Fix XSS, VJP contract, binding, session security, name collisions, and error handling

1. XSS: Add esc() helper to sanitize all user/LLM data interpolated into
innerHTML (logStep, gradient table details, eval log, bias audit table).
2. VJP contract: Backend analyze_gradient() now returns structured ranked
data alongside text; frontend renders from backend rankings instead of
recomputing unweighted averages.
3. Bind uvicorn to 127.0.0.1 instead of 0.0.0.0.
4. Session-bound tickets: store sid in counterfactual ticket and verify on
stream pickup.
5. Name collision: use composite key (name_user_id) for cohort_map in both
web app and scripts to avoid persona lookup collisions; propagate
user_id through _evaluator dict.
6. Counterfactual error handling: add try-catch around fut.result() matching
the evaluate stream pattern.

scripts/counterfactual.py

@@ -89,10 +89,20 @@ def build_changes_block(changes):
     return "\n".join(lines)
 
 
+def _cohort_lookup(cohort_map, ev):
+    """Look up persona by composite key (name_user_id), falling back to name."""
+    name = ev.get("name", "")
+    uid = ev.get("user_id", "")
+    key = f"{name}_{uid}"
+    if key in cohort_map:
+        return cohort_map[key]
+    return cohort_map.get(name, {})
+
+
 def probe_one(client, model, eval_result, cohort_map, all_changes):
     ev = eval_result.get("_evaluator", {})
     name = ev.get("name", "")
-    persona_text = cohort_map.get(name, {}).get("persona", "")
+    persona_text = _cohort_lookup(cohort_map, ev).get("persona", "")
 
     prompt = PROBE_PROMPT.format(
         name=name, age=ev.get("age", ""),
@@ -150,10 +160,17 @@ def compute_goal_weights(client, model, eval_results, cohort_map, goal, parallel
     """Score each evaluator's relevance to the goal. Returns {name: weight}."""
     weights = {}
 
+    def _eval_key(ev):
+        """Composite key matching cohort_map keys to avoid name collisions."""
+        name = ev.get("name", "")
+        uid = ev.get("user_id", "")
+        return f"{name}_{uid}" if uid else name
+
     def score_one(r):
         ev = r.get("_evaluator", {})
         name = ev.get("name", "")
-        persona = cohort_map.get(name, {})
+        key = _eval_key(ev)
+        persona = _cohort_lookup(cohort_map, ev)
         prompt = GOAL_RELEVANCE_PROMPT.format(
             goal=goal, name=name, age=ev.get("age", ""),
             occupation=ev.get("occupation", ""),
@@ -170,15 +187,15 @@ def compute_goal_weights(client, model, eval_results, cohort_map, goal, parallel
             content = resp.choices[0].message.content
             content = re.sub(r'<think>[\s\S]*?</think>', '', content).strip()
             data = json.loads(content)
-            return name, float(data.get("relevance", 0.5)), data.get("reasoning", "")
+            return key, float(data.get("relevance", 0.5)), data.get("reasoning", "")
         except Exception:
-            return name, 0.5, "default"
+            return key, 0.5, "default"
 
     with concurrent.futures.ThreadPoolExecutor(max_workers=parallel) as pool:
         futs = [pool.submit(score_one, r) for r in eval_results]
         for fut in concurrent.futures.as_completed(futs):
-            name, weight, reasoning = fut.result()
-            weights[name] = {"weight": weight, "reasoning": reasoning}
+            key, weight, reasoning = fut.result()
+            weights[key] = {"weight": weight, "reasoning": reasoning}
 
     return weights
 
@@ -186,22 +203,26 @@ def compute_goal_weights(client, model, eval_results, cohort_map, goal, parallel
 def analyze_gradient(results, all_changes, goal_weights=None):
     valid = [r for r in results if "counterfactuals" in r]
     if not valid:
-        return "No valid results."
+        return "No valid results.", []
 
     has_goal = goal_weights is not None
     labels = {c["id"]: c["label"] for c in all_changes}
     jacobian = defaultdict(list)
 
     for r in valid:
-        name = r["_evaluator"].get("name", "")
-        w = goal_weights.get(name, {}).get("weight", 1.0) if has_goal else 1.0
+        ev = r["_evaluator"]
+        name = ev.get("name", "")
+        uid = ev.get("user_id", "")
+        key = f"{name}_{uid}" if uid else name
+        w = goal_weights.get(key, {}).get("weight", 1.0) if has_goal else 1.0
         for cf in r.get("counterfactuals", []):
             jacobian[cf.get("change_id", "")].append({
                 "delta": cf.get("delta", 0),
                 "weighted_delta": cf.get("delta", 0) * w,
                 "weight": w,
                 "name": name,
-                "age": r["_evaluator"].get("age", ""),
+                "age": ev.get("age", ""),
+                "occupation": ev.get("occupation", ""),
                 "reasoning": cf.get("reasoning", ""),
             })
 
