@yemi33/minions 0.1.1909 → 0.1.1910

package/README.md

@@ -15,6 +15,8 @@ Inspired by and initially scaffolded from [Brady Gaster's Squad](https://bradyga
 - **Anthropic API key** or Claude Max subscription (agents spawn Claude Code sessions)
 - **Git** — agents create worktrees for all code changes
 
+> **Note:** you do **not** need to configure your CLI for "autopilot" / "bypass permissions" / "dangerous mode". Minions passes the right bypass flag per spawn (`--dangerously-skip-permissions` for Claude; `--autopilot --allow-all --no-ask-user` for Copilot), independent of your global CLI config. Run `minions doctor` to verify your installed CLI accepts those flags.
+
 ## Installation
 
 ```bash

package/engine/preflight.js

@@ -10,7 +10,7 @@
 
 const fs = require('fs');
 const path = require('path');
-const { execSync } = require('child_process');
+const { execSync, execFileSync } = require('child_process');
 
 /**
  * Resolve the Claude Code CLI binary path. Legacy helper preserved for back-
@@ -421,6 +421,115 @@ async function _modelDiscoveryResults(config) {
   return results;
 }
 
+/**
+ * Spawn `<resolved.bin> --help` and return the combined stdout/stderr, or null
+ * if the binary couldn't be invoked at all. Used only by the bypass-flag check
+ * in `_bypassFlagResults`; never on the hot path of `runPreflight` because
+ * it adds a subprocess invocation per runtime.
+ *
+ * Many CLIs emit `--help` to stderr or return a non-zero code when invoked in
+ * a non-TTY context, so we tolerate both — `execFileSync` populates `stdout`
+ * and `stderr` on the thrown error and we read them back.
+ */
+function _fetchCliHelpText(resolved, { timeoutMs = 5000 } = {}) {
+  if (!resolved || !resolved.bin) return null;
+  const leading = Array.isArray(resolved.leadingArgs) ? resolved.leadingArgs : [];
+  let cmd;
+  let args;
+  if (resolved.native === false) {
+    // Node shim (e.g. claude/cli.js). Invoke via the current Node so we don't
+    // depend on a `node` on PATH and we honor the same execPath the engine
+    // uses for spawn-agent.
+    cmd = process.execPath;
+    args = [resolved.bin, ...leading, '--help'];
+  } else {
+    cmd = resolved.bin;
+    args = [...leading, '--help'];
+  }
+  try {
+    const out = execFileSync(cmd, args, {
+      encoding: 'utf8',
+      windowsHide: true,
+      timeout: timeoutMs,
+      stdio: ['ignore', 'pipe', 'pipe'],
+    });
+    return String(out || '');
+  } catch (e) {
+    const stdout = e && e.stdout ? String(e.stdout) : '';
+    const stderr = e && e.stderr ? String(e.stderr) : '';
+    const combined = stdout + stderr;
+    return combined.length > 0 ? combined : null;
+  }
+}
+
+/**
+ * Pure helper — takes the adapter and the help text and returns a doctor
+ * result entry. Splitting this from the spawn keeps the helper unit-testable
+ * without mocking `execFileSync`. The check is `warn`-level (not critical) so
+ * a false positive from a CLI that renames flags or paginates help doesn't
+ * block existing installs; the engine spawns will still error loudly if the
+ * flag really isn't honored.
+ */
+function _checkBypassFlagSupported(runtimeName, adapter, helpText) {
+  const name = `Permission bypass: ${runtimeName}`;
+  const flags = Array.isArray(adapter && adapter.permissionBypassFlags)
+    ? adapter.permissionBypassFlags.filter(f => typeof f === 'string' && f.length > 0)
+    : [];
+  if (flags.length === 0) {
+    return {
+      name,
+      ok: 'warn',
+      message: `adapter did not declare permissionBypassFlags — cannot verify ${runtimeName} CLI accepts headless bypass`,
+    };
+  }
+  if (helpText == null || helpText === '') {
+    return {
+      name,
+      ok: 'warn',
+      message: `could not invoke ${runtimeName} --help to verify ${flags.join(' ')} support — Minions will still pass the flag(s) but you may see permission prompts if the CLI doesn't accept them`,
+    };
+  }
+  const missing = flags.filter(f => !helpText.includes(f));
+  if (missing.length > 0) {
+    return {
+      name,
+      ok: 'warn',
+      message: `${runtimeName} --help does not list expected flag(s): ${missing.join(', ')} — your CLI may be outdated. Agents will hang on permission prompts. Update with the CLI's package manager (npm i -g @anthropic-ai/claude-code for Claude; winget upgrade Microsoft.CopilotCLI for Copilot)`,
+    };
+  }
+  return {
