fix(dashboard): repair the parse-dead inline script; real screenshots; README sweep (#136)

THE BUG: commit 01ccc88 (2026-05-29, the XSS fix) wrote
  data-id=''' + escapeHtml(p.id) + '''
into the dashboard's inline script — a SyntaxError that killed the
ENTIRE script at parse time. Every dashboard from May 29 to today
rendered 'Loading projects...' forever: the project selector, graph,
ledger, everything dead. Found while capturing a README screenshot; the
picture would not load, and the reason was real.

The irony: the ES5 lint exists precisely for quote-escaping traps, the
offending commit even used the data-id pattern the lint recommends —
and the lint stayed green, because it pattern-matches known traps
instead of parsing. Pattern lists cannot enumerate typos.

THE FIX: data-id="..." (escapeHtml escapes double quotes, so the
attribute stays injection-safe). Verified live: project list populates,
graph renders, zero page errors.

THE GUARD: lint-dashboard-es5 now renders the BUILT dashboard HTML and
node --checks every inline script block, placed before the legacy exit
path (the first version ran after process.exit(0) — a placebo).
Proven A/B on the real defect: broken source exits 1 naming the line,
fixed source exits 0.

ALSO:
- README hero + docs images are now REAL captures of the running
  v20.8.0 dashboard (scrubbed HOME, authored demo data — no private
  content; visually inspected), replacing the generated mockup.
- What's New gained the missing 20.7–20.8.0 section.
- Dead BFCL blog link -> the canonical leaderboard URL.

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: dcostenco

README.md

@@ -8,7 +8,7 @@
 [![Models on HuggingFace](https://img.shields.io/badge/🤗-prism--coder-yellow)](https://huggingface.co/dcostenco)
 
 <p align="center">
-  <img src="docs/v11_hivemind_multi_agent_dashboard.jpg" alt="Prism Coder — Mind Palace Dashboard with Knowledge Graph and Multi-Agent Hivemind" width="700" />
+  <img src="docs/mind-palace-dashboard-v20.8.png" alt="Prism Mind Palace dashboard v20.8.0 — project state with handoff summary, pending TODOs, intent health, neural graph, and time-travel history" width="700" />
 </p>
 
 Prism Coder is an [MCP server](https://modelcontextprotocol.io) that gives Claude, Cursor, and other AI tools long-term memory that survives across sessions. It ships with the open-weight `prism-coder` model fleet (2B–27B) for fast, offline tool-routing — no cloud required.
@@ -116,6 +116,29 @@ or by re-enabling after each run.
 <details>
 <summary>Release history (optional)</summary>
 
+## What's New in v20.7 – v20.8.0
+
+- **First run proves the memory instead of describing it** — `session_bootstrap`
+  seeds one demo memory and shows it *recalled from disk*, so the save→recall
+  loop is felt in session 1. One-shot, contained in its own `prism-demo`
+  project, removable with one call.
+- **Dashboard fixed** — a quoting typo (shipped 2026-05-29) killed the inline
+  script at parse time, so every dashboard since rendered "Loading projects..."
+  forever. Fixed, and the ES5 lint now `node --check`s the built inline script
+  so an unparseable dashboard can never ship again.
+- **Trusted Publishing** — npm releases authenticate via GitHub OIDC. No stored
+  token to expire or leak, and every release carries a signed [provenance
+  attestation](https://docs.npmjs.com/generating-provenance-statements) — you
+  can verify the tarball you install was built from this repo by CI
+  (`npm audit signatures`).
+- **TLS enforced for cloud sync** — a remote `http://` storage URL is upgraded
+  to `https://` instead of silently sending session content in the clear.
+- **Codex plugin collision + enabled-state detection** — `prism connect` skips
+  its own registration only when a plugin *actually* provides `prism-mcp`
+  (cache present **and** enabled), preventing both duplicate and missing
+  servers.
+- Windows CI stabilized; registry/npm listings realigned and deduplicated.
+
 ## What's New in v20.6.0
 
 ### Delivery Is Not a Suggestion
@@ -604,7 +627,7 @@ Your AI agent forgets everything between sessions. Prism fixes that — and adds
 Every conversation feeds a persistent store. The next session loads the right context automatically — no re-explaining.
 
 <p align="center">
-  <img src="docs/mind-palace-dashboard.png" alt="Mind Palace Dashboard — project state, neural graph, pending TODOs" width="700" />
+  <img src="docs/mind-palace-dashboard-v20.8-full.png" alt="Mind Palace Dashboard — full page: session ledger, memory analytics, lifecycle controls, background scheduler" width="700" />
 </p>
 
 The dashboard shows your current project state, pending TODOs, intent health, and a neural knowledge graph — all built automatically from your agent sessions.
@@ -730,7 +753,7 @@ draft that may need correction—to Synalux for authenticated deterministic
 correction. Advertised custom host tools remain local. Set
 `route_guard: "local"` for a fully on-device route path.
 