@@ -268,7 +289,22 @@ def analyze_gradient(results, all_changes, goal_weights=None):
                 lines.append(f"  {d['delta']} {d['name']} ({d['age']}){w_label}: {d['reasoning']}")
         lines.append("")
 
-    return "\n".join(lines)
+    # Return ranked data alongside text for structured consumers (web UI)
+    ranked_data = [{
+        "id": r["id"], "label": r["label"],
+        "avg_delta": round(r["avg_delta"], 2),
+        "raw_avg_delta": round(r["raw_avg_delta"], 2),
+        "max_delta": r["max_delta"], "min_delta": r["min_delta"],
+        "positive": r["positive"], "negative": r["negative"],
+        "n": r["n"],
+        "details": sorted([{
+            "name": d["name"], "age": d.get("age", ""),
+            "occupation": d.get("occupation", ""),
+            "delta": d["delta"], "reasoning": d.get("reasoning", ""),
+        } for d in r["details"]], key=lambda x: x["delta"], reverse=True),
+    } for r in ranked]
+
+    return "\n".join(lines), ranked_data
 
 
 def main():
@@ -300,7 +336,7 @@ def main():
         for cat in changes_data.values():
             all_changes.extend(cat if isinstance(cat, list) else cat.get("changes", []))
 
-    cohort_map = {p["name"]: p for p in cohort}
+    cohort_map = {f"{p.get('name','')}_{p.get('user_id','')}": p for p in cohort}
 
     movable = [r for r in eval_results
                 if "score" in r and args.min_score <= r["score"] <= args.max_score]
@@ -356,7 +392,7 @@ def main():
         relevant = sum(1 for v in goal_weights.values() if v["weight"] >= 0.5)
         print(f"  {relevant}/{len(goal_weights)} evaluators relevant to goal\n")
 
-    gradient = analyze_gradient(results, all_changes, goal_weights=goal_weights)
+    gradient, _ranked = analyze_gradient(results, all_changes, goal_weights=goal_weights)
     with open(out_dir / "gradient.md", "w") as f:
         f.write(gradient)
 

scripts/evaluate.py

@@ -125,6 +125,7 @@ def evaluate_one(client, model, evaluator, entity_text, system_prompt=None):
         result = json.loads(content)
         result["_evaluator"] = {
             "name": evaluator["name"],
+            "user_id": evaluator.get("user_id"),
             "age": evaluator.get("age"),
             "city": evaluator.get("city"),
             "state": evaluator.get("state"),

web/app.py

@@ -583,7 +583,7 @@ async def prepare_counterfactual(sid: str, req: CounterfactualRequest):
     expired = [k for k, v in _cf_pending.items() if now - v.get("ts", 0) > 600]
     for k in expired:
         del _cf_pending[k]
-    _cf_pending[ticket] = {"req": req, "ts": now}
+    _cf_pending[ticket] = {"req": req, "ts": now, "sid": sid}
     return {"ticket": ticket}
 
 
@@ -598,6 +598,8 @@ async def counterfactual_stream(sid: str, ticket: str):
     entry = _cf_pending.pop(ticket, None)
     if not entry:
         raise HTTPException(400, "Invalid or expired ticket")
+    if entry.get("sid") != sid:
+        raise HTTPException(403, "Ticket does not belong to this session")
     req = entry["req"]
 
     all_changes = req.changes
@@ -611,7 +613,7 @@ async def counterfactual_stream(sid: str, ticket: str):
         model = get_model()
         cohort = session["cohort"]
         eval_results = session["eval_results"]
-        cohort_map = {p["name"]: p for p in cohort}
+        cohort_map = {f"{p.get('name','')}_{p.get('user_id','')}": p for p in cohort}
 
         movable = [r for r in eval_results
                    if "score" in r and min_score <= r["score"] <= max_score]
@@ -659,7 +661,10 @@ async def counterfactual_stream(sid: str, ticket: str):
             }
             for fut in concurrent.futures.as_completed(futs):
                 idx = futs[fut]
-                result = fut.result()
+                try:
+                    result = fut.result()
+                except Exception as e:
+                    result = {"error": str(e), "_evaluator": {"name": "?"}}
                 results[idx] = result
                 done += 1
 
