@yemi33/minions 0.1.1778 → 0.1.1780

package/CHANGELOG.md

@@ -1,5 +1,10 @@
 # Changelog
 
+## 0.1.1780 (2026-05-07)
+
+### Features
+- fix command center action parity (#2174)
+
 ## 0.1.1778 (2026-05-07)
 
 ### Features

package/dashboard/js/command-center.js

@@ -103,15 +103,15 @@ function _ccActiveTab() {
 
 // Build a plain-text transcript from a tab's stored messages — sent on every
 // initial request so the server can carry it over if the session has to reset
-// (runtime switch, system-prompt change). Last 20 user/assistant turns only;
-// system/action rows are skipped because they're UI artifacts, not dialog.
+// (runtime switch, system-prompt change) or if the previous turn has local
+// action results the runtime session never saw.
 var CC_TRANSCRIPT_MAX_TURNS = 20;
 function _ccBuildTranscript(tab) {
   if (!tab || !Array.isArray(tab.messages) || tab.messages.length === 0) return [];
   var out = [];
   for (var i = 0; i < tab.messages.length; i++) {
     var m = tab.messages[i];
-    if (!m || (m.role !== 'user' && m.role !== 'assistant')) continue;
+    if (!m || (m.role !== 'user' && m.role !== 'assistant' && m.role !== 'action' && m.role !== 'system')) continue;
     var html = typeof m.html === 'string' ? m.html : '';
     var tmp = document.createElement('div');
     tmp.innerHTML = html;
@@ -141,6 +141,23 @@ function _ccMergeStreamText(prev, incoming) {
   return current + '\n\n' + next;
 }
 
+var CC_DISPATCH_ACTION_ALIASES = ['fix', 'implement', 'explore', 'review', 'test'];
+function _ccNormalizeDispatchAction(action) {
+  if (!action || typeof action !== 'object' || typeof action.type !== 'string') return action;
+  var type = action.type.trim().toLowerCase();
+  if (type === 'dispatch') {
+    if (action.type === 'dispatch') return action;
+    var dispatchAction = Object.assign({}, action);
+    dispatchAction.type = 'dispatch';
+    return dispatchAction;
+  }
+  if (CC_DISPATCH_ACTION_ALIASES.indexOf(type) < 0) return action;
+  var normalized = Object.assign({}, action);
+  normalized.type = 'dispatch';
+  if (!normalized.workType) normalized.workType = type;
+  return normalized;
+}
+
 async function _ccDashboardHealth() {
   var controller = new AbortController();
   var timer = setTimeout(function() { controller.abort(); }, 3000);
@@ -745,7 +762,7 @@ async function _ccDoSend(message, skipUserMsg, forceTabId) {
       if (!isReconnect && res.status === 429 && (!activeTab._429retries || activeTab._429retries < 3)) {
         activeTab._429retries = (activeTab._429retries || 0) + 1;
         await new Promise(function(r) { setTimeout(r, 1500); });
-        return await _ccConsumeStream({ message: message, tabId: activeTabId, sessionId: activeTab.sessionId || null }, false);
+        return await _ccConsumeStream({ message: message, tabId: activeTabId, sessionId: activeTab.sessionId || null, transcript: _ccBuildTranscript(activeTab) }, false);
       }
       activeTab._429retries = 0;
       var errText = await res.text();
@@ -963,8 +980,25 @@ function ccRetryLast(tabId, retryId) {
   });
 }
 
-async function _ccFetch(url, body) {
-  var res = await fetch(url, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(body) });
+async function _ccFetch(url, body, method) {
+  method = (method || 'POST').toUpperCase();
+  var fetchUrl = url;
+  var opts = { method: method, headers: { 'Content-Type': 'application/json' } };
+  if (method === 'GET') {
+    var qs = new URLSearchParams();
+    Object.entries(body || {}).forEach(function(entry) {
+      var key = entry[0], value = entry[1];
+      if (value === undefined || value === null) return;
+      if (Array.isArray(value)) value.forEach(function(v) { qs.append(key, String(v)); });
+      else if (typeof value === 'object') qs.append(key, JSON.stringify(value));
+      else qs.append(key, String(value));
+    });
+    var text = qs.toString();
+    if (text) fetchUrl += (fetchUrl.includes('?') ? '&' : '?') + text;
+  } else {
+    opts.body = JSON.stringify(body || {});
+  }
+  var res = await fetch(fetchUrl, opts);
   if (!res.ok) {
     var d = await res.json().catch(function() { return {}; });
     var err = new Error(d.error || 'Request failed (' + res.status + ')');
@@ -994,6 +1028,7 @@ function _tagServerExecuted(actions, actionResults) {
 }
 
 async function ccExecuteAction(action, targetTabId) {
+  action = _ccNormalizeDispatchAction(action);
   var status = document.createElement('div');
   status.style.cssText = 'padding:4px 10px;border-radius:4px;font-size:10px;align-self:flex-start;border:1px dashed var(--border);color:var(--muted)';
 
@@ -1010,7 +1045,7 @@ async function ccExecuteAction(action, targetTabId) {
       status.style.color = action._serverDuplicate ? 'var(--orange)' : 'var(--green)';
     }
     ccAddMessage('action', status.outerHTML, false, targetTabId);
-    if (['dispatch','fix','implement','explore','review','test','create-meeting'].includes(action.type)) wakeEngine();
+    if (['dispatch','create-meeting'].includes(action.type)) wakeEngine();
     refresh();
     return;
   }
@@ -1023,7 +1058,7 @@ async function ccExecuteAction(action, targetTabId) {
       case 'explore':
       case 'review':
       case 'test': {
-        var workType = action.workType || (action.type !== 'dispatch' ? action.type : 'implement');
+        var workType = action.workType || 'implement';
         // Forward both singular (`agent`) and plural (`agents`) hint shapes —
         // the LLM emits either depending on phrasing ("assign to lambert" vs
         // "dispatch to dallas, ralph"). The server-side handler promotes a
@@ -1050,22 +1085,25 @@ async function ccExecuteAction(action, targetTabId) {
         if (notePageLink && !notePageLink.querySelector('.notif-badge')) { var noteCurPage = document.querySelector('.sidebar-link.active')?.getAttribute('data-page'); if (noteCurPage !== 'inbox') showNotifBadge(notePageLink); }
         break;
       }
-      case 'pin': {
+      case 'pin':
+      case 'pin-to-pinned': {
         await _ccFetch('/api/pinned', { title: action.title, content: action.content || action.description, level: action.level || '' });
         status.innerHTML = '&#x1F4CC; Pinned: <strong>' + escHtml(action.title) + '</strong> — visible to all agents';
         status.style.color = 'var(--green)';
         break;
       }
       case 'plan': {
-        await _ccFetch('/api/plan', { title: action.title, description: action.description, project: action.project, branchStrategy: action.branchStrategy || 'parallel' });
+        var branchStrategy = action.branch_strategy || action.branchStrategy || 'parallel';
+        await _ccFetch('/api/plan', { title: action.title, description: action.description, project: action.project, branch_strategy: branchStrategy, branchStrategy: branchStrategy });
         status.innerHTML = '&#10003; Plan queued: <strong>' + escHtml(action.title) + '</strong>';
         status.style.color = 'var(--green)';
         wakeEngine();
         break;
       }
       case 'cancel': {
-        await _ccFetch('/api/agents/cancel', { agentId: action.agent, reason: action.reason || 'Cancelled via command center' });
-        status.innerHTML = '&#10003; Cancelled agent: <strong>' + escHtml(action.agent) + '</strong>';
+        var cancelAgent = action.agent || action.agentId || '';
+        await _ccFetch('/api/agents/cancel', { agent: cancelAgent, agentId: cancelAgent, task: action.task || action.cancelTask || '', reason: action.reason || 'Cancelled via command center' });
+        status.innerHTML = '&#10003; Cancelled agent: <strong>' + escHtml(cancelAgent || action.task || action.cancelTask || '') + '</strong>';
         status.style.color = 'var(--orange)';
         break;
       }
@@ -1457,8 +1495,9 @@ async function ccExecuteAction(action, targetTabId) {
         break;
       }
       case 'add-project': {
-        await _ccFetch('/api/projects/add', { localPath: action.localPath, name: action.name || '', repoHost: action.repoHost || 'github' });
-        status.innerHTML = '&#10003; Project added: <strong>' + escHtml(action.name || action.localPath) + '</strong>';
+        var projectPath = action.path || action.localPath;
+        await _ccFetch('/api/projects/add', { path: projectPath, localPath: projectPath, name: action.name || '', repoHost: action.repoHost || 'github', allowNonRepo: action.allowNonRepo, confirmToken: action.confirmToken });
+        status.innerHTML = '&#10003; Project added: <strong>' + escHtml(action.name || projectPath) + '</strong>';
         status.style.color = 'var(--green)';
         break;
       }
@@ -1489,7 +1528,7 @@ async function ccExecuteAction(action, targetTabId) {
       default: {
         // Generic fallback: if action has an `endpoint` field, call it directly (local API only)
         if (action.endpoint && action.endpoint.startsWith('/api/') && !action.endpoint.includes('..') && !/\%2e/i.test(action.endpoint)) {
-          var genRes = await _ccFetch(action.endpoint, action.params || {});
+          var genRes = await _ccFetch(action.endpoint, action.params || {}, action.method || 'POST');
           var genData = await genRes.json().catch(function() { return {}; });
           status.innerHTML = '&#10003; ' + escHtml(action.type) + ': ' + escHtml(genData.message || genData.id || 'done');
           status.style.color = 'var(--green)';

