@yemi33/minions 0.1.128 → 0.1.130

package/CHANGELOG.md

@@ -1,5 +1,26 @@
 # Changelog
 
+## 0.1.130 (2026-04-01)
+
+### Engine
+- engine/lifecycle.js
+- engine/shared.js
+- engine/timeout.js
+
+### Dashboard
+- dashboard.js
+
+## 0.1.129 (2026-04-01)
+
+### Engine
+- engine/github.js
+- engine/preflight.js
+- engine/spawn-agent.js
+
+### Dashboard
+- dashboard/js/modal.js
+- dashboard/js/render-agents.js
+
 ## 0.1.128 (2026-04-01)
 
 ### Engine

package/dashboard/js/modal.js

@@ -13,7 +13,7 @@ function closeModal() {
   if (_qaSessionKey && (_qaHistory.length > 0 || _qaQueue.length > 0)) {
     _qaSessions.set(_qaSessionKey, {
       history: _qaHistory,
-      threadHtml: document.getElementById('modal-qa-thread').innerHTML,
+      threadHtml: (document.getElementById('modal-qa-thread') || {}).innerHTML || '',
       docContext: { ..._modalDocContext },
       filePath: _modalFilePath,
     });

package/dashboard/js/render-agents.js

@@ -17,10 +17,10 @@ function renderAgents(agents) {
 }
 
 async function openAgentDetail(id) {
-  currentAgentId = id;
   const agent = agentData.find(a => a.id === id);
-  currentTab = (agent?.status === 'working') ? 'live' : 'thought-process';
   if (!agent) return;
+  currentAgentId = id;
+  currentTab = (agent.status === 'working') ? 'live' : 'thought-process';
 
   document.getElementById('detail-agent-name').innerHTML =
     '<span style="font-size:22px">' + agent.emoji + '</span> ' + agent.name + ' — ' + agent.role;

package/dashboard.js

@@ -1662,7 +1662,7 @@ If nothing to do: { "duplicates": [], "reclassify": [], "remove": [] }`;
       const body = await readBody(req);
       if (!body.file) return jsonReply(res, 400, { error: 'file required' });
       const file = body.file;
-      if (file.includes('..') || file.includes('\0')) return jsonReply(res, 400, { error: 'invalid' });
+      if (file.includes('..') || file.includes('\0') || file.includes('/') || file.includes('\\')) return jsonReply(res, 400, { error: 'invalid' });
 
       const isJson = file.endsWith('.json');
       const sourceDir = isJson ? PRD_DIR : PLANS_DIR;
@@ -1701,7 +1701,7 @@ If nothing to do: { "duplicates": [], "reclassify": [], "remove": [] }`;
       const body = await readBody(req);
       if (!body.file) return jsonReply(res, 400, { error: 'file required' });
       const file = body.file;
-      if (file.includes('..') || file.includes('\0')) return jsonReply(res, 400, { error: 'invalid' });
+      if (file.includes('..') || file.includes('\0') || file.includes('/') || file.includes('\\')) return jsonReply(res, 400, { error: 'invalid' });
 
       const isJson = file.endsWith('.json');
       const targetDir = isJson ? PRD_DIR : PLANS_DIR;
@@ -2660,7 +2660,7 @@ What would you like to discuss or change? When you're happy, say "approve" and I
       const body = await readBody(req);
       const { name, category } = body;
       if (!name) return jsonReply(res, 400, { error: 'name required' });
-      if (name.includes('..') || name.includes('\0')) return jsonReply(res, 400, { error: 'Invalid file name' });
+      if (name.includes('..') || name.includes('\0') || name.includes('/') || name.includes('\\')) return jsonReply(res, 400, { error: 'Invalid file name' });
       if (!category || !shared.KB_CATEGORIES.includes(category)) {
         return jsonReply(res, 400, { error: 'category required: ' + shared.KB_CATEGORIES.join(', ') });
       }
@@ -2737,13 +2737,14 @@ What would you like to discuss or change? When you're happy, say "approve" and I
     const params = new URL(req.url, 'http://localhost').searchParams;
     const file = params.get('file');
     const dir = params.get('dir');
-    if (!file || file.includes('..') || file.includes('\0')) { res.statusCode = 400; res.end('Invalid file'); return; }
+    if (!file || file.includes('..') || file.includes('\0') || file.includes('/') || file.includes('\\')) { res.statusCode = 400; res.end('Invalid file'); return; }
 
     let content = '';
     if (dir) {
-      // Direct path from collectSkillFiles
-      const fullPath = path.join(dir.replace(/\//g, path.sep), file);
-      if (!fullPath.includes('..')) content = safeRead(fullPath) || '';
+      // Direct path from collectSkillFiles — validate resolved path stays within expected dir
+      const resolvedDir = path.resolve(dir.replace(/\//g, path.sep));
+      const fullPath = path.join(resolvedDir, file);
+      if (fullPath.startsWith(resolvedDir)) content = safeRead(fullPath) || '';
     }
     if (!content) {
       // Fallback: search Claude Code skills, then project skills

