@yemi33/minions 0.1.1781 → 0.1.1783

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## 0.1.1783 (2026-05-07)
+
+### Fixes
+- forbid manual git worktree add in CC system prompt
+
+## 0.1.1782 (2026-05-07)
+
+### Other
+- refactor(worktree): consolidate porcelain parsers behind shared helper
+
 ## 0.1.1781 (2026-05-07)
 
 ### Fixes

package/engine/cleanup.js

@@ -68,11 +68,13 @@ function isProtectedLocalBranch(branch, project = {}) {
 
 function localBranchWorktreeInUse(root, branch) {
   try {
-    const out = String(shared.execSilent('git worktree list --porcelain', {
+    const raw = String(shared.execSilent('git worktree list --porcelain', {
       cwd: root, encoding: 'utf8', stdio: 'pipe', timeout: 10000, windowsHide: true,
     }) || '');
-    return out.split(/\r?\n/).some(line => line.trim() === `branch refs/heads/${branch}`);
+    return shared.parseWorktreePorcelain(raw).some(w => w.branch === branch);
   } catch {
+    // Defensive: assume "in use" so the caller doesn't proceed to delete a
+    // branch when worktree state can't be enumerated.
     return true;
   }
 }
@@ -386,17 +388,16 @@ async function runCleanup(config, verbose = false) {
       log('warn', `Project "${project.name || root}" has localPath "${root}" which does not exist on disk — skipping worktree scan`);
       continue;
     }
-    let raw;
+    let trees;
     try {
-      raw = String(shared.execSilent('git worktree list --porcelain', { cwd: root, timeout: 10000, windowsHide: true }) || '');
+      const raw = String(shared.execSilent('git worktree list --porcelain', { cwd: root, timeout: 10000, windowsHide: true }) || '');
+      trees = shared.parseWorktreePorcelain(raw);
     } catch (e) { log('warn', `nested-worktree scan for ${project.name || root}: ${e.message}`); continue; }
-    for (const line of raw.split('\n')) {
-      if (!line.startsWith('worktree ')) continue;
-      const wt = line.slice('worktree '.length).trim();
-      if (!wt) continue;
-      if (!shared.isPathInside(wt, root)) continue; // strict — main worktree (equal path) is expected, descendants are the leak
+    for (const wt of trees) {
+      // Strict — main worktree (equal path) is expected, descendants are the leak.
+      if (!shared.isPathInside(wt.path, root)) continue;
       cleaned.nestedWorktrees++;
-      log('warn', `Nested worktree in project "${project.name || root}": "${wt}" is inside "${root}". This causes glob tools to match both copies and produces mirror writes. Run: git worktree remove "${wt}"`);
+      log('warn', `Nested worktree in project "${project.name || root}": "${wt.path}" is inside "${root}". This causes glob tools to match both copies and produces mirror writes. Run: git worktree remove "${wt.path}"`);
     }
   }
 

package/engine/copilot-models.json

@@ -1,5 +1,5 @@
 {
   "runtime": "copilot",
   "models": null,
-  "cachedAt": "2026-05-07T23:33:01.432Z"
+  "cachedAt": "2026-05-07T23:48:12.752Z"
 }

package/engine/shared.js

@@ -2177,6 +2177,42 @@ function isPathInsideOrEqual(childPath, parentPath) {
   return isPathInside(childAbs, parentAbs);
 }
 