+    name,
+    ok: true,
+    message: `${flags.join(' ')} accepted`,
+  };
+}
+
+/**
+ * Build the per-runtime bypass-flag verification entries for `minions doctor`.
+ * One entry per distinct configured runtime. Skipped silently when the binary
+ * itself didn't resolve (the upstream `Runtime: <name>` check already surfaces
+ * that failure — no point shouting twice).
+ */
+function _bypassFlagResults(config) {
+  const results = [];
+  if (!config || typeof config !== 'object') return results;
+  let registry;
+  try { registry = require('./runtimes'); } catch { return results; }
+  const runtimes = _distinctRuntimes(config);
+  for (const runtimeName of runtimes) {
+    let adapter;
+    try { adapter = registry.resolveRuntime(runtimeName); }
+    catch { continue; }
+    let resolved = null;
+    try { resolved = adapter.resolveBinary({ env: process.env }); }
+    catch { /* upstream Runtime check already reported this */ }
+    if (!resolved || !resolved.bin) continue;
+    const helpText = _fetchCliHelpText(resolved);
+    results.push(_checkBypassFlagSupported(runtimeName, adapter, helpText));
+  }
+  return results;
+}
+
 /**
  * Run extended doctor checks (preflight + runtime health + fleet summary +
  * per-runtime model discovery).
@@ -552,6 +661,11 @@ function doctor(minionsHome) {
     runtimeResults.push(...fleetSummary);
     const modelResults = await _modelDiscoveryResults(preflightConfig);
     runtimeResults.push(...modelResults);
+    // Verify each runtime CLI still recognizes the headless bypass flags the
+    // adapters inject. Catches "user installed an outdated CLI" before the
+    // first agent silently hangs on a permission prompt.
+    const bypassResults = _bypassFlagResults(preflightConfig);
+    runtimeResults.push(...bypassResults);
 
     // Print all
     const allResults = [...results, ...runtimeResults];
@@ -584,4 +698,7 @@ module.exports = {
   _warmModelCache,
   _fleetSummaryResults,
   _modelDiscoveryResults,
+  _fetchCliHelpText,
+  _checkBypassFlagSupported,
+  _bypassFlagResults,
 };

package/engine/runtimes/claude.js

@@ -689,6 +689,14 @@ function createStreamConsumer(ctx) {
   return { consume, reset };
 }
 
+// ── Permission Bypass ───────────────────────────────────────────────────────
+//
+// Flags the engine relies on for headless operation. `preflight.doctor()`
+// shells out to `<bin> --help` and verifies each literal appears in the help
+// text — surfaces "your CLI is too old / has been renamed" before agents
+// silently hang on permission prompts. Must stay in sync with `buildArgs`.
+const PERMISSION_BYPASS_FLAGS = ['--dangerously-skip-permissions'];
+
 // ── Capability Block ────────────────────────────────────────────────────────
 
 const capabilities = {
@@ -806,6 +814,7 @@ module.exports = {
   parseStreamChunk,
   parseError,
   createStreamConsumer,
+  permissionBypassFlags: PERMISSION_BYPASS_FLAGS,
   // Exposed for unit tests — never imported by engine code
   _CLAUDE_SHORTHANDS,
   THINKING_BLOCK_TYPES,

package/engine/runtimes/copilot.js

@@ -1062,6 +1062,14 @@ function createStreamConsumer(ctx) {
   return { consume, reset };
 }
 
+// ── Permission Bypass ───────────────────────────────────────────────────────
+//
+// Flags the engine relies on for headless operation. `preflight.doctor()`
+// shells out to `<bin> --help` and verifies each literal appears in the help
+// text — surfaces "your CLI is too old / has been renamed" before agents
+// silently hang on permission prompts. Must stay in sync with `buildArgs`.
+const PERMISSION_BYPASS_FLAGS = ['--autopilot', '--allow-all', '--no-ask-user'];
+
 // ── Capability Block ────────────────────────────────────────────────────────
 
 const capabilities = {
@@ -1170,6 +1178,7 @@ module.exports = {
   parseStreamChunk,
   parseError,
   createStreamConsumer,
+  permissionBypassFlags: PERMISSION_BYPASS_FLAGS,
   // Exposed for unit tests — engine code MUST go through resolveRuntime + the
   // adapter contract; never reach into these helpers directly.
   _MINIONS_MODEL_ALIASES,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yemi33/minions",
-  "version": "0.1.1909",
+  "version": "0.1.1910",
   "description": "Multi-agent AI dev team that runs from ~/.minions/ — five autonomous agents share a single engine, dashboard, and knowledge base",
   "bin": {
     "minions": "bin/minions.js"