@minionry/minion 0.7.36

package/dist/server/services/plan/agents/triage-findings.md

@@ -0,0 +1,78 @@
+---
+name: triage-findings
+description: "Relevance triage for programmatic code-quality findings — reads the actual code and decides which tool/heuristic findings are real issues vs. noise, so a cohesive long file or a justified complex function is not penalized. Use between programmatic detection and the AI deep review."
+user-invocable: false
+allowed-tools: Read, Grep, Glob, Bash
+context: fork
+variables: [dirPath, findingsJson]
+---
+
+You are a pragmatic senior engineer triaging the output of automated code-quality tools. The tools (linters, formatters, complexity analyzers, file/function-length heuristics) optimize for RECALL — they flag everything that *might* matter. Your job is PRECISION: read the real code and decide which findings a thoughtful reviewer would actually act on, and which are technically-true-but-not-an-issue noise.
+
+IMPORTANT: Your current working directory is "{{dirPath}}". Only read files within this directory. You do NOT fix anything and you do NOT invent new findings — you only classify the findings below.
+
+## Findings to triage
+
+{{findingsJson}}
+
+## Process
+
+For each finding:
+
+1. **Read the cited file** around the cited line (use Read; use Grep/Glob for surrounding context). Group findings by file so you read each file once.
+2. **Judge whether it is a real, worth-fixing issue in THIS codebase**, not in the abstract.
+3. Assign one status:
+   - **`confirmed`** — a real issue a good reviewer would want addressed. This is the default for findings from trusted tools (lint errors, build/compile errors, formatter violations, security/bug findings) unless you have strong evidence the tool is wrong.
+   - **`likely-fp`** — technically flagged, but not an actual problem here (a false positive or a non-issue). Use this for noise. The finding stays visible to the user but is excluded from the grade.
+   - **`uncertain`** — you genuinely cannot tell from the code whether it matters. Excluded from the grade.
+
+## Rubric for the noisy categories
+
+These categories produce most of the false positives. Apply judgment, not the raw threshold:
+
+### `file-length` (long file)
+- **`likely-fp`** when the file is *cohesive*: a single clear responsibility, a shared domain vocabulary, reads top-to-bottom, mostly one class/type plus its private helpers, or many small independent declarations of the same kind (e.g. a constants/registry/route table). Length alone is NOT a defect. A 1000-line file that does one thing well is fine.
+- **`confirmed`** (low/medium) when the file *mixes unrelated concerns* — several independent export groups, multiple unrelated domains (e.g. config + parsing + rendering + IO in one file), or a clear seam where it should be split.
+- **Always `confirmed`** when the file is extreme (> ~1500 lines) regardless of cohesion — that much in one file is hard to navigate even when focused.
+
+### `function-length` (long function)
+- **`likely-fp`** when the function is long but *linear and readable* — a flat sequence (config builder, big switch/dispatch, sequential setup) with little nesting. Many short composable steps in one function are fine.
+- **`confirmed`** when it is long AND *branchy/deeply nested* — high decision-point density, nested conditionals, does several distinct things. Severity scales with branchiness.
+
+### `complexity` (cyclomatic/cognitive)
+- **`likely-fp`** when the complexity is *inherent and well-structured* — e.g. an unavoidable parser/state-machine/switch that is clearly written. High cyclomatic count from a flat switch is usually fine.
+- **`confirmed`** when the complexity comes from *tangled nesting* a reader has to hold in their head.
+
+### `lint` / `linting`
+- Trust the linter by default → **`confirmed`**. Only mark `likely-fp` if the rule is clearly misfiring on this specific code (e.g. an intentional, commented pattern).
+
+### `format`
+- **`confirmed`** (these are deterministic and trivially auto-fixable). Keep low severity.
+
+### `build`
+- Compile/build errors are **always `confirmed`**, critical. Never downgrade.
+
+### `security` / `bugs` / `logic` / `performance`
+- Default **`confirmed`**. Only `likely-fp` with concrete counter-evidence in the code (a guard/sanitizer exists, the path is unreachable, etc.).
+
+## Severity
+
+You may CORRECT a finding's severity when the tool over- or under-stated it (e.g. drop a cohesive-but-flagged complexity finding to `low`, or raise a genuinely dangerous one). Calibrate by likelihood × user impact. If you don't change it, omit the `severity` field.
+
+## Output
+
+Output EXACTLY one JSON code block, then nothing else. Include one verdict per finding id.
+
+```json
+{
+  "verdicts": [
+    {
+      "id": 1,
+      "status": "confirmed|likely-fp|uncertain",
+      "confidence": 0.9,
+      "rationale": "One concise sentence grounded in what you saw in the code.",
+      "severity": "critical|high|medium|low"
+    }
+  ]
+}
+```