-| Model | Ollama tag | Size | [BFCL](https://gorilla.cs.berkeley.edu/blogs/12_bfcl_v3_multi_turn.html) Accuracy | Role | Automatic routing tier |
+| Model | Ollama tag | Size | [BFCL](https://gorilla.cs.berkeley.edu/leaderboard.html) Accuracy | Role | Automatic routing tier |
 |---|---|---|---|---|---|
 | Qwen3.5-4B Q3_K_M | `prism-coder:2b` | 2.3 GB | 99.1% × 3 seeds | iPhone / mobile first gate | Free |
 | Qwen3.5-4B Q4_K_M | `prism-coder:4b` | 3.4 GB | 100% × 3 seeds | Verifier | Free |

docs/mind-palace-dashboard-v20.8-full.png

@@ -89,10 +89,59 @@ lines.forEach((raw, i) => {
   }
 });
 
+// ── 3. Parse the OUTPUT, not just pattern-match the source ──────────────────
+// The 2026-05-29 XSS fix used the exact data-id pattern this lint recommends,
+// but typo'd the quoting (data-id=''' + …) — a plain SyntaxError that killed
+// the whole inline script. Every dashboard from May 29 to Aug 7 rendered
+// "Loading projects..." forever, and this lint stayed green because it looks
+// for known traps, not for validity. Pattern lists cannot enumerate typos;
+// node --check can. So: extract every quoted-string fragment concatenation is
+// impossible statically, but the assembled inline <script> in the BUILT html
+// is checkable. If the dashboard has been built, render it and syntax-check
+// each inline block; skip silently when dist/ is absent (pre-build lint runs).
+(function syntaxCheckBuiltDashboard() {
+    const path = require('path');
+    const fs = require('fs');
+    const { execFileSync } = require('child_process');
+    const os = require('os');
+    const distUi = path.join(__dirname, '..', 'dist', 'dashboard', 'ui.js');
+    if (!fs.existsSync(distUi)) return; // not built yet — CI lints post-build
+    let html;
+    try {
+        const ui = require(distUi);
+        const render = ui.renderDashboardHTML || ui.default;
+        if (typeof render !== 'function') return;
+        html = String(render('lint'));
+    } catch { return; } // rendering needs runtime state — do not fail the lint on that
+    const blocks = [...html.matchAll(/<script[^>]*>([\s\S]*?)<\/script>/g)]
+        .map(m => m[1]).filter(b => b.trim());
+    let bad = 0;
+    for (const [i, block] of blocks.entries()) {
+        const tmp = path.join(os.tmpdir(), `dash-lint-${process.pid}-${i}.js`);
+        fs.writeFileSync(tmp, block);
+        try {
+            execFileSync(process.execPath, ['--check', tmp], { stdio: 'pipe' });
+        } catch (e) {
+            bad++;
+            console.error(`✗ inline <script> block ${i} fails to parse:`);
+            console.error(String(e.stderr).split('\n').slice(0, 3).join('\n'));
+        } finally {
+            fs.unlinkSync(tmp);
+        }
+    }
+    if (bad) {
+        console.error(`${bad} inline script block(s) have syntax errors — the dashboard JS dies at parse time.`);
+        process.exit(1);
+    } else {
+        console.log(`✓ ${blocks.length} built inline script block(s) parse cleanly`);
+    }
+})();
+
 if (errors === 0) {
   console.log('[dashboard-es5] OK — no ES6 or quote-escape violations found.');
   process.exit(0);
 } else {
   console.error(`[dashboard-es5] FAIL — ${errors} violation(s) found. Fix before committing.`);
   process.exit(1);
 }
+

docs/mind-palace-dashboard-v20.8.png

@@ -1857,7 +1857,7 @@ function loadPipelines() {
                 html += '<div style="font-size:0.72rem;color:var(--accent-rose);margin-top:0.35rem;padding:0.3rem 0.5rem;background:rgba(244,63,94,0.08);border-radius:4px">⚠ ' + escapeHtml(p.error.slice(0, 200)) + '</div>';
             }
             if (isActive) {
-                html += '<div style="margin-top:0.5rem"><button onclick="abortPipeline(this.dataset.id)" data-id=''' + escapeHtml(p.id) + ''' class="cleanup-btn" style="font-size:0.72rem">🛑 Abort Pipeline</button></div>';
+                html += '<div style="margin-top:0.5rem"><button onclick="abortPipeline(this.dataset.id)" data-id="' + escapeHtml(p.id) + '" class="cleanup-btn" style="font-size:0.72rem">🛑 Abort Pipeline</button></div>';
             }
             html += '</div>';
         }