From 97b1ee5b02b85fa69e533453c8c8643ecc2ecb69 Mon Sep 17 00:00:00 2001
From: diegosouzapw <diegosouzapw@users.noreply.github.com>
Date: Tue, 24 Mar 2026 08:14:24 -0300
Subject: [PATCH] fix: sync CLI agents fingerprinting + fix dompurify XSS
 vulnerability
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Agents page: Added droid, openclaw, copilot, opencode to fingerprinting list
  (synced with CLI Tools — now 14 providers total)
- Fixed dompurify XSS vulnerability (GHSA-v2wj-7wpq-c8vv) via npm overrides
  forcing dompurify ^3.3.2 across all transitive deps (monaco-editor)
- npm audit now reports 0 vulnerabilities
---
 package-lock.json                             | 9 ---------
 package.json                                  | 3 +++
 src/app/(dashboard)/dashboard/agents/page.tsx | 4 ++++
 3 files changed, 7 insertions(+), 9 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index 701a1cd4d0..4565e9edfd 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -14606,15 +14606,6 @@
         "marked": "14.0.0"
       }
     },
-    "node_modules/monaco-editor/node_modules/dompurify": {
-      "version": "3.2.7",
-      "resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.2.7.tgz",
-      "integrity": "sha512-WhL/YuveyGXJaerVlMYGWhvQswa7myDG17P7Vu65EWC05o8vfeNbvNf4d/BOvH99+ZW+LlQsc1GDKMa1vNK6dw==",
-      "license": "(MPL-2.0 OR Apache-2.0)",
-      "optionalDependencies": {
-        "@types/trusted-types": "^2.0.7"
-      }
-    },
     "node_modules/motion": {
       "version": "12.38.0",
       "resolved": "https://registry.npmjs.org/motion/-/motion-12.38.0.tgz",
diff --git a/package.json b/package.json
index b5b4aa8958..74a4457736 100644
--- a/package.json
+++ b/package.json
@@ -155,5 +155,8 @@
       "omniroute",
       "sharp"
     ]
+  },
+  "overrides": {
+    "dompurify": "^3.3.2"
   }
 }
diff --git a/src/app/(dashboard)/dashboard/agents/page.tsx b/src/app/(dashboard)/dashboard/agents/page.tsx
index ced0e67c8f..82806ac9c4 100644
--- a/src/app/(dashboard)/dashboard/agents/page.tsx
+++ b/src/app/(dashboard)/dashboard/agents/page.tsx
@@ -205,6 +205,10 @@ export default function AgentsPage() {
                 "kilocode",
                 "cline",
                 "qwen",
+                "droid",
+                "openclaw",
+                "copilot",
+                "opencode",
               ] as const
             ).map((providerId) => {
               const providerMeta = Object.values(AI_PROVIDERS).find(