package/dashboard/js/modal-qa.js

@@ -28,6 +28,7 @@ let _qaAbortController = null;
 let _qaQueue = []; // queued messages while processing
 const QA_QUEUE_CAP = 10; // max queued messages
 const QA_STREAM_STALL_MS = 6 * 60 * 1000; // allow the full doc-chat timeout before treating heartbeat-only streams as stalled
+const QA_TRANSCRIPT_MAX_TURNS = 20;
 let _qaSessionKey = ''; // key for current conversation (title or filePath)
 
 const QA_STICKY_BOTTOM_PX = 80;
@@ -97,6 +98,40 @@ function _qaCloneQueue(queue) {
   return Array.isArray(queue) ? queue.map(item => ({ ...item })) : [];
 }
 
+function _qaBuildTranscript(history, currentMessage) {
+  if (!Array.isArray(history) || history.length === 0) return [];
+  const current = typeof currentMessage === 'string' ? currentMessage.trim() : '';
+  const out = [];
+  for (let i = 0; i < history.length; i++) {
+    const m = history[i];
+    if (!m || (m.role !== 'user' && m.role !== 'assistant' && m.role !== 'action' && m.role !== 'system')) continue;
+    const text = typeof m.text === 'string' ? m.text.trim() : '';
+    if (!text) continue;
+    if (current && m.role === 'user' && text === current && i === history.length - 1) continue;
+    out.push({ role: m.role, text });
+  }
+  return out.slice(-QA_TRANSCRIPT_MAX_TURNS);
+}
+
+function _qaSummarizeActionContext(actions, actionResults) {
+  if (!Array.isArray(actions) || actions.length === 0) return '';
+  const lines = [];
+  for (let i = 0; i < actions.length; i++) {
+    const action = actions[i] || {};
+    const result = Array.isArray(actionResults) ? actionResults[i] : null;
+    const type = action.type || 'action';
+    const subject = result?.id || action.id || action.title || action.file || action.target || action.endpoint || '';
+    if (result?.error) {
+      lines.push(`${type}${subject ? ' ' + subject : ''} failed: ${result.error}`);
+    } else if (result?.ok || action._serverExecuted) {
+      lines.push(`${type}${subject ? ' ' + subject : ''} completed${result?.duplicate ? ' (duplicate)' : ''}${result?.warning ? ': ' + result.warning : ''}`);
+    } else {
+      lines.push(`${type}${subject ? ' ' + subject : ''} emitted`);
+    }
+  }
+  return lines.join('\n');
+}
+
 function _qaGetRuntime(key) {
   if (!key) return null;
   let runtime = _qaRuntime.get(key);
@@ -609,6 +644,7 @@ async function _processQaMessage(message, selection, opts) {
         filePath: capturedFilePath || null,
         model: window._lastStatus?.autoMode?.ccModel || undefined,
         contentHash: capturedDocContext.content ? (function(s) { const m = Math.floor(s.length / 2); return s.length + ':' + s.charCodeAt(0) + ':' + s.charCodeAt(m) + ':' + s.charCodeAt(s.length - 1); })(capturedDocContext.content) : undefined,
+        transcript: _qaBuildTranscript(runtime.history, message),
       }),
     });
     let sessionDocContext = { ...capturedDocContext };
@@ -692,20 +728,21 @@ async function _processQaMessage(message, selection, opts) {
           if (rawErrorHtml) _qaInsertBeforeQueued(tmp, rawErrorHtml);
         });
 
-        runtime.history.push({ role: 'user', text: message });
-        runtime.history.push({ role: 'assistant', text: finalText || '' });
-        if (_qaIsActiveSession(sessionKey)) _qaHistory = runtime.history.slice();
-
         _qaNotifySidebar(capturedFilePath);
+        runtime.history.push({ role: 'user', text: message });
+        runtime.history.push({ role: 'assistant', text: bodyText || finalText || '' });
         if (evt.actions && evt.actions.length > 0) {
           if (evt.actionResults && typeof _tagServerExecuted === 'function') _tagServerExecuted(evt.actions, evt.actionResults);
           for (const action of evt.actions) await ccExecuteAction(action);
+          const actionContext = _qaSummarizeActionContext(evt.actions, evt.actionResults);
+          if (actionContext) runtime.history.push({ role: 'action', text: actionContext });
         } else if (evt.actionParseError) {
           const warning = '<div class="modal-qa-a" style="color:var(--red)">Actions block emitted but JSON could not be parsed — no actions were executed. Resend or rephrase. (' + escHtml(String(evt.actionParseError).slice(0, 200)) + ')</div>';
           updatedThreadHtml = _qaMutateThreadHtml(sessionKey, tmp => {
             _qaInsertBeforeQueued(tmp, warning);
           });
         }
+        if (_qaIsActiveSession(sessionKey)) _qaHistory = runtime.history.slice();
 
         if (evt.edited && evt.content) {
           const display = evt.content.replace(/^---[\s\S]*?---\n*/m, '');

package/dashboard.js

@@ -1366,10 +1366,36 @@ function _readCcTabSessions({ prune = true } = {}) {
 
 const CC_CARRYOVER_MAX_TURNS = 20;
 const CC_CARRYOVER_PER_MSG_CHARS = 2000;
+const CC_TRANSCRIPT_DIALOG_ROLES = new Set(['user', 'assistant']);
+const CC_TRANSCRIPT_CONTEXT_ROLES = new Set(['user', 'assistant', 'action', 'system']);
 
