feat(host-agent): migrate local console to Jinja2 templates with autoescape

Replace hand-written f-string + html.escape() rendering in the Host Agent local console with a module-level Jinja2 Environment configured with select_autoescape(["html","xml"]). XSS safety now holds by mechanism rather than per-call discipline — every operator-controlled field (device name, connection_info, task summary, etc.) is escaped by the engine uniformly. Eight templates under host_agent/web/templates/ replace the former _chrome(), _CSS, escape(), and per-page _xxx_body() helpers: base.html (header/nav/CSS + {% block body %}), login, dashboard (with the polling <script> preserved byte-identically inside {% raw %}), devices, account, history, tasks_list, and task_detail. The task-list and task-detail templates — added by the just-landed task-execution-progress-visibility change — were also migrated here rather than left in f-string form, since this change removes the shared helpers they depended on. URLs, auth/session/CSRF semantics, redirects, and /api/status JSON are unchanged. 15 new template tests cover render-smoke, XSS probing, script byte-identity, and no-autoescape-bypass guards. Tasks 8.1-8.6 (manual browser verification) remain. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-07-14 13:05:19 +08:00
parent ec261d57c2
commit 8381b3068a
20 changed files with 1286 additions and 394 deletions
@@ -0,0 +1,43 @@
+<script>
+    (function () {
+      function render(data) {
+        var hb = data.status.last_heartbeat;
+        document.getElementById("last-heartbeat").textContent = hb
+          ? (hb.ok ? "ok" : "failed") + " at " + hb.at + " (" + hb.device_count + " devices)"
+          : "never";
+        var current = data.status.current_assignment;
+        document.getElementById("current-assignment").textContent = current
+          ? current.task_id + " on " + current.device_id + " (started " + current.started_at + ")"
+          : "none";
+        var progress = data.status.progress;
+        document.getElementById("current-progress").textContent = progress
+          ? "step " + progress.step_index + " \u2014 " + progress.step_status + ": " + progress.summary
+          : "";
+        var policy = data.status.host_policy;
+        document.getElementById("host-policy").textContent = policy
+          ? "revision " + policy.revision + "; self-submission "
+            + (policy.self_submission_enabled ? "enabled" : "disabled")
+            + "; max active tasks " + (policy.max_active_tasks || "unlimited")
+            + "; daily token budget " + (policy.daily_token_budget || "unmetered")
+          : "no Cloud policy cached";
+        var body = document.getElementById("device-status-body");
+        body.innerHTML = "";
+        data.devices.forEach(function (device) {
+          var row = document.createElement("tr");
+          ["id", "name", "driver_type", "status"].forEach(function (key) {
+            var cell = document.createElement("td");
+            cell.textContent = device[key] || "";
+            row.appendChild(cell);
+          });
+          body.appendChild(row);
+        });
+      }
+      function poll() {
+        fetch("/api/status", { credentials: "same-origin" })
+          .then(function (response) { return response.ok ? response.json() : null; })
+          .then(function (data) { if (data) render(data); })
+          .catch(function () {});
+      }
+      setInterval(poll, 5000);
+    })();
+    </script>