fix(dashboard): bind loopback, fallback JSON, prevent XSS

Author: Aitomates

dashboard/index.html

@@ -35,14 +35,12 @@ <h1>Promptimprover Swarm Dashboard</h1>
         const tr = document.createElement('tr');
         const fmtTime = new Date(log.timestamp).toLocaleTimeString();
         const reason = log.reasoning_path && log.reasoning_path.length > 60 ? log.reasoning_path.slice(0,57) + '...' : log.reasoning_path;
-        tr.innerHTML = `
-          <td>${fmtTime}</td>
-          <td>${log.span_id || 'N/A'}</td>
-          <td>${log.persona || 'Unknown'}</td>
-          <td>${log.action_type || 'Unknown'}</td>
-          <td>${log.metrics?.total_tokens || 0}</td>
-          <td>${reason || ''}</td>
-        `;
+        ['time', 'span', 'persona', 'action', 'tokens', 'reasoning'].forEach((k, i) => {
+           const td = document.createElement('td');
+           const values = [fmtTime, log.span_id || 'N/A', log.persona || 'Unknown', log.action_type || 'Unknown', log.metrics?.total_tokens || 0, reason || ''];
+           td.textContent = values[i];
+           tr.appendChild(td);
+        });
         tbody.appendChild(tr);
       });
     }

dashboard/server.js

@@ -11,6 +11,7 @@ const PORT = 3000;
 
 // Helper: read last N lines from trace file
 async function readLastLines(filePath, maxLines = 20) {
+  if (!fs.existsSync(filePath)) return [];
   const stream = fs.createReadStream(filePath, { encoding: 'utf8' });
   let data = '';
   stream.on('data', chunk => { data += chunk; });
@@ -56,6 +57,6 @@ const server = http.createServer(async (req, res) => {
   }
 });
 
-server.listen(PORT, () => {
-  console.log(`Promptimprover dashboard listening on http://localhost:${PORT}`);
+server.listen(PORT, '127.0.0.1', () => {
+  console.log(`Promptimprover dashboard listening on http://127.0.0.1:${PORT}`);
 });