fix(dashboard): escape rendered trace fields (#27)

Co-authored-by: root <root@Kimi.localdomain>

Author: OgeonX-Ai

dashboard/index.html

@@ -35,12 +35,21 @@ <h1>Promptimprover Swarm Dashboard</h1>
         const tr = document.createElement('tr');
         const fmtTime = new Date(log.timestamp).toLocaleTimeString();
         const reason = log.reasoning_path && log.reasoning_path.length > 60 ? log.reasoning_path.slice(0,57) + '...' : log.reasoning_path;
-        ['time', 'span', 'persona', 'action', 'tokens', 'reasoning'].forEach((k, i) => {
-           const td = document.createElement('td');
-           const values = [fmtTime, log.span_id || 'N/A', log.persona || 'Unknown', log.action_type || 'Unknown', log.metrics?.total_tokens || 0, reason || ''];
-           td.textContent = values[i];
-           tr.appendChild(td);
-        });
+        const escapeHtml = (unsafe) => (unsafe || '').toString()
+          .replace(/&/g, "&amp;")
+          .replace(/</g, "&lt;")
+          .replace(/>/g, "&gt;")
+          .replace(/"/g, "&quot;")
+          .replace(/'/g, "&#039;");
+
+        tr.innerHTML = `
+          <td>${escapeHtml(fmtTime)}</td>
+          <td>${escapeHtml(log.span_id || 'N/A')}</td>
+          <td>${escapeHtml(log.persona || 'Unknown')}</td>
+          <td>${escapeHtml(log.action_type || 'Unknown')}</td>
+          <td>${escapeHtml(log.metrics?.total_tokens || 0)}</td>
+          <td>${escapeHtml(reason || '')}</td>
+        `;
         tbody.appendChild(tr);
       });
     }