-function _buildTranscriptCarryover(transcript, { previousRuntime, currentMessage } = {}) {
+function _normalizeTranscriptRole(role) {
+  const value = String(role || '').toLowerCase();
+  return CC_TRANSCRIPT_CONTEXT_ROLES.has(value) ? value : null;
+}
+
+function _transcriptHasCarryoverContext(transcript, { outOfBandOnly = false, currentMessage } = {}) {
+  if (!Array.isArray(transcript)) return false;
+  const current = typeof currentMessage === 'string' ? currentMessage.trim() : '';
+  return transcript.some(m => {
+    const role = _normalizeTranscriptRole(m?.role);
+    if (!role || typeof m.text !== 'string' || !m.text.trim()) return false;
+    if (outOfBandOnly && CC_TRANSCRIPT_DIALOG_ROLES.has(role)) return false;
+    return !(current && role === 'user' && m.text.trim() === current);
+  });
+}
+
+function _buildTranscriptCarryover(transcript, { previousRuntime, currentMessage, outOfBandOnly = false } = {}) {
   if (!Array.isArray(transcript) || transcript.length === 0) return '';
-  let filtered = transcript.filter(m => m && (m.role === 'user' || m.role === 'assistant') && typeof m.text === 'string' && m.text.trim());
+  let filtered = transcript
+    .map(m => {
+      const role = _normalizeTranscriptRole(m?.role);
+      return role && typeof m?.text === 'string' && m.text.trim()
+        ? { role, text: m.text }
+        : null;
+    })
+    .filter(Boolean);
+  if (outOfBandOnly) filtered = filtered.filter(m => !CC_TRANSCRIPT_DIALOG_ROLES.has(m.role));
   const current = typeof currentMessage === 'string' ? currentMessage.trim() : '';
   if (current && filtered.length > 0) {
     const last = filtered[filtered.length - 1];
@@ -1378,11 +1404,19 @@ function _buildTranscriptCarryover(transcript, { previousRuntime, currentMessage
   if (filtered.length === 0) return '';
   const recent = filtered.slice(-CC_CARRYOVER_MAX_TURNS);
   const truncated = filtered.length > recent.length;
-  const header = previousRuntime
-    ? `--- Previous conversation (carried over from ${previousRuntime} session) ---`
-    : `--- Previous conversation (carried over) ---`;
+  const header = outOfBandOnly
+    ? `--- Previous out-of-band UI/server events (carried over) ---`
+    : previousRuntime
+      ? `--- Previous conversation (carried over from ${previousRuntime} session) ---`
+      : `--- Previous conversation (carried over) ---`;
   const lines = recent.map(m => {
-    const who = m.role === 'user' ? 'User' : 'Assistant';
+    const who = m.role === 'user'
+      ? 'User'
+      : m.role === 'assistant'
+        ? 'Assistant'
+        : m.role === 'action'
+          ? 'Action result'
+          : 'System note';
     let text = m.text.trim();
     if (text.length > CC_CARRYOVER_PER_MSG_CHARS) text = text.slice(0, CC_CARRYOVER_PER_MSG_CHARS) + '… [truncated]';
     return `${who}: ${text}`;
@@ -1415,6 +1449,13 @@ try {
 let _preambleCache = null;
 let _preambleCacheTs = 0;
 const PREAMBLE_TTL = 30000; // 30s — longer TTL since preamble is lightweight orientation, not real-time data
+const CC_API_FALLBACK_TIMEOUT_MS = 15000;
+const CC_API_FALLBACK_METHODS = new Set(['GET', 'POST', 'DELETE']);
+const CC_API_FALLBACK_BLOCKED_PREFIXES = [
+  '/api/command-center',
+  '/api/doc-chat',
+  '/api/bot',
+];
 
 // SoT for CC's runtime API index. Captured lazily on the first HTTP request
 // because ROUTES is closed over inside the request handler. Subsequent
@@ -1535,13 +1576,20 @@ function _routesAsMeta(routes) {
 
 function _captureApiRoutesMeta(routes) {
   if (_ccApiRoutesMeta || !Array.isArray(routes)) return;
-  _ccApiRoutesMeta = _routesAsMeta(routes);
+  _ccApiRoutesMeta = routes.map(r => ({
+    ..._routesAsMeta([r])[0],
+    _pathRegex: r.path instanceof RegExp ? r.path : null,
+  }));
+}
+
+function _resetCcApiRoutesMetaForTest() {
+  _ccApiRoutesMeta = null;
 }
 
 function _formatCcApiRoutesIndex() {
   if (!Array.isArray(_ccApiRoutesMeta) || _ccApiRoutesMeta.length === 0) return '';
   return _ccApiRoutesMeta
-    .filter(r => r.path.startsWith('/api/'))
+    .filter(r => r.path.startsWith('/api/') || r.path.startsWith('/^\\/api'))
     .map(r => {
       const params = r.params ? ` — params: ${r.params}` : '';
       const flags = [
@@ -1601,8 +1649,8 @@ ${apiIndex || '(routes not yet captured — first request still pending)'}
 ### CLI Index (auto-generated from engine/cli.js CLI_COMMAND_DOCS — single source of truth)
 ${cliIndex || '(unavailable)'}
 
-For \`POST /api/...\` endpoints marked \`generic-fallback\` and not covered by a named CC action, use the generic fallback:
-\`{"type":"<descriptive>","endpoint":"/api/...","params":{...}}\`.` : '';
+For any safe local \`/api/...\` endpoint not covered by a named CC action, use the generic fallback:
+\`{"type":"<descriptive>","endpoint":"/api/...","method":"GET|POST|DELETE","params":{...}}\`.` : '';
 
   const result = `### Agents
 ${agents}
@@ -1751,6 +1799,19 @@ function _extractActionsJson(segment) {
   return null;
 }
 
+const CC_DISPATCH_ACTION_ALIASES = new Set(['fix', 'implement', 'explore', 'review', 'test']);
+
+function normalizeCCAction(action) {
+  if (!action || typeof action !== 'object') return action;
+  if (typeof action.type !== 'string') return action;
+  const type = action.type.trim().toLowerCase();
+  if (type === 'dispatch') {
+    return action.type === 'dispatch' ? action : { ...action, type: 'dispatch' };
+  }
+  if (!CC_DISPATCH_ACTION_ALIASES.has(type)) return action;
+  return { ...action, type: 'dispatch', workType: action.workType || type };
+}
+
 function parseCCActions(text) {
   let actions = [];
   let displayText = stripCCActionsForDisplay(text);
@@ -1791,6 +1852,7 @@ function parseCCActions(text) {
       parseError = null; // legacy fallback recovered actions
     }
   }
+  actions = actions.map(normalizeCCAction);
   const result = { text: displayText, actions };
   if (parseError && actions.length === 0) {
     result._actionParseError = parseError;
@@ -2184,9 +2246,296 @@ function _ccValidateAction(action) {
   }
 }
 
