@yemi33/minions 0.1.1776 → 0.1.1777

package/CHANGELOG.md

@@ -1,5 +1,10 @@
 # Changelog
 
+## 0.1.1777 (2026-05-07)
+
+### Fixes
+- tighten worktreeRoot validation everywhere worktrees are created
+
 ## 0.1.1776 (2026-05-07)
 
 ### Fixes

package/engine/copilot-models.json

@@ -1,5 +1,5 @@
 {
   "runtime": "copilot",
   "models": null,
-  "cachedAt": "2026-05-07T23:06:07.639Z"
+  "cachedAt": "2026-05-07T23:17:20.330Z"
 }

package/engine/lifecycle.js

@@ -1745,6 +1745,17 @@ async function rebaseBranchOntoMain(pr, project, config) {
   const tmpWt = path.join(wtRoot, `rebase-${shared.sanitizeBranch(branch)}-${Date.now()}`).replace(/\\/g, '/');
   const _gitOpts = { cwd: root, timeout: 30000, windowsHide: true };
 
+  // Refuse to create a worktree nested in the project root — would cause
+  // glob/grep tools running with cwd=root to match both copies of every file
+  // and produce mirror writes. Misconfigured engine.worktreeRoot is the only
+  // way this lands inside root; the assert throws so the caller can recover.
+  try {
+    shared.assertWorktreeOutsideProject(tmpWt, root);
+  } catch (err) {
+    log('warn', `Post-merge rebase: refusing nested worktree path — ${err.message}`);
+    return { success: false, error: err.message };
+  }
+
   try {
     await execAsync(`git fetch origin "${mainBranch}" "${branch}"`, _gitOpts);
     try {

package/engine/preflight.js

@@ -238,8 +238,13 @@ function runPreflight(opts = {}) {
   //    us the config. checkOrExit() / cli start() / doctor() pass it; legacy
   //    callers don't, in which case we skip silently.
   if (opts && opts.config && typeof opts.config === 'object') {
+    // Hoisted: `shared` is referenced by every check block below, including
+    // workSources warnings and the worktreeRoot check. Previously declared
+    // inside the first inner try, which left later blocks reading an
+    // undefined identifier (ReferenceError silently caught by the wrapping
+    // try/catch).
+    const shared = require('./shared');
     try {
-      const shared = require('./shared');
       let runtimeNames = [];
       try { runtimeNames = require('./runtimes').listRuntimes(); }
       catch { /* registry may be missing during partial installs */ }
@@ -266,6 +271,32 @@ function runPreflight(opts = {}) {
         results.push({ name: `Project config (${w.id})`, ok: 'warn', message: w.message });
       }
     } catch { /* defensive */ }
+
+    // 5. worktreeRoot config check — for every linked project, verify that the
+    //    configured engine.worktreeRoot resolves OUTSIDE the project's
+    //    localPath. A nested worktreeRoot causes glob/grep to match both
+    //    copies of every file, producing silent mirror writes (the W-cc-doc-
+    //    chat-continuity leak class). Hard-fail at preflight so the operator
+    //    sees it before any agent dispatch — the runtime guard in spawnAgent
+    //    is the second line of defense.
+    try {
+      const path = require('path');
+      const projects = shared.getProjects(opts.config) || [];
+      const wtRoot = opts.config?.engine?.worktreeRoot || shared.ENGINE_DEFAULTS.worktreeRoot;
+      for (const project of projects) {
+        if (!project || !project.localPath) continue;
+        const root = path.resolve(project.localPath);
+        const resolved = path.resolve(root, wtRoot);
+        if (shared.isPathInsideOrEqual(resolved, root)) {
+          results.push({
+            name: `worktreeRoot (${project.name || root})`,
+            ok: false,
+            message: `engine.worktreeRoot "${wtRoot}" resolves to "${resolved}" — INSIDE project root "${root}". This causes glob/grep to match duplicate files and produces mirror writes. Set engine.worktreeRoot to a sibling path (default: "../worktrees").`,
+          });
+          allOk = false;
+        }
+      }
+    } catch { /* defensive — preflight must never throw */ }
   }
 
   return { passed: allOk, results };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yemi33/minions",
-  "version": "0.1.1776",
+  "version": "0.1.1777",
   "description": "Multi-agent AI dev team that runs from ~/.minions/ — five autonomous agents share a single engine, dashboard, and knowledge base",
   "bin": {
     "minions": "bin/minions.js"