@yemi33/minions 0.1.1950 → 0.1.1952

package/dashboard.js

@@ -34,12 +34,20 @@ const features = require('./engine/features');
 const ccWorkerPool = require('./engine/cc-worker-pool');
 const os = require('os');
 
-const { safeRead, safeReadDir, safeWrite, safeJson, safeJsonObj, safeJsonArr, safeJsonNoRestore, safeUnlink, mutateJsonFileLocked, mutateTextFileLocked, mutateControl, mutateCooldowns, mutateWorkItems, getProjects: _getProjects, DONE_STATUSES, WI_STATUS, WORK_TYPE, reopenWorkItem } = shared;
+const { safeRead, safeReadDir, safeWrite, safeJson, safeJsonObj, safeJsonArr, safeJsonNoRestore, safeUnlink, mutateJsonFileLocked, mutateTextFileLocked, mutateControl, mutateCooldowns, mutateWorkItems, getProjects: _getProjects, DONE_STATUSES, WI_STATUS, WORK_TYPE, WORKTREE_REQUIRING_TYPES, reopenWorkItem } = shared;
 const { getAgents, getAgentDetail, getPrdInfo, getWorkItems, getDispatchQueue,
   getSkills, getInbox, getNotesWithMeta, getPullRequests,
-  getEngineLog, getMetrics, getKnowledgeBaseEntries, timeSince,
+  getEngineLog, getMetrics, getKnowledgeBaseEntries, getProjectGitStatus, timeSince,
   MINIONS_DIR, AGENTS_DIR, ENGINE_DIR, INBOX_DIR, DISPATCH_PATH, PRD_DIR } = queries;
 
+// Dev vs binary differentiation. When two dashboards run side-by-side (npm
+// install on 7331, local checkout on 7332), the favicon and title need to
+// differ so tabs don't blur together. Detected once at startup: only git
+// checkouts have a .git next to dashboard.js; the npm-installed copy doesn't.
+const IS_DEV_MODE = fs.existsSync(path.join(MINIONS_DIR, '.git'));
+const FAVICON_EMOJI = IS_DEV_MODE ? '🚧' : '👽';
+const TITLE_SUFFIX = IS_DEV_MODE ? ' [DEV]' : '';
+
 // Startup size guard (#1167): fail fast with a clear error when dispatch.json /
 // cooldowns.json have ballooned past ENGINE_DEFAULTS.maxStateFileBytes. Without
 // this, V8 silently OOMs on JSON.parse(~1 GB) and the operator has no hint as to
@@ -892,7 +900,9 @@ function buildDashboardHtml() {
   let assembled = layout
     .replace('/* __CSS__ */', () => css)
     .replace('<!-- __PAGES__ -->', () => pageHtml)
-    .replace('/* __JS__ */', () => `window.__MINIONS_HOME = ${JSON.stringify(os.homedir())};\n${featuresBootstrap}${jsHtml}`);
+    .replace('/* __JS__ */', () => `window.__MINIONS_HOME = ${JSON.stringify(os.homedir())};\n${featuresBootstrap}${jsHtml}`)
+    .replace(/\{\{favicon_emoji\}\}/g, FAVICON_EMOJI)
+    .replace(/\{\{title_suffix\}\}/g, TITLE_SUFFIX);
 
   if (_isTestMode()) {
     const label = _testBadgeLabel();
@@ -1484,7 +1494,12 @@ function getStatus() {
       })(),
       pipelines: (() => { try { const pl = require('./engine/pipeline'); return pl.getPipelines().map(p => ({ ...p, runs: (pl.getPipelineRuns()[p.id] || []).slice(-5) })); } catch { return []; } })(),
       pinned: (() => { try { return parsePinnedEntries(safeRead(PINNED_PATH)); } catch { return []; } })(),
-      projects: PROJECTS.map(p => ({ name: p.name, path: p.localPath, description: p.description || '' })),
+      projects: PROJECTS.map(p => ({
+        name: p.name,
+        path: p.localPath,
+        description: p.description || '',
+        ...getProjectGitStatus(p.localPath),
+      })),
       autoMode: {
         approvePlans: !!CONFIG.engine?.autoApprovePlans,
         decompose: CONFIG.engine?.autoDecompose !== false,
@@ -2360,6 +2375,17 @@ function flushPendingDocSessions() {
   }
 }
 