+let _ccLocalApiInvokerForTest = null;
+
+function _setCcLocalApiInvokerForTest(fn) {
+  _ccLocalApiInvokerForTest = typeof fn === 'function' ? fn : null;
+}
+
+function _ccRouteMethodsForPath(pathname) {
+  if (!Array.isArray(_ccApiRoutesMeta) || _ccApiRoutesMeta.length === 0) return null;
+  const methods = new Set();
+  for (const route of _ccApiRoutesMeta) {
+    if (route._pathRegex instanceof RegExp) {
+      route._pathRegex.lastIndex = 0;
+      if (route._pathRegex.test(pathname)) methods.add(String(route.method || '').toUpperCase());
+    } else if (route.path === pathname) {
+      methods.add(String(route.method || '').toUpperCase());
+    }
+  }
+  return methods;
+}
+
+function _ccValidateLocalApiFallback(endpoint, method) {
+  if (typeof endpoint !== 'string' || !endpoint.trim()) return 'generic API fallback requires endpoint';
+  const raw = endpoint.trim();
+  if (!(raw === '/api' || raw.startsWith('/api/'))) return 'generic API fallback endpoint must be a local /api/ path';
+  if (/[\0\r\n\\]/.test(raw) || raw.includes('..') || /%2e/i.test(raw) || /%5c/i.test(raw)) {
+    return 'generic API fallback endpoint is unsafe';
+  }
+  let parsed;
+  try {
+    parsed = new URL(raw, 'http://127.0.0.1');
+  } catch {
+    return 'generic API fallback endpoint is invalid';
+  }
+  if (parsed.origin !== 'http://127.0.0.1' || !(parsed.pathname === '/api' || parsed.pathname.startsWith('/api/'))) {
+    return 'generic API fallback endpoint must be a local /api/ path';
+  }
+  if (CC_API_FALLBACK_BLOCKED_PREFIXES.some(prefix => parsed.pathname === prefix || parsed.pathname.startsWith(prefix + '/'))) {
+    return 'generic API fallback cannot call Command Center, doc-chat, or bot endpoints';
+  }
+  if (/stream/i.test(parsed.pathname) || parsed.pathname === '/api/hot-reload') {
+    return 'generic API fallback cannot call streaming endpoints';
+  }
+  const normalizedMethod = String(method || 'POST').toUpperCase();
+  if (!CC_API_FALLBACK_METHODS.has(normalizedMethod)) {
+    return `generic API fallback method ${normalizedMethod} is not allowed`;
+  }
+  const routeMethods = _ccRouteMethodsForPath(parsed.pathname);
+  if (routeMethods && routeMethods.size > 0 && !routeMethods.has(normalizedMethod)) {
+    return `API endpoint ${parsed.pathname} does not allow ${normalizedMethod}; allowed methods: ${[...routeMethods].join(', ')}`;
+  }
+  if (routeMethods && routeMethods.size === 0) {
+    return `API endpoint ${parsed.pathname} is not in the local API index`;
+  }
+  return null;
+}
+
+function _ccBuildQueryString(params) {
+  if (!params || typeof params !== 'object' || Array.isArray(params)) return '';
+  const search = new URLSearchParams();
+  for (const [key, value] of Object.entries(params)) {
+    if (value === undefined || value === null) continue;
+    if (Array.isArray(value)) {
+      for (const item of value) search.append(key, String(item));
+    } else if (typeof value === 'object') {
+      search.append(key, JSON.stringify(value));
+    } else {
+      search.append(key, String(value));
+    }
+  }
+  const text = search.toString();
+  return text ? '?' + text : '';
+}
+
+function _ccRequestPath(endpoint, method, params) {
+  const parsed = new URL(endpoint, 'http://127.0.0.1');
+  if (method === 'GET') {
+    const extra = _ccBuildQueryString(params);
+    if (extra) {
+      const glue = parsed.search ? '&' : '?';
+      return parsed.pathname + parsed.search + glue + extra.slice(1);
+    }
+  }
+  return parsed.pathname + parsed.search;
+}
+
+async function _ccInvokeLocalApi({ method, endpoint, params }) {
+  if (_ccLocalApiInvokerForTest) return _ccLocalApiInvokerForTest({ method, endpoint, params });
+  const requestPath = _ccRequestPath(endpoint, method, params);
+  return new Promise((resolve, reject) => {
+    const body = method === 'GET' ? null : JSON.stringify(params || {});
+    const req = http.request({
+      hostname: '127.0.0.1',
+      port: PORT,
+      method,
+      path: requestPath,
+      timeout: CC_API_FALLBACK_TIMEOUT_MS,
+      headers: body ? {
+        'Content-Type': 'application/json',
+        'Content-Length': Buffer.byteLength(body),
+      } : {},
+    }, res => {
+      let text = '';
+      res.setEncoding('utf8');
+      res.on('data', chunk => { text += chunk; });
+      res.on('end', () => {
+        let data = text;
+        try { data = text ? JSON.parse(text) : {}; } catch { /* non-JSON API response */ }
+        resolve({ status: res.statusCode || 0, data });
+      });
+    });
+    req.on('timeout', () => {
+      req.destroy(new Error(`local API fallback timed out after ${CC_API_FALLBACK_TIMEOUT_MS}ms`));
+    });
+    req.on('error', reject);
+    if (body) req.write(body);
+    req.end();
+  });
+}
+
+function _ccApiRequest(endpoint, params = {}, method = 'POST') {
+  return { endpoint, params, method };
+}
+
+function _ccMappedApiRequests(action) {
+  switch (action.type) {
+    case 'pin':
+    case 'pin-to-pinned':
+      return _ccApiRequest('/api/pinned', { title: action.title, content: action.content || action.description, level: action.level || '' });
+    case 'plan': {
+      const branchStrategy = action.branch_strategy || action.branchStrategy || 'parallel';
+      return _ccApiRequest('/api/plan', {
+        title: action.title, description: action.description || '', priority: action.priority,
+        project: action.project, agent: action.agent, branch_strategy: branchStrategy,
+      });
+    }
+    case 'cancel':
+      return _ccApiRequest('/api/agents/cancel', {
+        agent: action.agent || action.agentId,
+        task: action.task || action.cancelTask,
+        reason: action.reason || 'Cancelled via command center',
+      });
+    case 'retry':
+      return (action.ids || []).map(id => _ccApiRequest('/api/work-items/retry', { id, source: action.source || '' }));
+    case 'pause-plan':
+      return _ccApiRequest('/api/plans/pause', { file: action.file });
+    case 'approve-plan':
+      return _ccApiRequest('/api/plans/approve', { file: action.file });
+    case 'reject-plan':
+      return _ccApiRequest('/api/plans/reject', { file: action.file, reason: action.reason || '' });
+    case 'archive-plan':
+      return _ccApiRequest('/api/plans/archive', { file: action.file });
+    case 'unarchive-plan':
+      return _ccApiRequest('/api/plans/unarchive', { file: action.file });
+    case 'execute-plan':
+      return _ccApiRequest('/api/plans/execute', { file: action.file, project: action.project || '' });
+    case 'trigger-verify':
+      return _ccApiRequest('/api/plans/trigger-verify', { file: action.file });
+    case 'regenerate-plan':
+      return _ccApiRequest('/api/plans/approve', { file: action.file, forceRegen: true });
+    case 'revise-plan':
+      return _ccApiRequest('/api/plans/revise', { file: action.file, feedback: action.feedback || action.description, requestedBy: 'command-center' });
+    case 'edit-prd-item':
+      return _ccApiRequest('/api/prd-items/update', {
+        source: action.source, itemId: action.itemId, name: action.name, description: action.description,
+        priority: action.priority, estimated_complexity: action.estimated_complexity || action.complexity,
+      });
+    case 'remove-prd-item':
+      return _ccApiRequest('/api/prd-items/remove', { source: action.source, itemId: action.itemId });
+    case 'reopen-prd-item':
+      return _ccApiRequest('/api/prd-items/update', { source: action.file, itemId: action.id, status: 'updated' });
+    case 'delete-work-item':
+      return _ccApiRequest('/api/work-items/delete', { id: action.id, source: action.source || '' });
+    case 'cancel-work-item':
+      return _ccApiRequest('/api/work-items/cancel', { id: action.id, source: action.source || '', reason: action.reason || 'cc' });
+    case 'archive-work-item':
+      return _ccApiRequest('/api/work-items/archive', { id: action.id });
+    case 'work-item-feedback':
+      return _ccApiRequest('/api/work-items/feedback', { id: action.id, rating: action.rating || 'up', comment: action.comment || '' });
