Merge branch 'main' into release

Author: rajbos

src/webview/diagnostics/main.ts

@@ -119,7 +119,7 @@ function formatDate(isoString: string | null): string {
     return "N/A";
   }
   try {
-    return new Date(isoString).toLocaleString();
+    return escapeHtml(new Date(isoString).toLocaleString());
   } catch {
     return escapeHtml(isoString);
   }
@@ -535,7 +535,7 @@ function renderSessionTable(
 							<td class="repository-cell" title="${sf.repository ? escapeHtml(sf.repository) : "No repository detected"}">${sf.repository ? escapeHtml(getRepoDisplayName(sf.repository)) : '<span style="color: #666;">—</span>'}</td>
 							<td>${formatFileSize(sf.size)}</td>
 							<td>${sanitizeNumber(sf.interactions)}</td>
-							<td title="${getContextRefsSummary(sf.contextReferences)}">${sanitizeNumber(getTotalContextRefs(sf.contextReferences))}</td>
+							<td title="${escapeHtml(getContextRefsSummary(sf.contextReferences))}">${sanitizeNumber(getTotalContextRefs(sf.contextReferences))}</td>
 							<td>${formatDate(sf.lastInteraction)}</td>
 							<td>
 								<a href="#" class="view-formatted-link" data-file="${encodeURIComponent(sf.file)}" title="View formatted JSONL file">📄 View</a>

src/webview/usage/main.ts

@@ -323,7 +323,7 @@ function renderLayout(stats: UsageAnalysisStats): void {
 								<th style="text-align: center; padding: 8px; border-bottom: 2px solid #2a2a30;">Sessions</th>
 								${matrix.customizationTypes.map(type => `
 									<th style="text-align: center; padding: 8px; border-bottom: 2px solid #2a2a30;" title="${escapeHtml(type.label)}">
-										${type.icon}
+										${escapeHtml(type.icon)}
 									</th>
 								`).join('')}
 							</tr>
@@ -351,7 +351,7 @@ function renderLayout(stats: UsageAnalysisStats): void {
 														: 'Status unknown';
 										return `
 										<td style="position: relative; padding: 6px 8px; border-bottom: 1px solid #2a2a30; text-align: center; font-size: 16px;" title="${statusLabel}" aria-label="${statusLabel}">
-											<span aria-hidden="true">${status}</span>
+											<span aria-hidden="true">${escapeHtml(status)}</span>
 											<span style="position:absolute;width:1px;height:1px;padding:0;margin:-1px;overflow:hidden;clip:rect(0,0,0,0);white-space:nowrap;border:0;">${statusLabel}</span>
 										</td>
 										`;
@@ -364,7 +364,7 @@ function renderLayout(stats: UsageAnalysisStats): void {
 				<div style="margin-top: 12px; font-size: 10px; color: #999; border-top: 1px solid #2a2a30; padding-top: 8px;">
 					<div style="display: flex; gap: 16px; flex-wrap: wrap;">
 						${matrix.customizationTypes.map(type => `
-							<span>${type.icon} ${escapeHtml(type.label)}</span>
+							<span>${escapeHtml(type.icon)} ${escapeHtml(type.label)}</span>
 						`).join('')}
 					</div>
 					<div style="margin-top: 8px;">
@@ -884,7 +884,7 @@ function renderLayout(stats: UsageAnalysisStats): void {
 			</div>
 
 			<div class="footer">
-				Last updated: ${new Date(stats.lastUpdated).toLocaleString()} · Updates every 5 minutes
+				Last updated: ${escapeHtml(new Date(stats.lastUpdated).toLocaleString())} · Updates every 5 minutes
 			</div>
 		</div>
 	`;
@@ -1358,7 +1358,7 @@ function renderRepositoryHygienePanels(): void {
 						${escapeHtml(ws.workspaceName)}
 					</div>
 					<div style="font-size: 10px; color: #999; margin-top: 2px;">
-						${ws.sessionCount} ${ws.sessionCount === 1 ? 'session' : 'sessions'} · ${ws.interactionCount} ${ws.interactionCount === 1 ? 'interaction' : 'interactions'} · Score: ${escapeHtml(scoreLabel)}
+						${Number(ws.sessionCount) || 0} ${ws.sessionCount === 1 ? 'session' : 'sessions'} · ${Number(ws.interactionCount) || 0} ${ws.interactionCount === 1 ? 'interaction' : 'interactions'} · Score: ${escapeHtml(scoreLabel)}
 					</div>
 				</div>
 				<vscode-button class="btn-repo-action" data-action="${buttonAction}" data-workspace-path="${escapeHtml(ws.workspacePath)}" ${isCurrentSelection ? 'disabled="true"' : ''} style="min-width: 80px;">