+// Peek without mutating — resolveSession deletes on mismatch, but callers
+// need the bit *before* the deletion to surface a user-visible notice.
+function docSessionWillBeInvalidated(key) {
+  if (!key) return false;
+  const s = docSessions.get(key);
+  return !!(s && s._promptHash !== _docChatPromptHash);
+}
+
+const DOC_SESSION_REFRESHED_NOTICE =
+  '_[Note: previous conversation in this doc was dropped because the system prompt changed (likely an engine update). Starting a fresh session — earlier turns are not in context.]_\n\n';
+
 // Resolve session from any store (CC global or doc-specific)
 function resolveSession(store, key) {
   if (store === 'cc') {
@@ -3226,6 +3252,8 @@ async function ccDocCall({ message, document, title, filePath, selection, canEdi
   const sessionKey = filePath || title;
   const docSlice = String(document || '');
 
+  const sessionWasInvalidated = !freshSession && docSessionWillBeInvalidated(sessionKey);
+
   // freshSession: true → discard any prior session for this key so the call starts clean.
   // Used by one-shot generation flows (e.g. Create Plan from meeting) that must not
   // bleed context from earlier conversations.
@@ -3309,7 +3337,8 @@ async function ccDocCall({ message, document, title, filePath, selection, canEdi
   // tools (verified by _finalizeDocChatEdit re-reading disk); state mutations
   // land via direct /api/* calls (correlated by X-CC-Turn-Id, surfaced as
   // chips server-side).
-  return { answer: result.text, toolUses: Array.isArray(result.toolUses) ? result.toolUses : [] };
+  const answerText = sessionWasInvalidated ? DOC_SESSION_REFRESHED_NOTICE + result.text : result.text;
+  return { answer: answerText, toolUses: Array.isArray(result.toolUses) ? result.toolUses : [] };
 }
 
 async function ccDocCallStreaming({ message, document, title, filePath, selection, canEdit, isJson, model, freshSession, transcript, onAbortReady, onChunk, onToolUse, onRetry, systemPrompt = DOC_CHAT_SYSTEM_PROMPT, turnId }) {
@@ -3317,6 +3346,11 @@ async function ccDocCallStreaming({ message, document, title, filePath, selectio
   const docSlice = String(document || '');
   const streamStripper = _makeDocChatStreamStripper(onChunk);
 
+  // Notice is surfaced via the final answer prepend below, not via onChunk:
+  // modal-qa's chunk handler replaces (not appends) streamedText, so an
+  // early-emit chunk would be wiped by the next LLM token.
+  const sessionWasInvalidated = !freshSession && docSessionWillBeInvalidated(sessionKey);
+
   if (freshSession && sessionKey) {
     docSessions.delete(sessionKey);
   }
@@ -3383,7 +3417,8 @@ async function ccDocCallStreaming({ message, document, title, filePath, selectio
   // tools (verified by _finalizeDocChatEdit re-reading disk); state mutations
   // land via direct /api/* calls (correlated by X-CC-Turn-Id, surfaced as
   // chips server-side).
-  return { answer: result.text, toolUses: Array.isArray(result.toolUses) ? result.toolUses : [] };
+  const finalAnswerText = sessionWasInvalidated ? DOC_SESSION_REFRESHED_NOTICE + result.text : result.text;
+  return { answer: finalAnswerText, toolUses: Array.isArray(result.toolUses) ? result.toolUses : [] };
 }
 
