Merge pull request #436 from PR0M3TH3AN/agents/daily/innerhtml-migration-11256635984187475549

[security] replace innerHTML usages in landing/index.html — convert to safe DOM APIs

landing/index.html

@@ -1347,7 +1347,7 @@ npm install https://github.com/PR0M3TH3AN/TORCH/archive/refs/heads/main.tar.gz &
                 if (!response.ok) throw new Error('Failed to load roster');
                 const roster = await response.json();
 
-                container.innerHTML = ''; // Clear loading state
+                container.replaceChildren(); // Clear loading state
 
                 // Flatten roster into a single list with schedule info
                 const allAgents = [];
@@ -1421,17 +1421,47 @@ npm install https://github.com/PR0M3TH3AN/TORCH/archive/refs/heads/main.tar.gz &
                         const card = document.createElement('div');
                         card.className = 'functional-agent-card';
 
-                        card.innerHTML = `
-                            <div class="functional-agent-header">
-                                <div class="functional-agent-title-group">
-                                    <span class="functional-agent-icon">${icon}</span>
-                                    <span class="functional-agent-title">${escapeHtml(agent.title)}</span>
-                                </div>
-                                <span class="functional-agent-schedule">${agent.schedule}</span>
-                            </div>
-                            <div class="functional-agent-desc">${escapeHtml(agent.description)}</div>
-                            <button class="view-prompt-btn" onclick="openAgentModal('${agent.agentName}')">View Prompt</button>
-                        `;
+                        // Header
+                        const header = document.createElement('div');
+                        header.className = 'functional-agent-header';
+
+                        const titleGroup = document.createElement('div');
+                        titleGroup.className = 'functional-agent-title-group';
+
+                        const iconSpan = document.createElement('span');
+                        iconSpan.className = 'functional-agent-icon';
+                        iconSpan.textContent = icon;
+
+                        const titleSpan = document.createElement('span');
+                        titleSpan.className = 'functional-agent-title';
+                        titleSpan.textContent = agent.title;
+
+                        titleGroup.appendChild(iconSpan);
+                        titleGroup.appendChild(titleSpan);
+
+                        const scheduleSpan = document.createElement('span');
+                        scheduleSpan.className = 'functional-agent-schedule';
+                        scheduleSpan.textContent = agent.schedule;
+
+                        header.appendChild(titleGroup);
+                        header.appendChild(scheduleSpan);
+
+                        // Description
+                        const descDiv = document.createElement('div');
+                        descDiv.className = 'functional-agent-desc';
+                        descDiv.textContent = agent.description;
+
+                        // Button
+                        const btn = document.createElement('button');
+                        btn.className = 'view-prompt-btn';
+                        btn.textContent = 'View Prompt';
+                        // Use function reference for safety instead of inline onclick string
+                        btn.onclick = () => window.openAgentModal(agent.agentName);
+
+                        card.appendChild(header);
+                        card.appendChild(descDiv);
+                        card.appendChild(btn);
+
                         grid.appendChild(card);
                     });
 
@@ -1440,7 +1470,11 @@ npm install https://github.com/PR0M3TH3AN/TORCH/archive/refs/heads/main.tar.gz &
 
             } catch (error) {
                 console.error('Error fetching agents:', error);
-                container.innerHTML = `<p class="text-center" style="color: var(--danger)">Error loading agents: ${error.message}</p>`;
+                const p = document.createElement('p');
+                p.className = 'text-center';
+                p.style.color = 'var(--danger)';
+                p.textContent = `Error loading agents: ${error.message}`;
+                container.replaceChildren(p);
             }
         }
 

memory-updates/2026-02-22T21-19-19Z__innerhtml-migration-agent.md

@@ -0,0 +1,14 @@
+# Memory Update — innerhtml-migration-agent — 2026-02-22
+
+## Key findings
+- scripts/check-innerhtml.mjs is read-only and does not support --update or BASELINE updates.
+- landing/index.html uses innerHTML for rendering agent cards and error messages.
+
+## Patterns / reusable knowledge
+- Use `element.replaceChildren()` to clear content instead of `innerHTML = ''`.
+- Use `document.createElement` and `textContent` to safely construct DOM elements.
+- Use `element.onclick = () => func()` instead of `onclick="func()"` strings for better security.
+
+## Warnings / gotchas
+- Verify tools before assuming they have write capabilities (like check-innerhtml.mjs).
+- Ensure `escapeHtml` is not needed if using `textContent`.