package/engine/github.js

@@ -5,7 +5,7 @@
  */
 
 const shared = require('./shared');
-const { exec, getProjects, projectPrPath, projectWorkItemsPath, safeJson, safeWrite, MINIONS_DIR, addPrLink } = shared;
+const { exec, getProjects, projectPrPath, projectWorkItemsPath, safeJson, safeWrite, MINIONS_DIR, addPrLink, getPrLinks } = shared;
 const { getPrs } = require('./queries');
 const path = require('path');
 

package/engine/lifecycle.js

@@ -500,14 +500,18 @@ function syncPrdItemStatus(itemId, status, sourcePlan) {
     const files = sourcePlan ? [sourcePlan] : require('fs').readdirSync(prdDir).filter(f => f.endsWith('.json'));
     for (const pf of files) {
       const fpath = path.join(prdDir, pf);
+      mutateJsonFileLocked(fpath, (plan) => {
+        if (!plan?.missing_features) return plan;
+        const feature = plan.missing_features.find(f => f.id === itemId);
+        if (feature && feature.status !== status) {
+          feature.status = status;
+        }
+        return plan;
+      });
+      // Check if we found it (read back to verify)
       const plan = safeJson(fpath);
-      if (!plan?.missing_features) continue;
-      const feature = plan.missing_features.find(f => f.id === itemId);
-      if (feature && feature.status !== status) {
-        feature.status = status;
-        shared.safeWrite(fpath, plan);
-        return;
-      }
+      const feature = plan?.missing_features?.find(f => f.id === itemId);
+      if (feature && feature.status === status) return;
     }
   } catch (err) { log('warn', `PRD status sync: ${err.message}`); }
 }

package/engine/preflight.js

@@ -25,7 +25,7 @@ function findClaudeBinary() {
   // Fallback: parse the shell wrapper
   try {
     const which = execSync('bash -c "which claude"', { encoding: 'utf8', windowsHide: true, timeout: 5000 }).trim();
-    const whichNative = which.replace(/^\/c\//, 'C:/').replace(/\//g, path.sep);
+    const whichNative = which.replace(/^\/([a-zA-Z])\//, (_, d) => d.toUpperCase() + ':/').replace(/\//g, path.sep);
     const wrapper = fs.readFileSync(whichNative, 'utf8');
     const m = wrapper.match(/node_modules\/@anthropic-ai\/claude-code\/cli\.js/);
     if (m) {

package/engine/shared.js

@@ -22,11 +22,14 @@ function log(level, msg, meta = {}) {
   const entry = { timestamp: ts(), level, message: msg, ...meta };
   console.log(`[${logTs()}] [${level}] ${msg}`);
 
-  let logData = safeJson(LOG_PATH) || [];
-  if (!Array.isArray(logData)) logData = logData.entries || [];
-  logData.push(entry);
-  if (logData.length >= 2500) logData.splice(0, logData.length - 2000);
-  safeWrite(LOG_PATH, logData);
+  try {
+    mutateJsonFileLocked(LOG_PATH, (logData) => {
+      if (!Array.isArray(logData)) logData = logData?.entries || [];
+      logData.push(entry);
+      if (logData.length >= 2500) logData.splice(0, logData.length - 2000);
+      return logData;
+    }, { defaultValue: [] });
+  } catch { /* logging should never crash the caller */ }
 }
 
 // ── File I/O ─────────────────────────────────────────────────────────────────

package/engine/spawn-agent.js

@@ -39,10 +39,11 @@ for (const p of searchPaths) {
 if (!claudeBin) {
   try {
     const which = exec('bash -c "which claude"', { encoding: 'utf8', env }).trim();
-    const wrapper = exec(`bash -c "cat '${which}'"`, { encoding: 'utf8', env });
+    const whichNative = which.replace(/^\/([a-zA-Z])\//, (_, d) => d.toUpperCase() + ':/').replace(/\//g, path.sep);
+    const wrapper = fs.readFileSync(whichNative, 'utf8');
     const m = wrapper.match(/node_modules\/@anthropic-ai\/claude-code\/cli\.js/);
     if (m) {
-      const basedir = path.dirname(which.replace(/^\/c\//, 'C:/').replace(/\//g, path.sep));
+      const basedir = path.dirname(whichNative);
       claudeBin = path.join(basedir, 'node_modules', '@anthropic-ai', 'claude-code', 'cli.js');
     }
   } catch { /* optional */ }

package/engine/timeout.js

@@ -248,6 +248,8 @@ function checkTimeouts(config) {
       const isActive = possibleKeys.some(k => activeKeys.has(k)) ||
         (dispatchData.active || []).some(d => d.meta?.item?.id === item.id);
       if (!isActive) {
+        // Don't revive items that were explicitly failed for non-retryable reasons
+        if (item.status === 'failed' && item.failReason && !item.failReason.includes('Agent died')) continue;
         const retries = (item._retryCount || 0);
         if (retries < 3) {
           log('info', `Reconcile: work item ${item.id} agent died — auto-retry ${retries + 1}/3`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yemi33/minions",
-  "version": "0.1.128",
+  "version": "0.1.130",
   "description": "Multi-agent AI dev team that runs from ~/.minions/ — five autonomous agents share a single engine, dashboard, and knowledge base",
   "bin": {
     "minions": "bin/minions.js"