 // -- POST helpers --
@@ -3437,6 +3472,119 @@ function readBody(req) {
   });
 }
 
+// Pick the best PowerShell executable for in-process dialogs. pwsh.exe
+// (PowerShell 7+) runs on .NET 8 which is required for
+// Microsoft.Win32.OpenFolderDialog (used by handleProjectsBrowse to get a
+// modern Explorer-style picker that honors InitialDirectory). powershell.exe
+// (Windows PowerShell 5.1) is .NET Framework 4.x and falls through to the
+// older BrowseForFolder fallback. Probes pwsh once on first call and caches
+// the result. _execModule override is for tests.
+let _cachedPwshExe = null;
+function _pickPwshExe(_execModule) {
+  if (_cachedPwshExe !== null) return _cachedPwshExe;
+  if (process.platform !== 'win32') return (_cachedPwshExe = 'pwsh');
+  const cp = _execModule || require('child_process');
+  try {
+    cp.execFileSync('pwsh.exe', ['-NoProfile', '-Command', '$PSVersionTable.PSVersion.Major'], {
+      encoding: 'utf8', timeout: 5000, windowsHide: true, stdio: ['ignore', 'pipe', 'ignore'],
+    });
+    _cachedPwshExe = 'pwsh.exe';
+  } catch {
+    _cachedPwshExe = 'powershell.exe';
+  }
+  return _cachedPwshExe;
+}
+function _resetPwshExeCache() { _cachedPwshExe = null; } // test hook
+
+// PowerShell script for the modern slim-UX folder picker — Explorer-style
+// (Microsoft.Win32.OpenFolderDialog with native path bar + InitialDirectory)
+// with a Shell.Application.BrowseForFolder fallback for older PowerShell.
+// Both branches use a topmost owner so the dialog comes to front. Returns a
+// self-contained script string the dashboard writes to disk and spawns via
+// pwsh. Gated behind the `modernPicker` request flag — classic UX uses
+// _buildBrowseScriptClassic instead so its UX stays exactly as it was.
+function _buildBrowseScriptModern(initialPath) {
+  const psInitial = String(initialPath || '').replace(/'/g, "''");
+  return [
+    "$initial = '" + psInitial + "'",
+    '$selected = $null',
+    'try {',
+    '  Add-Type -AssemblyName PresentationFramework -ErrorAction Stop',
+    '  Add-Type -AssemblyName WindowsBase -ErrorAction Stop',
+    '  $ownerWin = New-Object System.Windows.Window',
+    '  $ownerWin.Topmost = $true',
+    '  $ownerWin.ShowInTaskbar = $false',
+    '  $ownerWin.WindowStyle = "None"',
+    '  $ownerWin.Width = 1; $ownerWin.Height = 1',
+    '  $ownerWin.Left = -10000; $ownerWin.Top = -10000',
+    '  $ownerWin.Show()',
+    '  $f = New-Object Microsoft.Win32.OpenFolderDialog -ErrorAction Stop',
+    '  $f.Title = "Select project folder"',
+    '  if ($initial -ne "" -and (Test-Path -LiteralPath $initial -PathType Container)) {',
+    '    $f.InitialDirectory = $initial',
+    '  }',
+    '  if ($f.ShowDialog($ownerWin)) { $selected = $f.FolderName }',
+    '  $ownerWin.Close()',
+    '} catch {',
+    '  Add-Type -AssemblyName System.Windows.Forms',
+    '  $owner = New-Object System.Windows.Forms.Form',
+    '  $owner.TopMost = $true',
+    '  $owner.StartPosition = "CenterScreen"',
+    '  $owner.WindowState = "Minimized"',
+    '  $owner.Show(); $owner.Hide()',
+    '  $shell = New-Object -ComObject Shell.Application',
+    '  $folder = $shell.BrowseForFolder($owner.Handle.ToInt32(), "Select project folder", 0x50, 0)',
+    '  if ($folder -ne $null) { $selected = $folder.Self.Path }',
+    '  $owner.Dispose()',
+    '}',
+    'if ($selected) { Write-Output $selected }',
+  ].join('\r\n');
+}
+
+// PowerShell script for the classic dashboard folder picker — preserves the
+// original WinForms FolderBrowserDialog UX (tree-only, no typing,
+// no InitialDirectory). Kept verbatim so the non-slim dashboard's
+// "Scan Projects" flow looks identical to its pre-slim-UX behavior.
+function _buildBrowseScriptClassic() {
+  return [
+    'Add-Type -AssemblyName System.Windows.Forms',
+    '$f = New-Object System.Windows.Forms.FolderBrowserDialog',
+    '$f.Description = "Select project folder"',
+    '$f.ShowNewFolderButton = $false',
+    '$owner = New-Object System.Windows.Forms.Form',
+    '$owner.TopMost = $true',
+    '$owner.StartPosition = "CenterScreen"',
+    '$owner.WindowState = "Minimized"',
+    '$owner.Show()',
+    '$owner.Hide()',
+    'if ($f.ShowDialog($owner) -eq "OK") { Write-Output $f.SelectedPath }',
+    '$owner.Dispose()',
+  ].join('\r\n');
+}
+
+// Resolve a user-typed candidate path to the nearest existing directory by
+// walking up its parents. Used by handleProjectsBrowse to pre-seed the
+// folder picker: a typed-but-not-yet-existing path like `C:\code\new-proj`
+// should still open the picker at `C:\code` rather than at the user's
+// default. Returns '' when no usable ancestor exists. Pure helper — fsModule
+// override is for tests.
+function _resolveBrowseInitialPath(candidate, fsModule) {
+  const fsm = fsModule || fs;
+  if (!candidate || typeof candidate !== 'string') return '';
+  const trimmed = candidate.trim();
+  if (!trimmed) return '';
+  let resolved = path.resolve(trimmed);
+  while (resolved) {
+    try {
+      if (fsm.statSync(resolved).isDirectory()) return resolved;
+    } catch { /* keep walking up */ }
+    const parent = path.dirname(resolved);
+    if (parent === resolved) return ''; // reached drive root with no match
+    resolved = parent;
+  }
+  return '';
+}
+
 const _rateLimits = new Map();
 function checkRateLimit(key, maxPerMinute) {
   const now = Date.now();
@@ -3781,6 +3929,7 @@ const server = http.createServer(async (req, res) => {
       }
 