@@ -678,13 +683,14 @@ async def counterfactual_stream(sid: str, ticket: str):
                 yield {"event": "progress", "data": json.dumps(progress)}
 
         elapsed = time.time() - t0
-        gradient_text = analyze_gradient(results, all_changes,
-                                         goal_weights=goal_weights)
+        gradient_text, ranked_data = analyze_gradient(results, all_changes,
+                                                      goal_weights=goal_weights)
         session["gradient"] = gradient_text
 
         yield {"event": "complete", "data": json.dumps({
             "elapsed": round(elapsed, 1),
             "gradient": gradient_text,
+            "ranked": ranked_data,
             "results": results,
             "goal": goal if has_goal else None,
         })}
@@ -830,4 +836,4 @@ if __name__ == "__main__":
     import uvicorn
     print(f"\n  SGO Web Interface")
     print(f"  http://localhost:8000\n")
-    uvicorn.run(app, host="0.0.0.0", port=8000)
+    uvicorn.run(app, host="127.0.0.1", port=8000)

web/static/index.html

@@ -558,6 +558,17 @@ const TEMPLATES = {
 let sessionId = null;
 let evalResultsData = null;
 
+// XSS sanitization helper
+function esc(str) {
+  if (str == null) return '';
+  return String(str)
+    .replace(/&/g, '&')
+    .replace(/</g, '&lt;')
+    .replace(/>/g, '&gt;')
+    .replace(/"/g, '&quot;')
+    .replace(/'/g, '&#039;');
+}
+
 // ── Init ──
 
 async function init() {
@@ -652,7 +663,7 @@ function goToStep(n) {
 
 function logStep(msg, cls = '') {
   const log = document.getElementById('evalLog');
-  log.innerHTML += `<div class="${cls}">${msg}</div>`;
+  log.innerHTML += `<div class="${esc(cls)}">${esc(msg)}</div>`;
   log.scrollTop = log.scrollHeight;
 }
 
@@ -875,7 +886,7 @@ async function runDirections() {
 
     const log = document.getElementById('cfLog');
     concerns.slice(0, 8).forEach(c => {
-      log.innerHTML += `<div style="color:var(--text2)">Concern: ${c}</div>`;
+      log.innerHTML += `<div style="color:var(--text2)">Concern: ${esc(c)}</div>`;
     });
     log.innerHTML += `<div>${concerns.length} unique concerns from ${persuadable.length} persuadable evaluators</div>`;
     document.getElementById('cfProgressBar').style.width = '15%';
@@ -891,7 +902,7 @@ async function runDirections() {
     suggestedChanges = suggestData.changes || [];
 
     suggestedChanges.forEach(c => {
-      log.innerHTML += `<div class="pos">Change: ${c.label} — ${c.description}</div>`;
+      log.innerHTML += `<div class="pos">Change: ${esc(c.label)} — ${esc(c.description)}</div>`;
     });
     log.scrollTop = log.scrollHeight;
     document.getElementById('cfProgressBar').style.width = '25%';
@@ -926,7 +937,7 @@ async function runDirections() {
       es.addEventListener('goal_weights', (e) => {
         const d = JSON.parse(e.data);
         document.getElementById('cfProgressText').textContent = d.message;
-        log.innerHTML += `<div>${d.message}</div>`;
+        log.innerHTML += `<div>${esc(d.message)}</div>`;
         log.scrollTop = log.scrollHeight;
       });
 
@@ -938,7 +949,7 @@ async function runDirections() {
 
         const delta = d.best_delta > 0 ? `+${d.best_delta}` : d.best_delta;
         const changeName = (suggestedChanges.find(c => c.id === d.best_change) || {}).label || d.best_change;
-        log.innerHTML += `<div>${d.name} (orig ${d.original_score}): best ${delta} from "${changeName}"</div>`;
+        log.innerHTML += `<div>${esc(d.name)} (orig ${d.original_score}): best ${delta} from "${esc(changeName)}"</div>`;
         log.scrollTop = log.scrollHeight;
       });
 
@@ -955,7 +966,7 @@ async function runDirections() {
           return;
         }
 
-        renderGradientTable(d.results, suggestedChanges);
+        renderGradientTable(d.results, suggestedChanges, d.ranked);
         document.getElementById('gradientText').textContent = d.gradient;
         document.getElementById('changesTested').textContent =
           suggestedChanges.map(c => `${c.label}: ${c.description}`).join('\n');
@@ -971,48 +982,55 @@ async function runDirections() {
   }
 }
 