+    case 'schedule':
+      return _ccApiRequest(action._update ? '/api/schedules/update' : '/api/schedules', {
+        id: action.id, title: action.title, cron: action.cron, type: action.workType || 'implement',
+        project: action.project, agent: action.agent, description: action.description,
+        priority: action.priority, enabled: action.enabled !== false,
+      });
+    case 'delete-schedule':
+      return _ccApiRequest('/api/schedules/delete', { id: action.id });
+    case 'edit-pipeline':
+      return _ccApiRequest('/api/pipelines/update', {
+        id: action.id, title: action.title, stages: action.stages,
+        trigger: action.trigger, enabled: action.enabled, stopWhen: action.stopWhen,
+        monitoredResources: action.monitoredResources,
+      });
+    case 'delete-pipeline':
+      return _ccApiRequest('/api/pipelines/delete', { id: action.id });
+    case 'trigger-pipeline':
+      return _ccApiRequest('/api/pipelines/trigger', { id: action.id });
+    case 'continue-pipeline':
+      return _ccApiRequest('/api/pipelines/continue', { id: action.id, stageId: action.stageId });
+    case 'abort-pipeline':
+      return _ccApiRequest('/api/pipelines/abort', { id: action.id });
+    case 'retrigger-pipeline':
+      return _ccApiRequest('/api/pipelines/retrigger', { id: action.id });
+    case 'add-meeting-note':
+      return _ccApiRequest('/api/meetings/note', { id: action.id, note: action.note || action.content });
+    case 'advance-meeting':
+      return _ccApiRequest('/api/meetings/advance', { id: action.id });
+    case 'end-meeting':
+      return _ccApiRequest('/api/meetings/end', { id: action.id });
+    case 'archive-meeting':
+      return _ccApiRequest('/api/meetings/archive', { id: action.id });
+    case 'unarchive-meeting':
+      return _ccApiRequest('/api/meetings/unarchive', { id: action.id });
+    case 'delete-meeting':
+      return _ccApiRequest('/api/meetings/delete', { id: action.id });
+    case 'set-config':
+      return _ccApiRequest('/api/settings', { engine: { [action.setting]: action.value } });
+    case 'update-routing':
+      return _ccApiRequest('/api/settings/routing', { content: action.content });
+    case 'steer-agent':
+      return _ccApiRequest('/api/agents/steer', { agent: action.agent, message: action.message || action.content });
+    case 'link-pr':
+      return _ccApiRequest('/api/pull-requests/link', { url: action.url, title: action.title || '', project: action.project || '', autoObserve: action.autoObserve !== false });
+    case 'delete-pr':
+      return _ccApiRequest('/api/pull-requests/delete', { id: action.id, project: action.project || '' });
+    case 'file-bug':
+      return _ccApiRequest('/api/issues/create', { title: action.title, description: action.description, labels: action.labels });
+    case 'promote-to-kb':
+      return _ccApiRequest('/api/inbox/promote-kb', { name: action.file, category: action.category || 'project-notes' });
+    case 'kb-sweep':
+      return _ccApiRequest('/api/knowledge/sweep', {});
+    case 'toggle-kb-pin':
+      return _ccApiRequest('/api/kb-pins/toggle', { key: action.key });
+    case 'unpin':
+      return _ccApiRequest('/api/pinned' + '/remove', { title: action.title });
+    case 'add-project':
+      return _ccApiRequest('/api/projects/add', {
+        path: action.path || action.localPath, name: action.name || '',
+        repoHost: action.repoHost || 'github', allowNonRepo: action.allowNonRepo,
+        confirmToken: action.confirmToken,
+      });
+    case 'restart-engine':
+      return _ccApiRequest('/api/engine/restart', {});
+    case 'reset-settings':
+      return _ccApiRequest('/api/settings/reset', {});
+    default:
+      if (action.endpoint) return _ccApiRequest(action.endpoint, action.params || {}, action.method || 'POST');
+      return null;
+  }
+}
+
+async function _ccExecuteLocalApiAction(action) {
+  const mapped = _ccMappedApiRequests(action);
+  if (!mapped) return null;
+  const requests = Array.isArray(mapped) ? mapped : [mapped];
+  if (requests.length === 0) throw new Error(`${action.type} action has no API requests to execute`);
+  const apiResults = [];
+  for (const request of requests) {
+    const method = String(request.method || 'POST').toUpperCase();
+    const endpoint = String(request.endpoint || '').trim();
+    const params = request.params || {};
+    const validationError = _ccValidateLocalApiFallback(endpoint, method);
+    if (validationError) throw new Error(validationError);
+    const response = await _ccInvokeLocalApi({ method, endpoint, params });
+    const status = Number(response?.status) || 0;
+    const data = response?.data === undefined ? {} : response.data;
+    if (status < 200 || status >= 300) {
+      const detail = data && typeof data === 'object' && data.error ? data.error : `HTTP ${status}`;
+      throw new Error(`${method} ${endpoint} failed: ${detail}`);
+    }
+    if (data && typeof data === 'object' && data.error) throw new Error(`${method} ${endpoint} failed: ${data.error}`);
+    apiResults.push({ status, data, endpoint, method });
+  }
+  const firstData = apiResults[0]?.data && typeof apiResults[0].data === 'object' ? apiResults[0].data : {};
+  return {
+    type: action.type,
+    ok: true,
+    endpoint: apiResults[0]?.endpoint,
+    method: apiResults[0]?.method,
+    status: apiResults[0]?.status,
+    ...(firstData.id ? { id: firstData.id } : {}),
+    ...(firstData.file ? { file: firstData.file } : {}),
+    ...(firstData.message ? { message: firstData.message } : {}),
+    ...(apiResults.length > 1 ? { count: apiResults.length, results: apiResults.map(r => r.data) } : { data: firstData }),
+  };
+}
+
 async function executeCCActions(actions) {
   const results = [];
-  for (const action of actions) {
+  for (const rawAction of actions) {
+    const action = normalizeCCAction(rawAction);
     const validationError = _ccValidateAction(action);
     if (validationError) {
       results.push({ type: action?.type || 'unknown', error: validationError });
@@ -2195,7 +2544,7 @@ async function executeCCActions(actions) {
     try {
       switch (action.type) {
         case 'dispatch': case 'fix': case 'implement': case 'explore': case 'review': case 'test': {
-          const workType = routing.normalizeWorkType(action.workType || (action.type !== 'dispatch' ? action.type : WORK_TYPE.IMPLEMENT), WORK_TYPE.IMPLEMENT);
+          const workType = routing.normalizeWorkType(action.workType || WORK_TYPE.IMPLEMENT, WORK_TYPE.IMPLEMENT);
           const id = 'W-' + shared.uid();
           const project = action.project || '';
           const prRef = getWorkItemPrRef(action);
@@ -2447,10 +2796,16 @@ async function executeCCActions(actions) {
           results.push({ type: 'resume-watch', id: action.id, ok: !!resumed });
           break;
         }
-        default:
-          // Server didn't handle — frontend must execute
-          results.push({ type: action.type });
+        default: {
+          const apiResult = await _ccExecuteLocalApiAction(action);
+          if (apiResult) {
+            results.push(apiResult);
+          } else {
+            // Server didn't handle — frontend must execute.
+            results.push({ type: action.type });
+          }
           break;
+        }
       }
     } catch (e) {
       results.push({ type: action.type, error: e.message });
@@ -2661,12 +3016,14 @@ async function ccCall(message, { store = 'cc', sessionKey, extraContext, label =
   const existing = resolveSession(store, sessionKey);
   let sessionId = existing ? existing.sessionId : null;
   const resumeNeedsCarryover = !!sessionId && _ccRuntimeNeedsResumeCarryover(shared.resolveCcCli(CONFIG.engine));
+  const resumeHasOutOfBandCarryover = !!sessionId && _transcriptHasCarryoverContext(transcript, { outOfBandOnly: true, currentMessage: message });
+  const freshNeedsCarryover = _transcriptHasCarryoverContext(transcript, { currentMessage: message });
 