package/dist/server/services/plan/agents/verify-review.md

@@ -0,0 +1,57 @@
+---
+name: verify-review
+description: "Independent verification pass for code review findings — skeptically re-checks each finding against actual code to catch hallucinations and false positives. Use after an AI code review to validate findings."
+user-invocable: false
+allowed-tools: Read, Grep, Glob, Bash
+context: fork
+variables: [dirPath, findingsJson]
+---
+
+You are an independent code review VERIFIER. A separate reviewer produced the findings below. Your job is to VERIFY each finding against the actual code. You are a skeptic — do NOT trust the original reviewer's claims.
+
+IMPORTANT: Your current working directory is "{{dirPath}}". Only read files within this directory.
+
+## Findings to Verify
+
+{{findingsJson}}
+
+## Verification Process
+
+For EACH finding:
+
+1. **Read the cited file and line** using the Read tool. Read at least 20 lines around the cited line for context.
+2. **Check the specific claim** in the description. Does the code actually do what the finding claims?
+3. **Search for counter-evidence**:
+   - If the finding claims something is missing (no validation, no cleanup, no guard): search for it with Grep
+   - If the finding claims an API is used: verify the actual API call at that line
+   - If the finding claims a value is leaked/exposed: check if it's filtered/deleted elsewhere in the same function
+4. **Verdict**: Mark as "confirmed" or "rejected" with a brief explanation
+
+## Rules
+
+- You MUST actually Read each cited file. Do not rely on memory or assumptions.
+- Use Grep to search for patterns the finding claims exist (or don't exist).
+- A finding is "rejected" if:
+  - The code does NOT match what the description claims
+  - There IS a guard/fix that the finding claims is missing
+  - The line number doesn't contain the relevant code
+  - The finding is about a different version of the code than what exists now
+- A finding is "confirmed" if you can independently verify the issue exists in the current code.
+- Be thorough but efficient — focus verification effort on high/critical severity findings.
+
+## Output
+
+Output EXACTLY one JSON code block. No other text after the JSON block.
+
+```json
+{
+  "verifications": [
+    {
+      "id": 1,
+      "verdict": "confirmed|rejected",
+      "confidence": 0.95,
+      "note": "Brief explanation of what you found when checking the code"
+    }
+  ]
+}
+```