-function renderGradientTable(results, changes) {
-  const valid = results.filter(r => r && r.counterfactuals);
-  const labels = {};
-  const descs = {};
-  changes.forEach(c => { labels[c.id] = c.label; descs[c.id] = c.description; });
-
-  // Aggregate with per-evaluator details
-  const byChange = {};
-  valid.forEach(r => {
-    const ev = r._evaluator || {};
-    (r.counterfactuals || []).forEach(cf => {
-      const cid = cf.change_id;
-      if (!byChange[cid]) byChange[cid] = {deltas: [], pos: 0, neg: 0, details: []};
-      const delta = cf.delta || 0;
-      byChange[cid].deltas.push(delta);
-      if (delta > 0) byChange[cid].pos++;
-      if (delta < 0) byChange[cid].neg++;
-      byChange[cid].details.push({
-        name: ev.name || '?',
-        age: ev.age || '',
-        occupation: ev.occupation || '',
-        delta: delta,
-        reasoning: cf.reasoning || '',
+function renderGradientTable(results, changes, ranked) {
+  // Use backend-provided ranked data (respects goal weights / VJP) when available,
+  // falling back to client-side aggregation only for legacy responses.
+  if (!ranked || !ranked.length) {
+    // Legacy fallback: recompute from raw results (unweighted)
+    const valid = results.filter(r => r && r.counterfactuals);
+    const labels = {};
+    const descs = {};
+    changes.forEach(c => { labels[c.id] = c.label; descs[c.id] = c.description; });
+    const byChange = {};
+    valid.forEach(r => {
+      const ev = r._evaluator || {};
+      (r.counterfactuals || []).forEach(cf => {
+        const cid = cf.change_id;
+        if (!byChange[cid]) byChange[cid] = {deltas: [], pos: 0, neg: 0, details: []};
+        const delta = cf.delta || 0;
+        byChange[cid].deltas.push(delta);
+        if (delta > 0) byChange[cid].pos++;
+        if (delta < 0) byChange[cid].neg++;
+        byChange[cid].details.push({
+          name: ev.name || '?', age: ev.age || '',
+          occupation: ev.occupation || '', delta, reasoning: cf.reasoning || '',
+        });
       });
     });
-  });
-
-  const ranked = Object.entries(byChange).map(([cid, d]) => {
-    const avg = d.deltas.reduce((a, b) => a + b, 0) / d.deltas.length;
-    const min = Math.min(...d.deltas);
-    const max = Math.max(...d.deltas);
-    d.details.sort((a, b) => b.delta - a.delta);
-    return {id: cid, label: labels[cid] || cid, desc: descs[cid] || '', avg, min, max, pos: d.pos, neg: d.neg, details: d.details};
-  });
-  ranked.sort((a, b) => b.avg - a.avg);
+    ranked = Object.entries(byChange).map(([cid, d]) => {
+      const avg = d.deltas.reduce((a, b) => a + b, 0) / d.deltas.length;
+      d.details.sort((a, b) => b.delta - a.delta);
+      return {
+        id: cid, label: labels[cid] || cid, desc: descs[cid] || '',
+        avg_delta: avg, min_delta: Math.min(...d.deltas), max_delta: Math.max(...d.deltas),
+        positive: d.pos, negative: d.neg, details: d.details,
+      };
+    });
+    ranked.sort((a, b) => b.avg_delta - a.avg_delta);
+  } else {
+    // Attach descriptions from changes list
+    const descs = {};
+    changes.forEach(c => { descs[c.id] = c.description; });
+    ranked.forEach(r => { if (!r.desc) r.desc = descs[r.id] || ''; });
+  }
 
   const tbody = document.querySelector('#gradientTable tbody');
   tbody.innerHTML = '';
   ranked.forEach((r, i) => {
-    const cls = r.avg >= 0 ? 'delta-pos' : 'delta-neg';
-    const barWidth = Math.min(Math.abs(r.avg) * 30, 120);
-    const barColor = r.avg >= 0 ? 'var(--green)' : 'var(--red)';
+    const avg = r.avg_delta;
+    const cls = avg >= 0 ? 'delta-pos' : 'delta-neg';
+    const barWidth = Math.min(Math.abs(avg) * 30, 120);
+    const barColor = avg >= 0 ? 'var(--green)' : 'var(--red)';
     const rowId = `gradient-detail-${i}`;
 
