Task titles, notes, subtask text, and section names from the opened task
file, plus memory file and directory names, were interpolated into
innerHTML template strings unescaped, so markup in that content was parsed
as HTML when the dashboard rendered.
- Route every such interpolation through the existing escapeHtml() helper.
- Make escapeHtml() also escape quotes so it is safe inside attribute
values (data-tab, data-search, placeholder).
- Replace the inline onclick/oninput handlers that embedded file and
directory names in JavaScript string literals with addEventListener,
matching the pattern the rest of the file already uses.
- Bump plugin version to 1.3.1.
The ms365 / microsoft-365 entries ship M365 as a manual type:http MCP
server. That auth path cannot succeed: the M365 server's OAuth client
registration only permits the claude.ai callback, so any client-initiated
OAuth flow (localhost or claude:// redirect) is rejected by the identity
provider before the consent screen ever shows (AADSTS50011).
Users connect Microsoft 365 through the claude.ai Connectors directory
instead, which uses the registered callback and works. Plugin skills
reference tools via ~~category placeholders (see CONNECTORS.md), not the
ms365 server key, so no content changes are needed.
Bumps each touched plugin's version so the update distributes to
existing installs.
Co-authored-by: Claude <noreply@anthropic.com>
Jake Marsh