package/dist/server/services/plan/approval-evaluator.js

@@ -0,0 +1,143 @@
+// Copyright (c) 2025-present Minionry, Inc.
+// SPDX-License-Identifier: LicenseRef-Minionry-Software
+export const DEFAULT_STRATEGY_THRESHOLDS = {
+    requireApprovalFor: ['pricing', 'positioning', 'direction', 'brand'],
+    minSeverity: 'medium',
+};
+export function getStrategyTriggers(template) {
+    return template?.board?.strategy_approval_triggers ?? [];
+}
+function collectTriggerEvidence(output, trigger, diagnostics) {
+    const evidence = [];
+    for (const keyword of trigger.keywords ?? []) {
+        const ev = findKeywordEvidence(output, keyword);
+        if (ev)
+            evidence.push(ev);
+    }
+    for (const patternSrc of trigger.patterns ?? []) {
+        let pattern;
+        try {
+            pattern = new RegExp(patternSrc, 'i');
+        }
+        catch (err) {
+            diagnostics.push(`Trigger "${trigger.id}" pattern "${patternSrc}" is invalid: ${err instanceof Error ? err.message : String(err)}`);
+            continue;
+        }
+        const ev = findPatternEvidence(output, patternSrc, pattern);
+        if (ev)
+            evidence.push(ev);
+    }
+    return evidence;
+}
+export function evaluateStrategyChange(output, triggers, ctx) {
+    const result = { hits: [], advisory: [], diagnostics: [] };
+    if (!output || triggers.length === 0)
+        return result;
+    const thresholds = ctx.thresholds ?? DEFAULT_STRATEGY_THRESHOLDS;
+    const minSeverityRank = severityRank(thresholds.minSeverity);
+    const requireSet = new Set(thresholds.requireApprovalFor);
+    for (const trigger of triggers) {
+        if (!triggerAppliesToIssue(trigger, ctx.issueId))
+            continue;
+        const evidence = collectTriggerEvidence(output, trigger, result.diagnostics);
+        const minHits = Math.max(1, trigger.min_hits ?? 1);
+        if (evidence.length < minHits)
+            continue;
+        const severity = trigger.severity ?? 'medium';
+        const hit = {
+            triggerId: trigger.id,
+            category: trigger.category,
+            severity,
+            description: trigger.description ?? defaultDescription(trigger.category, severity),
+            evidence,
+            requiresApproval: severityRank(severity) >= minSeverityRank && requireSet.has(trigger.category),
+        };
+        if (hit.requiresApproval)
+            result.hits.push(hit);
+        else
+            result.advisory.push(hit);
+    }
+    return result;
+}
+export function buildApprovalRequest(hit, args) {
+    const evidenceSummary = hit.evidence
+        .slice(0, 5)
+        .map((e) => `• [${e.kind}] ${e.source}: "${truncate(e.snippet, 160)}"`)
+        .join('\n');
+    const description = [
+        hit.description,
+        '',
+        `Category: ${hit.category} (severity: ${hit.severity})`,
+        `Issue: ${args.issueId}`,
+        `Trigger: ${hit.triggerId}`,
+        '',
+        'Evidence:',
+        evidenceSummary || '(no detailed evidence — keyword match only)',
+    ].join('\n');
+    return {
+        type: 'strategy',
+        title: truncate(args.titleOverride ?? hit.description, 500),
+        description: truncate(description, 8000),
+        requestedBy: args.requestedBy,
+        departmentId: args.departmentId ?? null,
+        executionId: args.executionId ?? null,
+        estimatedCostCents: null,
+    };
+}
+const SEVERITY_ORDER = {
+    low: 0,
+    medium: 1,
+    high: 2,
+};
+function severityRank(s) {
+    return SEVERITY_ORDER[s] ?? 1;
+}
+function triggerAppliesToIssue(trigger, issueId) {
+    if (!trigger.applies_to || trigger.applies_to.length === 0)
+        return true;
+    return trigger.applies_to.includes(issueId);
+}
+function findKeywordEvidence(haystack, keyword) {
+    if (!keyword)
+        return null;
+    const escaped = escapeRegex(keyword);
+    const re = new RegExp(`(^|\\W)(${escaped})(\\W|$)`, 'i');
+    const match = re.exec(haystack);
+    if (!match)
+        return null;
+    const matchIdx = match.index + match[1].length;
+    return {
+        kind: 'keyword',
+        source: keyword,
+        snippet: extractSnippet(haystack, matchIdx, keyword.length),
+    };
+}
+function findPatternEvidence(haystack, source, pattern) {
+    const match = pattern.exec(haystack);
+    if (!match)
+        return null;
+    return {
+        kind: 'pattern',
+        source,
+        snippet: extractSnippet(haystack, match.index, match[0].length),
+    };
+}
+function extractSnippet(text, idx, len) {
+    const radius = 60;
+    const start = Math.max(0, idx - radius);
+    const end = Math.min(text.length, idx + len + radius);
+    const prefix = start > 0 ? '…' : '';
+    const suffix = end < text.length ? '…' : '';
+    return `${prefix}${text.slice(start, end).replace(/\s+/g, ' ').trim()}${suffix}`;
+}
+function escapeRegex(s) {
+    return s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+function truncate(s, max) {
+    if (s.length <= max)
+        return s;
+    return `${s.slice(0, max - 1)}…`;
+}
+function defaultDescription(category, severity) {
+    return `Proposed ${severity}-severity ${category} change requires owner approval before publishing.`;
+}