     // Summary row (clickable)
@@ -1020,35 +1038,36 @@ function renderGradientTable(results, changes) {
       <tr onclick="document.getElementById('${rowId}').classList.toggle('hidden')" style="cursor:pointer">
         <td>${i + 1}</td>
         <td>
-          <div style="font-weight:600">${r.label}</div>
-          <div style="font-size:0.75rem;color:var(--text2);margin-top:2px">${r.desc}</div>
+          <div style="font-weight:600">${esc(r.label)}</div>
+          <div style="font-size:0.75rem;color:var(--text2);margin-top:2px">${esc(r.desc)}</div>
         </td>
         <td class="${cls}">
-          ${r.avg >= 0 ? '+' : ''}${r.avg.toFixed(1)}
+          ${avg >= 0 ? '+' : ''}${avg.toFixed(1)}
           <span class="delta-bar" style="width:${barWidth}px;background:${barColor};margin-left:8px"></span>
         </td>
-        <td style="color:var(--text2)">${r.min >= 0 ? '+' : ''}${r.min} to +${r.max}</td>
-        <td style="color:var(--green)">${r.pos}</td>
-        <td style="color:var(--red)">${r.neg}</td>
+        <td style="color:var(--text2)">${r.min_delta >= 0 ? '+' : ''}${r.min_delta} to +${r.max_delta}</td>
+        <td style="color:var(--green)">${r.positive}</td>
+        <td style="color:var(--red)">${r.negative}</td>
       </tr>
     `;
 
     // Detail row (hidden by default)
-    const helped = r.details.filter(d => d.delta > 0).slice(0, 5);
-    const hurt = r.details.filter(d => d.delta < 0).slice(0, 3);
-    const neutral = r.details.filter(d => d.delta === 0).length;
+    const details = r.details || [];
+    const helped = details.filter(d => d.delta > 0).slice(0, 5);
+    const hurt = details.filter(d => d.delta < 0).slice(0, 3);
+    const neutral = details.filter(d => d.delta === 0).length;
 
     let detailHtml = '<div style="padding:12px 16px;font-size:0.8rem;line-height:1.6">';
     if (helped.length) {
       detailHtml += '<div style="color:var(--green);font-weight:600;margin-bottom:4px">Helps:</div>';
       helped.forEach(d => {
-        detailHtml += `<div style="margin-left:12px;margin-bottom:4px">+${d.delta} <strong>${d.name}</strong> (${d.age}, ${d.occupation}): ${d.reasoning}</div>`;
+        detailHtml += `<div style="margin-left:12px;margin-bottom:4px">+${d.delta} <strong>${esc(d.name)}</strong> (${esc(d.age)}, ${esc(d.occupation)}): ${esc(d.reasoning)}</div>`;
       });
     }
     if (hurt.length) {
       detailHtml += '<div style="color:var(--red);font-weight:600;margin-top:8px;margin-bottom:4px">Hurts:</div>';
       hurt.forEach(d => {
-        detailHtml += `<div style="margin-left:12px;margin-bottom:4px">${d.delta} <strong>${d.name}</strong> (${d.age}, ${d.occupation}): ${d.reasoning}</div>`;
+        detailHtml += `<div style="margin-left:12px;margin-bottom:4px">${d.delta} <strong>${esc(d.name)}</strong> (${esc(d.age)}, ${esc(d.occupation)}): ${esc(d.reasoning)}</div>`;
       });
     }
     if (neutral) {
@@ -1121,7 +1140,7 @@ function runBiasAudit() {
 
     d.analyses.forEach(a => {
       if (a.error) {
-        tbody.innerHTML += `<tr><td>${a.probe}</td><td colspan="4">Error: ${a.error}</td></tr>`;
+        tbody.innerHTML += `<tr><td>${esc(a.probe)}</td><td colspan="4">Error: ${esc(a.error)}</td></tr>`;
         return;
       }
       const expected = baselines[a.probe];
@@ -1137,7 +1156,7 @@ function runBiasAudit() {
 
       tbody.innerHTML += `
         <tr>
-          <td style="font-weight:600">${a.probe}</td>
+          <td style="font-weight:600">${esc(a.probe)}</td>
           <td>${a.shifted_pct.toFixed(1)}%</td>
           <td>${a.avg_abs_delta.toFixed(2)}</td>
           <td style="color:var(--text2)">${expected !== undefined ? expected + '%' : '—'}</td>