+/**
+ * Parse `git worktree list --porcelain` output. Pure — callers run the
+ * subprocess (sync `execSilent` or async `execAsync`) and feed stdout in.
+ *
+ * Returns `[{path, head, branch, bare, detached, locked, prunable}]`.
+ * `branch` strips the `refs/heads/` prefix; flag fields default to false.
+ *
+ * Porcelain format: each worktree is a block of `key value\n` lines
+ * terminated by a blank line. First line of every block is `worktree <path>`
+ * (always present). Optional follow-ups: `HEAD <sha>`, `branch refs/heads/<name>`,
+ * and the flag lines `bare`, `detached`, `locked [<reason>]`, `prunable [<reason>]`.
+ */
+function parseWorktreePorcelain(raw) {
+  const trees = [];
+  if (!raw) return trees;
+  let current = null;
+  const flush = () => { if (current) { trees.push(current); current = null; } };
+  for (const line of String(raw).split(/\r?\n/)) {
+    if (line === '') { flush(); continue; }
+    if (line.startsWith('worktree ')) {
+      flush();
+      current = { path: line.slice('worktree '.length).trim(), head: '', branch: '', bare: false, detached: false, locked: false, prunable: false };
+      continue;
+    }
+    if (!current) continue;
+    if (line.startsWith('HEAD ')) current.head = line.slice('HEAD '.length).trim();
+    else if (line.startsWith('branch ')) current.branch = line.slice('branch '.length).trim().replace(/^refs\/heads\//, '');
+    else if (line === 'bare') current.bare = true;
+    else if (line === 'detached') current.detached = true;
+    else if (line === 'locked' || line.startsWith('locked ')) current.locked = true;
+    else if (line === 'prunable' || line.startsWith('prunable ')) current.prunable = true;
+  }
+  flush();
+  return trees;
+}
+
 /**
  * Throws when `worktreePath` would land inside (or equal) `projectRoot`.
  * Called by the engine spawn path before `git worktree add`, and by the
@@ -3269,6 +3305,7 @@ module.exports = {
   buildWorktreeDirName, // exported for testing
   isPathInside,
   isPathInsideOrEqual,
+  parseWorktreePorcelain,
   assertWorktreeOutsideProject,
   isLiveCommandCenterPath,
   describeCcProtectedPaths,

package/engine.js

@@ -474,20 +474,8 @@ async function syncReusedWorktree(rootDir, worktreePath, branchName, gitOpts = {
 async function findExistingWorktree(repoDir, branchName) {
   try {
     const out = await execAsync(`git worktree list --porcelain`, { cwd: repoDir, timeout: 10000 });
-    const branchRef = `branch refs/heads/${branchName}`;
-    const lines = out.split('\n');
-    for (let i = 0; i < lines.length; i++) {
-      if (lines[i].trim() === branchRef) {
-        // Walk back to find the worktree path
-        for (let j = i - 1; j >= 0; j--) {
-          if (lines[j].startsWith('worktree ')) {
-            const wtPath = lines[j].slice('worktree '.length).trim();
-            if (fs.existsSync(wtPath)) return wtPath;
-            break;
-          }
-        }
-      }
-    }
+    const found = shared.parseWorktreePorcelain(out).find(w => w.branch === branchName);
+    if (found && fs.existsSync(found.path)) return found.path;
   } catch (e) { log('warn', 'git: ' + e.message); }
   return null;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yemi33/minions",
-  "version": "0.1.1781",
+  "version": "0.1.1783",
   "description": "Multi-agent AI dev team that runs from ~/.minions/ — five autonomous agents share a single engine, dashboard, and knowledge base",
   "bin": {
     "minions": "bin/minions.js"

package/prompts/cc-system.md

@@ -155,6 +155,7 @@ Terms like schedules, pipelines, agents, inbox, work items, plans, PRD, PRs, dis
 2. Be specific — cite IDs, names, filenames, line numbers.
 3. Never modify engine source. Never push to git without user confirmation.
 4. Estimate first, then act (see Role: Orchestrator). For Medium-and-above tasks, your tools are for orientation; the agent does the work. For Small tasks, you may do them yourself.
+5. **Never run `git worktree add` directly.** Worktrees are managed by the engine — they get created automatically when you dispatch an `implement`/`fix`/`test`/`verify`/`review` agent (the engine places them at `engine.worktreeRoot`, default `../worktrees/`, never inside the project tree). A worktree placed inside a project root causes glob/grep tools to match both copies of every file and produces silent mirror-write leaks. If you need work done on a branch, dispatch an agent with the appropriate type — do not manually `git worktree add`, `git worktree remove`, or shell out around the engine's worktree management.
 
 ## API & CLI Index (auto-injected)
 Your state preamble (delivered alongside this prompt at session start) carries an auto-generated **API Index** rendered from `dashboard.js` `ROUTES` and a **CLI Index** rendered from `engine/cli.js` `CLI_COMMAND_DOCS`. Both are single-source-of-truth — adding a new HTTP endpoint or CLI command auto-surfaces it in your preamble; do not memorize the named action shorthand list above as exhaustive.