       let found = false;
+      let blocked = null;
       mutateJsonFileLocked(wiPath, (items) => {
         if (!Array.isArray(items)) items = [];
         const item = items.find(i => i.id === id);
@@ -3790,6 +3939,20 @@ const server = http.createServer(async (req, res) => {
           found = 'already_done';
           return items;
         }
+        // Refuse to re-spawn a project-less worktree-requiring WI when no
+        // single auto-target exists. Without this, retry re-runs the same
+        // broken spawn (drive-root rootDir) the engine already failed on.
+        // The user can fix this by assigning a project via /api/work-items/update
+        // before retrying. (W-mp631ux9000x6df0)
+        if (!resolvedTarget.project
+            && WORKTREE_REQUIRING_TYPES.has(item.type)
+            && PROJECTS.length !== 1) {
+          blocked = {
+            error: 'project required for type=' + item.type + ' when multiple projects are configured; assign a project via /api/work-items/update before retrying',
+            knownProjects: PROJECTS.map(p => p.name),
+          };
+          return items;
+        }
         found = true;
         item.status = WI_STATUS.PENDING;
         item._retryCount = 0; // Reset retry counter on manual retry
@@ -3801,6 +3964,7 @@ const server = http.createServer(async (req, res) => {
         delete item.fanOutAgents;
         return items;
       });
+      if (blocked) return jsonReply(res, 400, blocked);
       if (found === 'already_done') return jsonReply(res, 409, { error: 'item already completed — use force:true to retry' });
       if (!found) return jsonReply(res, 404, { error: 'item not found' });
 
@@ -4038,13 +4202,29 @@ const server = http.createServer(async (req, res) => {
         if (!Array.isArray(body.depends_on)) return jsonReply(res, 400, { error: 'depends_on must be an array of strings' });
         if (!body.depends_on.every(s => typeof s === 'string')) return jsonReply(res, 400, { error: 'depends_on entries must be strings' });
       }
+      // Worktree-requiring types must own a project so the engine's spawnAgent
+      // can resolve a per-project rootDir. With no project (and no single
+      // auto-target via defaultWhenSingle), spawn falls back to MINIONS_DIR's
+      // parent — on Windows that can collapse to a drive root and forever-fail
+      // assertWorktreeOutsideProject. Reject up front rather than letting a
+      // central WI silently land and loop. (W-mp631ux9000x6df0; reproduced by
+      // W-mp629rn3000od581 — Rebecca's spawn looped 12+ times silently.)
+      const normalizedType = routing.normalizeWorkType(body.type, WORK_TYPE.IMPLEMENT);
+      if (WORKTREE_REQUIRING_TYPES.has(normalizedType)
+          && PROJECTS.length !== 1
+          && (!body.project || !String(body.project).trim())) {
+        return jsonReply(res, 400, {
+          error: 'project required for type=' + normalizedType + ' when multiple projects are configured',
+          knownProjects: PROJECTS.map(p => p.name),
+        });
+      }
       const target = resolveWorkItemsCreateTarget(body.project);
       if (target.error) return jsonReply(res, 400, { error: target.error });
       const wiPath = target.wiPath;
       const targetProject = target.project;
       const id = 'W-' + shared.uid();
       const item = {
-        id, title: body.title.trim(), type: routing.normalizeWorkType(body.type, WORK_TYPE.IMPLEMENT),
+        id, title: body.title.trim(), type: normalizedType,
         priority: body.priority || 'medium', description: body.description || '',
         status: WI_STATUS.PENDING, created: new Date().toISOString(), createdBy: 'dashboard',
       };
@@ -5870,31 +6050,59 @@ What would you like to discuss or change? When you're happy, say "approve" and I
 