package/dist/server/services/plan/board-archive.js

@@ -0,0 +1,102 @@
+// Copyright (c) 2025-present Minionry, Inc.
+// SPDX-License-Identifier: LicenseRef-Minionry-Software
+import { readdirSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { unzipSync, zipSync } from 'fflate';
+import { parseBoardDirectory } from './parser.js';
+import { parseFrontMatter } from './parser-core.js';
+export const TEMPLATE_MANIFEST_NAME = 'minionry-template.json';
+export const TEMPLATE_FORMAT = 'minionry-board-template';
+const MAX_ENTRIES = 2000;
+const MAX_TOTAL_UNCOMPRESSED = 200 * 1024 * 1024;
+function collectFiles(dir, base, out) {
+    for (const entry of readdirSync(dir, { withFileTypes: true })) {
+        if (entry.isSymbolicLink())
+            continue;
+        const abs = join(dir, entry.name);
+        const rel = base ? `${base}/${entry.name}` : entry.name;
+        if (entry.isDirectory()) {
+            collectFiles(abs, rel, out);
+        }
+        else if (entry.isFile()) {
+            out[rel] = readFileSync(abs);
+        }
+    }
+}
+export function packBoardArchive(pmDir, boardId) {
+    const boardState = parseBoardDirectory(pmDir, boardId);
+    if (!boardState)
+        throw new Error(`Board not found: ${boardId}`);
+    const files = {};
+    collectFiles(join(pmDir, 'boards', boardId), '', files);
+    const manifest = {
+        format: TEMPLATE_FORMAT,
+        version: 1,
+        boardId,
+        title: boardState.board.title,
+        exportedAt: new Date().toISOString(),
+    };
+    files[TEMPLATE_MANIFEST_NAME] = Buffer.from(JSON.stringify(manifest, null, 2), 'utf-8');
+    return { data: Buffer.from(zipSync(files, { level: 6 })), board: boardState.board };
+}
+function isHostileEntryName(name) {
+    if (name.includes('\0'))
+        return true;
+    if (name.startsWith('/') || /^[a-zA-Z]:/.test(name))
+        return true;
+    return name.split('/').some(segment => segment === '..');
+}
+function collectSafeEntries(unzipped) {
+    const files = new Map();
+    for (const [rawName, bytes] of Object.entries(unzipped)) {
+        const name = rawName.replace(/\\/g, '/');
+        if (name.endsWith('/'))
+            continue;
+        if (isHostileEntryName(name))
+            throw new Error(`Unsafe entry in archive: ${rawName}`);
+        files.set(name, bytes);
+    }
+    return files;
+}
+function unwrapSingleRootFolder(files) {
+    if (files.has('board.md'))
+        return files;
+    const roots = new Set([...files.keys()].map(name => name.split('/')[0]));
+    const root = roots.size === 1 ? [...roots][0] : null;
+    if (!root || !files.has(`${root}/board.md`))
+        return files;
+    const unwrapped = new Map();
+    for (const [name, bytes] of files)
+        unwrapped.set(name.slice(root.length + 1), bytes);
+    return unwrapped;
+}
+export function extractBoardArchive(data) {
+    let entryCount = 0;
+    let totalSize = 0;
+    const unzipped = unzipSync(data, {
+        filter: file => {
+            entryCount++;
+            if (entryCount > MAX_ENTRIES)
+                throw new Error(`Archive has too many entries (max ${MAX_ENTRIES})`);
+            totalSize += file.originalSize;
+            if (totalSize > MAX_TOTAL_UNCOMPRESSED)
+                throw new Error('Archive is too large when uncompressed');
+            return true;
+        },
+    });
+    const files = unwrapSingleRootFolder(collectSafeEntries(unzipped));
+    const boardMd = files.get('board.md');
+    if (!boardMd)
+        throw new Error('Not a board template archive (missing board.md)');
+    const { frontMatter } = parseFrontMatter(Buffer.from(boardMd).toString('utf-8'));
+    const sourceBoardId = typeof frontMatter.id === 'string' && frontMatter.id ? frontMatter.id : null;
+    files.delete(TEMPLATE_MANIFEST_NAME);
+    return { files, sourceBoardId };
+}
+export function slugifyBoardTitle(title) {
+    return title.toLowerCase().replace(/[^a-z0-9]+/g, '-').replace(/^-+|-+$/g, '');
+}
+export function defaultArchiveFileName(board) {
+    const slug = slugifyBoardTitle(board.title) || board.id.toLowerCase();
+    return `${slug}-template.zip`;
+}

