@yemi33/minions 0.1.1584 → 0.1.1586

package/CHANGELOG.md

@@ -1,8 +1,10 @@
 # Changelog
 
-## 0.1.1584 (2026-04-28)
+## 0.1.1586 (2026-04-28)
 
 ### Fixes
+- stop URL regex at backslash to prevent JSONL escape leakage
+- optimistic UI for planApprove cascades to linked PRD
 - stack chain-of-thought above progress block (was side-by-side)
 
 ### Other

package/dashboard/js/render-plans.js

@@ -559,6 +559,32 @@ async function planView(file) {
 async function planApprove(file, btn) {
   if (btn) { btn.dataset.origText = btn.textContent; btn.textContent = 'Approving...'; btn.style.pointerEvents = 'none'; btn.style.opacity = '0.6'; }
   showToast('cmd-toast', 'Plan approved — work will begin on next engine tick', true);
+
+  // Optimistic UI: mutate cached state and re-render so both the plan card and
+  // PRD view reflect 'approved' immediately. The .md card's display status
+  // follows the linked PRD's status via lookup in renderPlanCard, so updating
+  // the PRD entry covers both. Refresh after fetch reconciles with truth.
+  const isPrd = typeof file === 'string' && file.endsWith('.json');
+  if (Array.isArray(window._lastPlans)) {
+    for (const p of window._lastPlans) {
+      if (p.file === file) {
+        p.status = 'approved';
+        p.planStale = false;
+        delete p.pausedAt;
+      }
+    }
+    try { renderPlans(window._lastPlans); } catch { /* render is best-effort */ }
+  }
+  if (isPrd && window._lastStatus?.prdProgress?.items) {
+    for (const item of window._lastStatus.prdProgress.items) {
+      if (item.source === file) {
+        item.planStatus = 'approved';
+        item.planStale = false;
+      }
+    }
+    if (typeof rerenderPrdFromCache === 'function') rerenderPrdFromCache();
+  }
+
   try {
     const res = await fetch('/api/plans/approve', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ file }) });
     if (res.ok) {
@@ -568,8 +594,14 @@ async function planApprove(file, btn) {
       if (btn) { btn.textContent = btn.dataset.origText || 'Approve'; btn.style.pointerEvents = ''; btn.style.opacity = ''; }
       const d = await res.json().catch(() => ({}));
       showToast('cmd-toast', 'Approve failed: ' + (d.error || 'unknown'), false);
+      // Refresh to revert optimistic state from server truth
+      refresh();
     }
-  } catch (e) { if (btn) { btn.textContent = btn.dataset.origText || 'Approve'; btn.style.pointerEvents = ''; btn.style.opacity = ''; } showToast('cmd-toast', 'Error: ' + e.message, false); }
+  } catch (e) {
+    if (btn) { btn.textContent = btn.dataset.origText || 'Approve'; btn.style.pointerEvents = ''; btn.style.opacity = ''; }
+    showToast('cmd-toast', 'Error: ' + e.message, false);
+    refresh();
+  }
 }
 
 async function planDelete(file) {

package/engine/lifecycle.js

@@ -771,9 +771,11 @@ function syncPrsFromOutput(output, agentId, meta, config) {
 
   // Extract PR URL directly from agent output — no manual construction
   function extractPrUrl(prId) {
-    const ghMatch = output.match(new RegExp(`https?://github\\.com/[^\\s"'\\)\\]]*?/pull/${prId}(?:[^\\s"'\\)\\]]*)`, 'i'));
+    // Stop at backslash in addition to whitespace/quotes — raw JSONL encodes newlines as \n (literal
+    // backslash-n), so without this the regex would capture e.g. "pull/1804\n/usr/bin/bash".
+    const ghMatch = output.match(new RegExp(`https?://github\\.com/[^\\s"'\\)\\]\\\\]*?/pull/${prId}(?:[^\\s"'\\)\\]\\\\]*)`, 'i'));
     if (ghMatch) return ghMatch[0].replace(/[.,;:]+$/, '');
-    const adoMatch = output.match(new RegExp(`https?://(?:dev\\.azure\\.com|[^/]+\\.visualstudio\\.com)[^\\s"'\\)\\]]*?pullrequest/${prId}(?:[^\\s"'\\)\\]]*)`, 'i'));
+    const adoMatch = output.match(new RegExp(`https?://(?:dev\\.azure\\.com|[^/]+\\.visualstudio\\.com)[^\\s"'\\)\\]\\\\]*?pullrequest/${prId}(?:[^\\s"'\\)\\]\\\\]*)`, 'i'));
     if (adoMatch) return adoMatch[0].replace(/[.,;:]+$/, '');
     return '';
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yemi33/minions",
-  "version": "0.1.1584",
+  "version": "0.1.1586",
   "description": "Multi-agent AI dev team that runs from ~/.minions/ — five autonomous agents share a single engine, dashboard, and knowledge base",
   "bin": {
     "minions": "bin/minions.js"