   async function handleProjectsBrowse(req, res) {
     try {
-      const { execSync, execFileSync } = require('child_process');
+      // Async child_process helpers — the picker dialog can sit on screen
+      // for as long as the user takes to decide. execFileSync would block
+      // Node's event loop for the entire dialog lifetime, freezing every
+      // other request on the dashboard (status, SSE, work-item POSTs, etc.).
+      // util.promisify(execFile) gives us the same exit-status / signal /
+      // stdout / stderr error shape but lets the event loop keep running.
+      const cp = require('child_process');
+      const { promisify } = require('util');
+      const execFileAsync = promisify(cp.execFile);
+      const execAsync = promisify(cp.exec);
+      // Picker mode + optional initial directory.
+      //
+      // The slim UX opts into the modern Explorer-style picker (Microsoft.Win32
+      // .OpenFolderDialog with InitialDirectory support) by sending
+      // `modernPicker: true`. The classic dashboard's Scan Projects flow does
+      // NOT send this flag and gets the unchanged WinForms FolderBrowserDialog
+      // — preserving its pre-slim UX exactly. initialPath is only honored when
+      // modernPicker is true (FolderBrowserDialog has no equivalent property).
+      let modernPicker = false;
+      let initialPath = '';
+      try {
+        const body = await readBody(req);
+        modernPicker = !!(body && body.modernPicker === true);
+        if (modernPicker) initialPath = _resolveBrowseInitialPath(body && body.initialPath);
+      } catch { /* no body — defaults to classic picker, no initial path */ }
       let selectedPath = '';
       if (process.platform === 'win32') {
-        // Launch PowerShell directly (not through cmd.exe) and hide its console so
-        // only the folder picker is visible. Closing the picker should cancel cleanly
-        // instead of surfacing a raw shell "Command failed" error.
-        const psScript = [
-          'Add-Type -AssemblyName System.Windows.Forms',
-          '$f = New-Object System.Windows.Forms.FolderBrowserDialog',
-          '$f.Description = "Select project folder"',
-          '$f.ShowNewFolderButton = $false',
-          '$owner = New-Object System.Windows.Forms.Form',
-          '$owner.TopMost = $true',
-          '$owner.StartPosition = "CenterScreen"',
-          '$owner.WindowState = "Minimized"',
-          '$owner.Show()',
-          '$owner.Hide()',
-          'if ($f.ShowDialog($owner) -eq "OK") { Write-Output $f.SelectedPath }',
-          '$owner.Dispose()',
-        ].join('\r\n');
+        // Primary: Microsoft.Win32.OpenFolderDialog (Explorer-style, native
+        // path bar, InitialDirectory support) — requires .NET 8 / PS 7.4+.
+        // Fallback: Shell.Application.BrowseForFolder with BIF_EDITBOX (0x10)
+        // and BIF_NEWDIALOGSTYLE (0x40) for typeable input on older systems.
+        // The fallback can't honor initialPath (BrowseForFolder's 4th arg
+        // sets the tree root, not the initial selection).
+        //
+        // Topmost-owner trick on the fallback: BrowseForFolder doesn't
+        // auto-front, so we hand it the handle of a hidden topmost WinForms
+        // form so the dialog inherits z-order priority. Same trick the
+        // earlier FolderBrowserDialog version used.
+        const psScript = modernPicker
+          ? _buildBrowseScriptModern(initialPath)
+          : _buildBrowseScriptClassic();
         const psPath = path.join(MINIONS_DIR, 'engine', 'tmp', '_browse.ps1');
         fs.mkdirSync(path.dirname(psPath), { recursive: true });
         fs.writeFileSync(psPath, psScript);