package/dist/server/services/plan/board-config.js

@@ -0,0 +1,108 @@
+// Copyright (c) 2025-present Minionry, Inc.
+// SPDX-License-Identifier: LicenseRef-Minionry-Software
+import { existsSync, readFileSync } from 'node:fs';
+import { readFile, writeFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { replaceFrontMatterField } from './front-matter.js';
+import { DEFAULT_QUALITY_GATE, parseQualityGate, parseWorkspace } from './parser-core.js';
+export const DEFAULT_MAX_PARALLEL_AGENTS = 3;
+export async function getBoardMaxParallelAgents(pmDir, boardId, warn) {
+    if (!pmDir || !boardId)
+        return DEFAULT_MAX_PARALLEL_AGENTS;
+    const boardMdPath = join(pmDir, 'boards', boardId, 'board.md');
+    if (!existsSync(boardMdPath))
+        return DEFAULT_MAX_PARALLEL_AGENTS;
+    try {
+        const content = await readFile(boardMdPath, 'utf-8');
+        const match = content.match(/^max_parallel_agents:\s*(\d+)/m);
+        return match ? Math.max(1, Math.min(Number(match[1]), 10)) : DEFAULT_MAX_PARALLEL_AGENTS;
+    }
+    catch (err) {
+        warn(`Warning: failed to read board max_parallel_agents: ${errMsg(err)}`);
+        return DEFAULT_MAX_PARALLEL_AGENTS;
+    }
+}
+export async function getBoardQualityGate(pmDir, boardId, warn) {
+    if (!pmDir || !boardId)
+        return DEFAULT_QUALITY_GATE;
+    const boardMdPath = join(pmDir, 'boards', boardId, 'board.md');
+    if (!existsSync(boardMdPath))
+        return DEFAULT_QUALITY_GATE;
+    try {
+        const content = await readFile(boardMdPath, 'utf-8');
+        const match = content.match(/^quality_gate:\s*["']?(\w+)["']?\s*$/m);
+        return parseQualityGate(match?.[1]);
+    }
+    catch (err) {
+        warn(`Warning: failed to read board quality_gate: ${errMsg(err)}`);
+        return DEFAULT_QUALITY_GATE;
+    }
+}
+export function resolveActiveBoardId(pmDir) {
+    if (!pmDir)
+        return null;
+    try {
+        const workspacePath = join(pmDir, 'workspace.json');
+        if (!existsSync(workspacePath))
+            return null;
+        const workspace = JSON.parse(readFileSync(workspacePath, 'utf-8'));
+        return workspace.activeBoardId ?? null;
+    }
+    catch {
+        return null;
+    }
+}
+export function resolveBoardWorktreePath(pmDir, boardId) {
+    if (!pmDir || !boardId)
+        return null;
+    try {
+        const workspacePath = join(pmDir, 'workspace.json');
+        if (!existsSync(workspacePath))
+            return null;
+        return parseWorkspace(readFileSync(workspacePath, 'utf-8')).boardWorktrees?.[boardId]?.path ?? null;
+    }
+    catch {
+        return null;
+    }
+}
+export function resolveBoardDir(pmDir, boardId) {
+    if (!pmDir)
+        return null;
+    const effective = boardId ?? resolveActiveBoardId(pmDir);
+    if (!effective)
+        return null;
+    const boardDir = join(pmDir, 'boards', effective);
+    return existsSync(boardDir) ? boardDir : null;
+}
+export async function activateBoard(pmDir, boardId, warn) {
+    const boardMdPath = join(pmDir, 'boards', boardId, 'board.md');
+    if (!existsSync(boardMdPath))
+        return;
+    try {
+        const content = await readFile(boardMdPath, 'utf-8');
+        await writeFile(boardMdPath, replaceFrontMatterField(content, 'status', 'active'), 'utf-8');
+    }
+    catch (err) {
+        warn(`Warning: failed to activate board ${boardId}: ${errMsg(err)}`);
+    }
+}
+export async function tryCompleteBoardIfDone(pmDir, boardId, issues, warn) {
+    const allDone = issues.length > 0 && issues.every(i => i.status === 'done' || i.status === 'cancelled');
+    if (!allDone)
+        return;
+    const boardMdPath = join(pmDir, 'boards', boardId, 'board.md');
+    if (!existsSync(boardMdPath))
+        return;
+    try {
+        let content = await readFile(boardMdPath, 'utf-8');
+        content = replaceFrontMatterField(content, 'status', 'completed');
+        content = replaceFrontMatterField(content, 'completed_at', `"${new Date().toISOString()}"`);
+        await writeFile(boardMdPath, content, 'utf-8');
+    }
+    catch (err) {
+        warn(`Warning: failed to mark board ${boardId} as completed: ${errMsg(err)}`);
+    }
+}
+function errMsg(err) {
+    return err instanceof Error ? err.message : String(err);
+}