephemeral token (rotates on restart)
+    }
+    return token;
+}
+function escapeHtml(str) {
+    return String(str)
+        .replace(/&/g, '&amp;')
+        .replace(/</g, '&lt;')
+        .replace(/>/g, '&gt;')
+        .replace(/"/g, '&quot;')
+        .replace(/'/g, '&#39;');
+}
+// A session whose file was touched within this window is treated as still
+// attached to a live `claude` process. Shared so the dashboard status dot and
+// the resume fork-confirmation use the exact same definition of "active".
+exports.ACTIVE_THRESHOLD_MS = 2 * 60_000;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "ccakashic",
-  "version": "0.2.8",
-  "description": "Browse Claude Code session logs (~/.claude/projects/) as beautiful HTML in your browser — an Akashic Record of your Claude Code sessions",
+  "version": "0.3.0",
+  "description": "A cross-project dashboard for your Claude Code sessions (~/.claude/projects/) — browse logs as beautiful HTML, see which sessions are waiting for you, and resume any of them in one click via cmux",
   "bin": {
     "ccakashic": "dist/bin/ccakashic.js"
   },