+        // Prefer pwsh.exe (PowerShell 7+) over powershell.exe (Windows
+        // PowerShell 5.1). The OpenFolderDialog primary path requires .NET 8 /
+        // PS 7.4+; running under 5.1 always throws to the BrowseForFolder
+        // fallback, which can't honor InitialDirectory — meaning a typed
+        // initial-path hint would be silently ignored. _pickPwshExe()
+        // probes for pwsh on PATH and caches the result.
+        const psExe = _pickPwshExe();
         try {
-          selectedPath = execFileSync('powershell.exe', [
+          const { stdout } = await execFileAsync(psExe, [
             '-STA',
             '-NoProfile',
             '-ExecutionPolicy', 'Bypass',
@@ -5903,27 +6111,27 @@ What would you like to discuss or change? When you're happy, say "approve" and I
             encoding: 'utf8',
             timeout: 120000,
             windowsHide: true,
-            stdio: ['ignore', 'pipe', 'pipe'],
-          }).trim();
+          });
+          selectedPath = String(stdout || '').trim();
         } catch (e) {
           const stdout = String(e.stdout || '').trim();
           const stderr = String(e.stderr || '').trim();
           const signal = String(e.signal || '').toUpperCase();
-          const status = Number.isInteger(e.status) ? e.status : null;
+          const status = Number.isInteger(e.code) ? e.code : (Number.isInteger(e.status) ? e.status : null);
           const interrupted = signal === 'SIGINT' || signal === 'SIGBREAK' || status === 0xC000013A;
           if (interrupted && !stdout && !stderr) return jsonReply(res, 200, { cancelled: true });
           throw e;
         } finally { try { fs.unlinkSync(psPath); } catch { /* cleanup */ } }
       } else if (process.platform === 'darwin') {
         try {
-          selectedPath = execFileSync('osascript', [
+          const { stdout } = await execFileAsync('osascript', [
             '-e',
             'POSIX path of (choose folder with prompt "Select project folder")',
           ], {
             encoding: 'utf8',
             timeout: 120000,
-            stdio: ['ignore', 'pipe', 'pipe'],
-          }).trim();
+          });
+          selectedPath = String(stdout || '').trim();
         } catch (e) {
           const stderr = String(e.stderr || '').trim();
           const message = String(e.message || '').trim();
@@ -5932,7 +6140,8 @@ What would you like to discuss or change? When you're happy, say "approve" and I
           throw e;
         }
       } else {
-        selectedPath = execSync(`zenity --file-selection --directory --title="Select project folder" 2>/dev/null`, { encoding: 'utf8', timeout: 120000 }).trim();
+        const { stdout } = await execAsync(`zenity --file-selection --directory --title="Select project folder" 2>/dev/null`, { encoding: 'utf8', timeout: 120000 });
+        selectedPath = String(stdout || '').trim();
       }
       if (!selectedPath) return jsonReply(res, 200, { cancelled: true });
       return jsonReply(res, 200, { path: selectedPath.replace(/\\/g, '/') });
@@ -6050,7 +6259,10 @@ What would you like to discuss or change? When you're happy, say "approve" and I
       });
       if (duplicate) return jsonReply(res, 400, { error: 'Project already linked at ' + target });
       reloadConfig(); // Update in-memory project list immediately
-      invalidateStatusCache();
+      // includeSlow: PROJECTS lives in the slow-state cache (60s TTL); without
+      // flushing it, /api/status keeps returning the previous project list for
+      // up to a minute after the add. Matches handleProjectsRemove's behavior.
+      invalidateStatusCache({ includeSlow: true });
 
