From 45cc1f951f66ca347328c7f4def155948b4cc2dc Mon Sep 17 00:00:00 2001
From: root <root@Kimi.localdomain>
Date: Wed, 8 Jul 2026 16:23:19 +0300
Subject: [PATCH] fix(dashboard): escape rendered trace fields

---
 dashboard/index.html | 21 +++++++++++++++------
 1 file changed, 15 insertions(+), 6 deletions(-)

diff --git a/dashboard/index.html b/dashboard/index.html
index f08ec95..8a32984 100644
--- a/dashboard/index.html
+++ b/dashboard/index.html
@@ -35,12 +35,21 @@ <h1>Promptimprover Swarm Dashboard</h1>
         const tr = document.createElement('tr');
         const fmtTime = new Date(log.timestamp).toLocaleTimeString();
         const reason = log.reasoning_path && log.reasoning_path.length > 60 ? log.reasoning_path.slice(0,57) + '...' : log.reasoning_path;
-        ['time', 'span', 'persona', 'action', 'tokens', 'reasoning'].forEach((k, i) => {
-           const td = document.createElement('td');
-           const values = [fmtTime, log.span_id || 'N/A', log.persona || 'Unknown', log.action_type || 'Unknown', log.metrics?.total_tokens || 0, reason || ''];
-           td.textContent = values[i];
-           tr.appendChild(td);
-        });
+        const escapeHtml = (unsafe) => (unsafe || '').toString()
+          .replace(/&/g, "&amp;")
+          .replace(/</g, "&lt;")
+          .replace(/>/g, "&gt;")
+          .replace(/"/g, "&quot;")
+          .replace(/'/g, "&#039;");
+
+        tr.innerHTML = `
+          <td>${escapeHtml(fmtTime)}</td>
+          <td>${escapeHtml(log.span_id || 'N/A')}</td>
+          <td>${escapeHtml(log.persona || 'Unknown')}</td>
+          <td>${escapeHtml(log.action_type || 'Unknown')}</td>
+          <td>${escapeHtml(log.metrics?.total_tokens || 0)}</td>
+          <td>${escapeHtml(reason || '')}</td>
+        `;
         tbody.appendChild(tr);
       });
     }