src/context/CONTEXT_2026-02-22T21-19-19Z.md

@@ -0,0 +1,21 @@
+---
+agent: innerhtml-migration-agent
+cadence: daily
+run-start: 2026-02-22T21:19:19Z
+---
+# Context
+
+Executed prompt: src/prompts/daily/innerhtml-migration-agent.md
+
+Goal: Migrate innerHTML usage in landing/index.html to safe DOM APIs.
+Scope: landing/index.html
+Constraints: Do not break functionality. Minimize changes.
+
+Reason: Security hardening and reducing innerHTML count.
+Date: 2026-02-22
+
+Plan:
+1. Replace container.innerHTML = '' with replaceChildren()
+2. Replace container.innerHTML = Error... with createElement
+3. Replace card.innerHTML = ... with createElement structure
+4. Keep marked.parse usage as is (documented)

src/decisions/DECISIONS_2026-02-22T21-19-19Z.md

@@ -0,0 +1,26 @@
+---
+agent: innerhtml-migration-agent
+cadence: daily
+run-start: 2026-02-22T21:19:19Z
+---
+# Decisions
+
+Executed prompt: src/prompts/daily/innerhtml-migration-agent.md
+
+## landing/index.html
+
+1. **Clear loading state**:
+   - Decision: Use `container.replaceChildren();`
+   - Rationale: Safer and cleaner replacement for `innerHTML = ''`.
+
+2. **Error handling**:
+   - Decision: Use `document.createElement('p')` and set `textContent`.
+   - Rationale: Prevents potential injection if `error.message` contains HTML.
+
+3. **Agent card rendering**:
+   - Decision: Build DOM tree with `createElement` and `textContent`. Use `addEventListener` for button click.
+   - Rationale: Eliminates `innerHTML` usage, safer event handling, removes need for `escapeHtml` for text content.
+
+4. **Documentation modal**:
+   - Decision: Keep `contentDiv.innerHTML = marked.parse(text);`
+   - Rationale: The content comes from `../src/docs/TORCH.md`, which is a trusted file in the repository. Migrating this is out of scope.

src/test_logs/TEST_LOG_2026-02-22T21-19-19Z.md

@@ -0,0 +1,32 @@
+---
+agent: innerhtml-migration-agent
+cadence: daily
+run-start: 2026-02-22T21:19:19Z
+---
+# Test Log
+
+Executed prompt: src/prompts/daily/innerhtml-migration-agent.md
+
+## Pre-migration
+
+Command: node scripts/check-innerhtml.mjs --report
+Result:
+dashboard/app.js: 1 assignments
+landing/index.html: 4 assignments
+Total assignments: 5
+
+## Modifications
+Applied changes to landing/index.html using replace_with_git_merge_diff.
+
+## Post-migration verification
+
+Command: npm run lint
+Result: Passed
+
+Command: node scripts/check-innerhtml.mjs --report
+Result:
+dashboard/app.js: 1 assignments
+landing/index.html: 1 assignments
+Total assignments: 2
+
+Migration successful. Reduced landing/index.html innerHTML count from 4 to 1.

src/todo/TODO_2026-02-22T21-19-19Z.md

@@ -0,0 +1,18 @@
+---
+agent: innerhtml-migration-agent
+cadence: daily
+run-start: 2026-02-22T21:19:19Z
+---
+# TODO
+
+Executed prompt: src/prompts/daily/innerhtml-migration-agent.md
+
+File: landing/index.html
+
+## Completed
+- [x] Line ~910: container.innerHTML = '' (Clear loading state)
+- [x] Line ~970: container.innerHTML = Error... (Error handling)
+- [x] Line ~933: card.innerHTML = ... (Agent card rendering)
+
+## Pending
+- [ ] Line ~816: contentDiv.innerHTML = marked.parse(text) (Documentation modal - Keep as is)

task-logs/daily/2026-02-22T21-19-19Z__innerhtml-migration-agent__completed.md

@@ -0,0 +1,27 @@
+---
+agent: innerhtml-migration-agent
+cadence: daily
+run-start: 2026-02-22T21:19:19Z
+platform: linux
+---
+# Task Log
+
+Status: Success
+Agent: innerhtml-migration-agent
+Prompt: src/prompts/daily/innerhtml-migration-agent.md
+Reason: Migration successful. Reduced innerHTML count in landing/index.html.
+Learnings:
+# Memory Update — innerhtml-migration-agent — 2026-02-22
+
+## Key findings
+- scripts/check-innerhtml.mjs is read-only and does not support --update or BASELINE updates.
+- landing/index.html uses innerHTML for rendering agent cards and error messages.
+
+## Patterns / reusable knowledge
+- Use `element.replaceChildren()` to clear content instead of `innerHTML = ''`.
+- Use `document.createElement` and `textContent` to safely construct DOM elements.
+- Use `element.onclick = () => func()` instead of `onclick="func()"` strings for better security.
+
+## Warnings / gotchas
+- Verify tools before assuming they have write capabilities (like check-innerhtml.mjs).
+- Ensure `escapeHtml` is not needed if using `textContent`.