-  function buildPrompt({ includePreamble = true, includeCarryover = false } = {}) {
+  function buildPrompt({ includePreamble = true, includeCarryover = false, outOfBandOnly = false } = {}) {
     const parts = (!skipStatePreamble && includePreamble) ? [`## Current Minions State (${new Date().toISOString().slice(0, 16)})\n\n${buildCCStatePreamble()}`] : [];
     if (extraContext) parts.push(extraContext);
     if (includeCarryover) {
-      const carryover = _buildTranscriptCarryover(transcript, { currentMessage: message });
+      const carryover = _buildTranscriptCarryover(transcript, { currentMessage: message, outOfBandOnly });
       if (carryover) parts.push(carryover);
     }
     parts.push(message);
@@ -2677,7 +3034,11 @@ async function ccCall(message, { store = 'cc', sessionKey, extraContext, label =
 
   // Attempt 1: resume existing session — skip preamble (session already has context)
   if (sessionId && maxTurns > 1) {
-    const p1 = llm.callLLM(buildPrompt({ includePreamble: false, includeCarryover: resumeNeedsCarryover }), '', {
+    const p1 = llm.callLLM(buildPrompt({
+      includePreamble: false,
+      includeCarryover: resumeNeedsCarryover || resumeHasOutOfBandCarryover,
+      outOfBandOnly: !resumeNeedsCarryover,
+    }), '', {
       timeout, label, model, maxTurns, allowedTools, sessionId, effort: ccEffort, direct: true,
       engineConfig: CONFIG.engine,
     });
@@ -2714,7 +3075,7 @@ async function ccCall(message, { store = 'cc', sessionKey, extraContext, label =
   }
 
   // Attempt 2: fresh session (include preamble for full context)
-  const freshPrompt = buildPrompt({ includeCarryover: resumeNeedsCarryover });
+  const freshPrompt = buildPrompt({ includeCarryover: freshNeedsCarryover });
   const p2 = llm.callLLM(freshPrompt, systemPrompt, {
     timeout, label, model, maxTurns, allowedTools, effort: ccEffort, direct: true,
     engineConfig: CONFIG.engine,
@@ -2762,12 +3123,14 @@ async function ccCallStreaming(message, { store = 'cc', sessionKey, extraContext
   const existing = resolveSession(store, sessionKey);
   let sessionId = existing ? existing.sessionId : null;
   const resumeNeedsCarryover = !!sessionId && _ccRuntimeNeedsResumeCarryover(shared.resolveCcCli(CONFIG.engine));
+  const resumeHasOutOfBandCarryover = !!sessionId && _transcriptHasCarryoverContext(transcript, { outOfBandOnly: true, currentMessage: message });
+  const freshNeedsCarryover = _transcriptHasCarryoverContext(transcript, { currentMessage: message });
 
-  function buildPrompt({ includePreamble = true, includeCarryover = false } = {}) {
+  function buildPrompt({ includePreamble = true, includeCarryover = false, outOfBandOnly = false } = {}) {
     const parts = (!skipStatePreamble && includePreamble) ? [`## Current Minions State (${new Date().toISOString().slice(0, 16)})\n\n${buildCCStatePreamble()}`] : [];
     if (extraContext) parts.push(extraContext);
     if (includeCarryover) {
-      const carryover = _buildTranscriptCarryover(transcript, { currentMessage: message });
+      const carryover = _buildTranscriptCarryover(transcript, { currentMessage: message, outOfBandOnly });
       if (carryover) parts.push(carryover);
     }
     parts.push(message);
@@ -2777,7 +3140,11 @@ async function ccCallStreaming(message, { store = 'cc', sessionKey, extraContext
   let result;
 
   if (sessionId && maxTurns > 1) {
-    const p1 = llm.callLLMStreaming(buildPrompt({ includePreamble: false, includeCarryover: resumeNeedsCarryover }), '', {
+    const p1 = llm.callLLMStreaming(buildPrompt({
+      includePreamble: false,
+      includeCarryover: resumeNeedsCarryover || resumeHasOutOfBandCarryover,
+      outOfBandOnly: !resumeNeedsCarryover,
+    }), '', {
       timeout, label, model, maxTurns, allowedTools, sessionId, effort: ccEffort, direct: true,
       engineConfig: CONFIG.engine,
       onChunk,
@@ -2814,7 +3181,7 @@ async function ccCallStreaming(message, { store = 'cc', sessionKey, extraContext
   }
 
   if (onRetry) onRetry(2);
-  const freshPrompt = buildPrompt({ includeCarryover: resumeNeedsCarryover });
+  const freshPrompt = buildPrompt({ includeCarryover: freshNeedsCarryover });
   const p2 = llm.callLLMStreaming(freshPrompt, systemPrompt, {
     timeout, label, model, maxTurns, allowedTools, effort: ccEffort, direct: true,
     engineConfig: CONFIG.engine,
@@ -2998,7 +3365,7 @@ async function _retryDocChatAfterResumeFailure({ result, initialPass, freshSessi
 function _buildDocChatErrorEnvelope(result) {
   return {
     code: result.code ?? null,
-    stderr: (result.stderr || '').slice(-2048),
+    stderr: String(result.stderr || '').slice(-2048),
     errorClass: result.errorClass || null,
     errorMessage: result.errorMessage || null,
     runtime: result.runtime || null,
@@ -3186,7 +3553,7 @@ function _makeDocChatStreamStripper(onChunk) {
 }
 
 // Doc-specific wrapper — adds document context, parses ---DOCUMENT---
-async function ccDocCall({ message, document, title, filePath, selection, canEdit, isJson, model, freshSession, onAbortReady }) {
+async function ccDocCall({ message, document, title, filePath, selection, canEdit, isJson, model, freshSession, transcript, onAbortReady }) {
   const sessionKey = filePath || title;
   const docSlice = String(document || '');
 
@@ -3213,6 +3580,7 @@ async function ccDocCall({ message, document, title, filePath, selection, canEdi
       allowedTools: 'Bash,Read,Write,Edit,Glob,Grep,WebFetch,WebSearch',
       skipStatePreamble: true,
       systemPrompt: DOC_CHAT_SYSTEM_PROMPT,
+      transcript,
       ...(model ? { model } : {}),
       onAbortReady,
     });
@@ -3250,7 +3618,7 @@ async function ccDocCall({ message, document, title, filePath, selection, canEdi
   return _parseDocChatResultText(result.text);
 }
 
-async function ccDocCallStreaming({ message, document, title, filePath, selection, canEdit, isJson, model, freshSession, onAbortReady, onChunk, onToolUse, onRetry }) {
+async function ccDocCallStreaming({ message, document, title, filePath, selection, canEdit, isJson, model, freshSession, transcript, onAbortReady, onChunk, onToolUse, onRetry }) {
   const sessionKey = filePath || title;
   const docSlice = String(document || '');
   const streamStripper = _makeDocChatStreamStripper(onChunk);
@@ -3273,6 +3641,7 @@ async function ccDocCallStreaming({ message, document, title, filePath, selectio
       allowedTools: 'Bash,Read,Write,Edit,Glob,Grep,WebFetch,WebSearch',
       skipStatePreamble: true,
       systemPrompt: DOC_CHAT_SYSTEM_PROMPT,
+      transcript,
       ...(model ? { model } : {}),
       onAbortReady,
       onChunk: streamStripper,
@@ -4110,7 +4479,7 @@ const server = http.createServer(async (req, res) => {
         id, title: body.title, type: 'plan',
         priority: body.priority || 'high', description: body.description || '',
         status: WI_STATUS.PENDING, created: new Date().toISOString(), createdBy: 'dashboard',
-        branchStrategy: body.branch_strategy || 'parallel',
+        branchStrategy: body.branch_strategy || body.branchStrategy || 'parallel',
       };
       if (body.project) item.project = body.project;
       if (body.agent) item.agent = body.agent;
@@ -4313,14 +4682,17 @@ const server = http.createServer(async (req, res) => {
   async function handleAgentsCancel(req, res) {
     try {
       const body = await readBody(req);
+      const requestedAgent = body.agent || body.agentId;
+      const requestedTask = body.task || body.cancelTask;
+      if (!requestedAgent && !requestedTask) return jsonReply(res, 400, { error: 'agent or task required' });
       const dispatchPath = path.join(MINIONS_DIR, 'engine', 'dispatch.json');
       const dispatch = safeJsonObj(dispatchPath);
       const active = dispatch.active || [];
       const cancelled = [];
 
       for (const d of active) {
-        const matchAgent = body.agent && d.agent === body.agent;
-        const matchTask = body.task && (d.task || '').toLowerCase().includes((body.task || '').toLowerCase());
+        const matchAgent = requestedAgent && d.agent === requestedAgent;
+        const matchTask = requestedTask && (d.task || '').toLowerCase().includes(String(requestedTask).toLowerCase());
         if (!matchAgent && !matchTask) continue;
 
