@yemi33/minions 0.1.129 → 0.1.130

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## 0.1.130 (2026-04-01)
+
+### Engine
+- engine/lifecycle.js
+- engine/shared.js
+- engine/timeout.js
+
+### Dashboard
+- dashboard.js
+
 ## 0.1.129 (2026-04-01)
 
 ### Engine

package/dashboard.js

@@ -1662,7 +1662,7 @@ If nothing to do: { "duplicates": [], "reclassify": [], "remove": [] }`;
       const body = await readBody(req);
       if (!body.file) return jsonReply(res, 400, { error: 'file required' });
       const file = body.file;
-      if (file.includes('..') || file.includes('\0')) return jsonReply(res, 400, { error: 'invalid' });
+      if (file.includes('..') || file.includes('\0') || file.includes('/') || file.includes('\\')) return jsonReply(res, 400, { error: 'invalid' });
 
       const isJson = file.endsWith('.json');
       const sourceDir = isJson ? PRD_DIR : PLANS_DIR;
@@ -1701,7 +1701,7 @@ If nothing to do: { "duplicates": [], "reclassify": [], "remove": [] }`;
       const body = await readBody(req);
       if (!body.file) return jsonReply(res, 400, { error: 'file required' });
       const file = body.file;
-      if (file.includes('..') || file.includes('\0')) return jsonReply(res, 400, { error: 'invalid' });
+      if (file.includes('..') || file.includes('\0') || file.includes('/') || file.includes('\\')) return jsonReply(res, 400, { error: 'invalid' });
 
       const isJson = file.endsWith('.json');
       const targetDir = isJson ? PRD_DIR : PLANS_DIR;
@@ -2660,7 +2660,7 @@ What would you like to discuss or change? When you're happy, say "approve" and I
       const body = await readBody(req);
       const { name, category } = body;
       if (!name) return jsonReply(res, 400, { error: 'name required' });
-      if (name.includes('..') || name.includes('\0')) return jsonReply(res, 400, { error: 'Invalid file name' });
+      if (name.includes('..') || name.includes('\0') || name.includes('/') || name.includes('\\')) return jsonReply(res, 400, { error: 'Invalid file name' });
       if (!category || !shared.KB_CATEGORIES.includes(category)) {
         return jsonReply(res, 400, { error: 'category required: ' + shared.KB_CATEGORIES.join(', ') });
       }
@@ -2737,13 +2737,14 @@ What would you like to discuss or change? When you're happy, say "approve" and I
     const params = new URL(req.url, 'http://localhost').searchParams;
     const file = params.get('file');
     const dir = params.get('dir');
-    if (!file || file.includes('..') || file.includes('\0')) { res.statusCode = 400; res.end('Invalid file'); return; }
+    if (!file || file.includes('..') || file.includes('\0') || file.includes('/') || file.includes('\\')) { res.statusCode = 400; res.end('Invalid file'); return; }
 
     let content = '';
     if (dir) {
-      // Direct path from collectSkillFiles
-      const fullPath = path.join(dir.replace(/\//g, path.sep), file);
-      if (!fullPath.includes('..')) content = safeRead(fullPath) || '';
+      // Direct path from collectSkillFiles — validate resolved path stays within expected dir
+      const resolvedDir = path.resolve(dir.replace(/\//g, path.sep));
+      const fullPath = path.join(resolvedDir, file);
+      if (fullPath.startsWith(resolvedDir)) content = safeRead(fullPath) || '';
     }
     if (!content) {
       // Fallback: search Claude Code skills, then project skills

package/engine/lifecycle.js

@@ -500,14 +500,18 @@ function syncPrdItemStatus(itemId, status, sourcePlan) {
     const files = sourcePlan ? [sourcePlan] : require('fs').readdirSync(prdDir).filter(f => f.endsWith('.json'));
     for (const pf of files) {
       const fpath = path.join(prdDir, pf);
+      mutateJsonFileLocked(fpath, (plan) => {
+        if (!plan?.missing_features) return plan;
+        const feature = plan.missing_features.find(f => f.id === itemId);
+        if (feature && feature.status !== status) {
+          feature.status = status;
+        }
+        return plan;
+      });
+      // Check if we found it (read back to verify)
       const plan = safeJson(fpath);
-      if (!plan?.missing_features) continue;
-      const feature = plan.missing_features.find(f => f.id === itemId);
-      if (feature && feature.status !== status) {
-        feature.status = status;
-        shared.safeWrite(fpath, plan);
-        return;
-      }
+      const feature = plan?.missing_features?.find(f => f.id === itemId);
+      if (feature && feature.status === status) return;
     }
   } catch (err) { log('warn', `PRD status sync: ${err.message}`); }
 }

package/engine/shared.js

@@ -22,11 +22,14 @@ function log(level, msg, meta = {}) {
   const entry = { timestamp: ts(), level, message: msg, ...meta };
   console.log(`[${logTs()}] [${level}] ${msg}`);
 
-  let logData = safeJson(LOG_PATH) || [];
-  if (!Array.isArray(logData)) logData = logData.entries || [];
-  logData.push(entry);
-  if (logData.length >= 2500) logData.splice(0, logData.length - 2000);
-  safeWrite(LOG_PATH, logData);
+  try {
+    mutateJsonFileLocked(LOG_PATH, (logData) => {
+      if (!Array.isArray(logData)) logData = logData?.entries || [];
+      logData.push(entry);
+      if (logData.length >= 2500) logData.splice(0, logData.length - 2000);
+      return logData;
+    }, { defaultValue: [] });
+  } catch { /* logging should never crash the caller */ }
 }
 
 // ── File I/O ─────────────────────────────────────────────────────────────────

package/engine/timeout.js

@@ -248,6 +248,8 @@ function checkTimeouts(config) {
       const isActive = possibleKeys.some(k => activeKeys.has(k)) ||
         (dispatchData.active || []).some(d => d.meta?.item?.id === item.id);
       if (!isActive) {
+        // Don't revive items that were explicitly failed for non-retryable reasons
+        if (item.status === 'failed' && item.failReason && !item.failReason.includes('Agent died')) continue;
         const retries = (item._retryCount || 0);
         if (retries < 3) {
           log('info', `Reconcile: work item ${item.id} agent died — auto-retry ${retries + 1}/3`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yemi33/minions",
-  "version": "0.1.129",
+  "version": "0.1.130",
   "description": "Multi-agent AI dev team that runs from ~/.minions/ — five autonomous agents share a single engine, dashboard, and knowledge base",
   "bin": {
     "minions": "bin/minions.js"