         // Kill agent process
@@ -5433,6 +5805,7 @@ What would you like to discuss or change? When you're happy, say "approve" and I
         filePath: body.filePath, selection: body.selection, canEdit, isJson,
         model: body.model || undefined,
         freshSession: !!body.freshSession,
+        transcript: body.transcript,
         onAbortReady: (abort) => { _docAbort = abort; },
       });
       const actionResults = await executeDocChatActions(actions);
@@ -5523,6 +5896,7 @@ What would you like to discuss or change? When you're happy, say "approve" and I
           filePath: body.filePath, selection: body.selection, canEdit, isJson,
           model: body.model || undefined,
           freshSession: !!body.freshSession,
+          transcript: body.transcript,
           onAbortReady: (abort) => { _docAbort = abort; },
           onChunk: (text) => { writeDocEvent({ type: 'chunk', text }); },
           onToolUse: (name, input) => { writeDocEvent({ type: 'tool', name, input: _lightToolInput(input) }); },
@@ -6279,11 +6653,14 @@ What would you like to discuss or change? When you're happy, say "approve" and I
         const wasResume = !!tabSessionId;
         const sessionId = tabSessionId || null;
         const resumeNeedsCarryover = wasResume && _ccRuntimeNeedsResumeCarryover(currentRuntime);
+        const resumeHasOutOfBandCarryover = wasResume && _transcriptHasCarryoverContext(body.transcript, { outOfBandOnly: true, currentMessage: body.message });
         const preamble = wasResume ? '' : buildCCStatePreamble();
-        const carryover = (sessionReset || resumeNeedsCarryover)
+        const includeFullCarryover = sessionReset || resumeNeedsCarryover;
+        const carryover = (includeFullCarryover || resumeHasOutOfBandCarryover)
           ? _buildTranscriptCarryover(body.transcript, {
             previousRuntime: sessionReset ? previousRuntime : null,
             currentMessage: body.message,
+            outOfBandOnly: !includeFullCarryover,
           })
           : '';
         const prompt = _joinCcPromptParts(preamble, carryover, body.message);
@@ -7361,7 +7738,7 @@ What would you like to discuss or change? When you're happy, say "approve" and I
     { method: 'POST', path: '/api/notes-save', desc: 'Save edited notes.md content', params: 'content, file?', handler: handleNotesSave },
 
     // Plans
-    { method: 'POST', path: '/api/plan', desc: 'Create a plan work item that chains to PRD on completion', params: 'title, description?, priority?, project?, agent?, branch_strategy?', handler: handlePlanCreate },
+    { method: 'POST', path: '/api/plan', desc: 'Create a plan work item that chains to PRD on completion', params: 'title, description?, priority?, project?, agent?, branch_strategy? or branchStrategy?', handler: handlePlanCreate },
     { method: 'GET', path: '/api/plans', desc: 'List plan files (.md drafts + .json PRDs)', handler: handlePlansList },
     { method: 'POST', path: '/api/plans/trigger-verify', desc: 'Manually trigger verification for a completed plan', params: 'file', handler: handlePlansTriggerVerify },
     { method: 'POST', path: '/api/plans/approve', desc: 'Approve a plan for execution', params: 'file, approvedBy?', handler: handlePlansApprove },
@@ -7546,7 +7923,7 @@ What would you like to discuss or change? When you're happy, say "approve" and I
         inboxCount: steering.listUnreadSteeringMessages(agentId).length,
       });
     }},
-    { method: 'POST', path: '/api/agents/cancel', desc: 'Cancel an active agent by ID or task substring', params: 'agent?, task?', handler: handleAgentsCancel },
+    { method: 'POST', path: '/api/agents/cancel', desc: 'Cancel an active agent by ID or task substring', params: 'agent? or agentId?, task?', handler: handleAgentsCancel },
     { method: 'POST', path: /^\/api\/agent\/([\w-]+)\/kill$/, template: '/api/agent/:id/kill', desc: 'Kill a running agent: stop process, clear dispatch, reset work items to pending', handler: handleAgentKill },
     { method: 'GET', path: /^\/api\/agent\/([\w-]+)\/live-stream(?:\?.*)?$/, template: '/api/agent/:id/live-stream', desc: 'SSE real-time live output streaming', handler: handleAgentLiveStream },
     { method: 'GET', path: /^\/api\/agent\/([\w-]+)\/live(?:\?.*)?$/, template: '/api/agent/:id/live', desc: 'Tail live output for a working agent', params: 'tail? (bytes, default 8192)', handler: handleAgentLive },
@@ -7592,8 +7969,8 @@ What would you like to discuss or change? When you're happy, say "approve" and I
     { method: 'GET', path: /^\/api\/knowledge\/([^/]+)\/([^?]+)/, template: '/api/knowledge/:category/:file', desc: 'Read a specific knowledge base entry', handler: handleKnowledgeRead },
 
     // Doc chat
-    { method: 'POST', path: '/api/doc-chat', desc: 'Minions-aware doc Q&A + editing via CC session', params: 'message, document, title?, filePath?, selection?, contentHash?', handler: handleDocChat },
-    { method: 'POST', path: '/api/doc-chat/stream', desc: 'Streaming doc chat — SSE with text chunks and tool progress', params: 'message, document, title?, filePath?, selection?, contentHash?', handler: handleDocChatStream },
+    { method: 'POST', path: '/api/doc-chat', desc: 'Minions-aware doc Q&A + editing via CC session', params: 'message, document, title?, filePath?, selection?, contentHash?, transcript?', handler: handleDocChat },
+    { method: 'POST', path: '/api/doc-chat/stream', desc: 'Streaming doc chat — SSE with text chunks and tool progress', params: 'message, document, title?, filePath?, selection?, contentHash?, transcript?', handler: handleDocChatStream },
 
     // Inbox
     { method: 'POST', path: '/api/inbox/persist', desc: 'Promote an inbox item to team notes', params: 'name', handler: handleInboxPersist },
@@ -7617,8 +7994,8 @@ What would you like to discuss or change? When you're happy, say "approve" and I
     // Command Center
     { method: 'POST', path: '/api/command-center/new-session', desc: 'Clear active CC session', handler: handleCommandCenterNewSession },
     { method: 'POST', path: '/api/command-center/abort', desc: 'Abort an in-flight CC request for a tab', params: 'tabId?', handler: handleCommandCenterAbort },
-    { method: 'POST', path: '/api/command-center', desc: 'Conversational command center with full minions context', params: 'message, sessionId?', handler: handleCommandCenter },
-    { method: 'POST', path: '/api/command-center/stream', desc: 'Streaming CC — SSE with text chunks as they arrive', params: 'message, tabId?', handler: handleCommandCenterStream },
+    { method: 'POST', path: '/api/command-center', desc: 'Conversational command center with full minions context', params: 'message, tabId?, sessionId?, transcript?', handler: handleCommandCenter },
+    { method: 'POST', path: '/api/command-center/stream', desc: 'Streaming CC — SSE with text chunks as they arrive', params: 'message, tabId?, sessionId?, transcript?', handler: handleCommandCenterStream },
     { method: 'GET', path: '/api/cc-sessions', desc: 'List CC session metadata for all tabs', handler: handleCCSessionsList },
     { method: 'DELETE', path: /^\/api\/cc-sessions\/([\w-]+)$/, template: '/api/cc-sessions/:id', desc: 'Delete a CC session by tab ID', handler: handleCCSessionDelete },
 
@@ -8018,10 +8395,15 @@ module.exports = {
   _resolveWorkItemsCreateTarget: resolveWorkItemsCreateTarget,
   _collectArchivedWorkItems: collectArchivedWorkItems,
   _createPipelineFromAction: createPipelineFromAction,
+  _setCcLocalApiInvokerForTest,
+  _resetCcApiRoutesMetaForTest,
+  _ccValidateLocalApiFallback,
   executeCCActions,
+  executeDocChatActions,
   buildCCStatePreamble,
   _routesAsMeta,
   _buildTranscriptCarryover,
+  _transcriptHasCarryoverContext,
   _ccRuntimeNeedsResumeCarryover,
   _joinCcPromptParts,
   _captureApiRoutesMeta,

package/docs/command-center.md

@@ -93,6 +93,8 @@ When you ask CC to *do* something, it includes structured action blocks in its r
 | `remove-prd-item` | Remove a PRD item | "Remove P011 from the plan" |
 | `delete-work-item` | Delete a work item | "Delete work item W025" |
 
+For endpoints without a named action, CC may emit a local API fallback action with `endpoint`, `method`, and `params`. The server only invokes safe local `/api/...` paths, validates the requested method against the route index when available, sends GET params as query strings, and rejects streaming/recursive CC/doc-chat endpoints.
+
 ## Error Handling
 
 - **Frontend timeout**: 10-minute `AbortSignal` on the fetch — prevents infinite "thinking" spinner
@@ -155,4 +157,3 @@ Frontend
 ## Command Bar
 
 The command bar at the top of the dashboard routes all input to the CC panel. Typing in the command bar opens the CC drawer and sends the message as a CC turn.
-

package/engine/copilot-models.json

@@ -1,5 +1,5 @@
 {
   "runtime": "copilot",
   "models": null,
-  "cachedAt": "2026-05-07T23:22:07.269Z"
+  "cachedAt": "2026-05-07T23:26:31.525Z"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yemi33/minions",
-  "version": "0.1.1778",
+  "version": "0.1.1780",
   "description": "Multi-agent AI dev team that runs from ~/.minions/ — five autonomous agents share a single engine, dashboard, and knowledge base",
   "bin": {
     "minions": "bin/minions.js"

package/prompts/cc-system.md

@@ -81,17 +81,17 @@ I'll dispatch dallas to fix that bug.
 ===ACTIONS===
 [{"type": "dispatch", "title": "Fix login bug", "workType": "fix", "agents": ["dallas"], "project": "MyApp", "description": "..."}]
 
-**Generic fallback:** For any action not listed below, include `"endpoint": "/api/..."` and `"params": {...}` to call the API directly. Example: `{"type": "custom-op", "endpoint": "/api/some/endpoint", "params": {"key": "value"}}`.
+**Generic fallback:** For any action not listed below, include `"endpoint": "/api/..."`, `"method": "GET|POST|DELETE"`, and `"params": {...}` to call the API directly. Omit `method` only for POST endpoints. Example: `{"type": "custom-op", "endpoint": "/api/some/endpoint", "method": "POST", "params": {"key": "value"}}`.
 
 **Required fields per action type — server rejects with an error if missing:**
 
-- `dispatch` (and aliases: `fix`, `implement`, `explore`, `review`, `test`): `title` is REQUIRED. `description` recommended. `project` REQUIRED when multiple projects are configured (server returns the list of known names if you guess wrong). For agent hints emit either `agents: ["dallas"]` (array, preferred) or `agent: "dallas"` (string — auto-promoted server-side). Unknown agent names error.
+- `dispatch`: `title` is REQUIRED. `description` recommended. `project` REQUIRED when multiple projects are configured (server returns the list of known names if you guess wrong). For agent hints emit either `agents: ["dallas"]` (array, preferred) or `agent: "dallas"` (string — auto-promoted server-side). Unknown agent names error. Always emit `"type":"dispatch"` for dispatch-like work and preserve the semantic intent in `workType` (`fix`, `implement`, `explore`, `review`, or `test`) instead of using those words as action types.
 - `build-and-test`: `pr` REQUIRED (number, ID, or URL).
 - `note`: `title` and `content` (or `description`) REQUIRED.
 - `knowledge`: `title`, `content`, and `category` REQUIRED. Valid categories: architecture, conventions, project-notes, build-reports, reviews.
 
 Core action types:
-- **dispatch**: title (REQUIRED), workType, priority (low/medium/high), agents[] or agent (optional — both shapes accepted), project (REQUIRED when multi-project unless `pr` resolves to a tracked PR), description, pr (optional PR number/id/url for work that targets an existing PR), scope (`"fan-out"` only when the user explicitly asks to fan out to all agents)
+- **dispatch**: title (REQUIRED), workType, priority (low/medium/high), agents[] or agent (optional — both shapes accepted), project (REQUIRED when multi-project unless `pr` resolves to a tracked PR), description, pr (optional PR number/id/url for work that targets an existing PR), scope (`"fan-out"` only when the user explicitly asks to fan out to all agents). Do not emit `type:"fix"` or `type:"implement"`; emit `type:"dispatch"` with `workType:"fix"` or `workType:"implement"`.
   workTypes: `explore` (research/report only, NO PR), `ask` (answer/report, NO PR), `implement` (new code, PR REQUIRED), `fix` (standalone bug fix creates a PR; include `pr` when fixing review comments/build failures on an existing PR), `review` (code review, NO PR), `test` (tests, PR if new), `verify` (merge/build/maintenance, NO PR)
   If the user wants a design/architecture artifact committed through a PR, dispatch `implement` or `docs` rather than `explore`.
   When the user names a specific agent ("assign this to lambert"), put exactly that one name in `agents` (e.g. `"agents": ["lambert"]`). A single-agent assignment is hard-pinned by the server — it will queue for that agent only and skip the routing table. If the user explicitly asks for fan-out/all agents, set `scope: "fan-out"`.
@@ -143,7 +143,7 @@ Additional actions (all take `id` or `file` as primary key):
 - KB/Inbox: promote-to-kb (file, category), kb-sweep, toggle-kb-pin (key)
 - Plan lifecycle: revise-plan (file, feedback — dispatches agent to revise)
 - Pipeline: continue-pipeline (id — resume past wait stage)
-- Projects: add-project (localPath, name, repoHost)
+- Projects: add-project (path or localPath, name, repoHost)
 - Engine: restart-engine, reset-settings
 - Other: unpin (title), link-pr (url, title, project, autoObserve), delete-pr (id, project), update-routing (content), file-bug (title, description, labels)
 
@@ -159,8 +159,8 @@ Terms like schedules, pipelines, agents, inbox, work items, plans, PRD, PRs, dis
 ## API & CLI Index (auto-injected)
 Your state preamble (delivered alongside this prompt at session start) carries an auto-generated **API Index** rendered from `dashboard.js` `ROUTES` and a **CLI Index** rendered from `engine/cli.js` `CLI_COMMAND_DOCS`. Both are single-source-of-truth — adding a new HTTP endpoint or CLI command auto-surfaces it in your preamble; do not memorize the named action shorthand list above as exhaustive.
 
-For a `POST /api/...` endpoint marked `generic-fallback` in the API Index that doesn't have a matching named action above, emit the generic fallback shape:
-`{"type":"<short-descriptor>","endpoint":"/api/...","params":{...}}`
-The action runner POSTs `params` as JSON; do not use the fallback for read-only GET routes, DELETE routes, or endpoints not marked generic-fallback.
+For any safe local `/api/...` endpoint that doesn't have a matching named action above, emit the generic fallback shape:
+`{"type":"<short-descriptor>","endpoint":"/api/...","method":"GET|POST|DELETE","params":{...}}`
+The action runner enforces the endpoint method from the API index when available, sends GET params as query strings, sends POST/DELETE params as JSON, and rejects Command Center, doc-chat, bot, or streaming endpoints.
 
 For CLI commands (`minions <cmd>`), use Bash to invoke them when delegating would be heavier than just running the command.