       return jsonReply(res, 200, { ok: true, name, path: target, detected });
     } catch (e) { return jsonReply(res, 400, { error: e.message }); }
@@ -6188,6 +6400,43 @@ What would you like to discuss or change? When you're happy, say "approve" and I
     return jsonReply(res, 200, { ok: true });
   }
 
+  // Trigger a process-spawn + initialize + session/new (including MCP init)
+  // in the background so the user's first message skips the ~18-21 s Copilot
+  // cold-spawn. Runtime-gated: a no-op (200 skipped) when the pool is off, so
+  // the frontend can fire-and-forget without branching on runtime. Idempotent
+  // against the pool's existing warm-reuse path — calling on a hot tab is free.
+  async function _warmCcPool(tabId, systemPromptHash) {
+    if (!shared.resolveCcUseWorkerPool(CONFIG.engine)) return { skipped: 'pool-disabled' };
+    if (!tabId) throw new Error('tabId required');
+    const result = await ccWorkerPool.warmTab({
+      tabId,
+      model: CONFIG.engine?.ccModel || shared.ENGINE_DEFAULTS.ccModel,
+      effort: CONFIG.engine?.ccEffort || shared.ENGINE_DEFAULTS.ccEffort,
+      mcpServers: (CONFIG.engine && CONFIG.engine.mcpServers) || [],
+      systemPromptHash,
+    });
+    return { warmed: true, lifecycle: result.lifecycle };
+  }
+
+  async function handleCcSessionWarm(req, res) {
+    try {
+      const body = await readBody(req);
+      if (!body || !body.tabId) return jsonReply(res, 400, { error: 'tabId required' });
+      const result = await _warmCcPool(body.tabId, _ccPromptHash);
+      return jsonReply(res, 200, result);
+    } catch (e) { return jsonReply(res, e.statusCode || 500, { error: e.message }); }
+  }
+
+  async function handleDocChatWarm(req, res) {
+    try {
+      const body = await readBody(req);
+      const sessionKey = body && (body.filePath || body.title);
+      if (!sessionKey) return jsonReply(res, 400, { error: 'filePath or title required' });
+      const result = await _warmCcPool(sessionKey, _docChatPromptHash);
+      return jsonReply(res, 200, result);
+    } catch (e) { return jsonReply(res, e.statusCode || 500, { error: e.message }); }
+  }
+
   async function handleCommandCenter(req, res) {
     if (checkRateLimit('command-center', 10)) return jsonReply(res, 429, { error: 'Rate limited — max 10 requests/minute' });
     let tabId;
@@ -6631,7 +6880,18 @@ What would you like to discuss or change? When you're happy, say "approve" and I
         const ccTurnId = 'cct-' + shared.uid();
         const turnSystemPrompt = renderCcSystemPromptForTurn(ccTurnId);
         const turnHeader = _ccTurnHeaderPart(ccTurnId);
-        const prompt = _joinCcPromptParts(preamble, resumeGuard, carryover, turnHeader, body.message);
+        // Slim-UX project context (W-mourbrw100024855): the slim chatbox sends a
+        // `currentProject` hint so CC can default action.project without the
+        // user naming it every turn. Validate against the configured project
+        // list before injecting — body.currentProject is untrusted input.
+        const _knownProjectNames = (PROJECTS || []).map(p => p && p.name).filter(Boolean);
+        const _currentProject = (body.currentProject && _knownProjectNames.includes(body.currentProject))
+          ? body.currentProject
+          : null;
+        const projectContextPart = _currentProject
+          ? `[Project Context] The user is currently working in project "${_currentProject}". Default any action's "project" field to this project unless the user explicitly names a different one.`
+          : '';
+        const prompt = _joinCcPromptParts(preamble, resumeGuard, carryover, turnHeader, projectContextPart, body.message);
 
         const { trackEngineUsage: trackUsage } = require('./engine/llm');
         const streamModel = CONFIG.engine?.ccModel || shared.ENGINE_DEFAULTS.ccModel;
@@ -6662,7 +6922,7 @@ What would you like to discuss or change? When you're happy, say "approve" and I
           console.log(`[CC-stream] Resume failed (code=${result.code}) — retrying fresh`);
           const freshPreamble = buildCCStatePreamble();
           const freshCarryover = _buildTranscriptCarryover(body.transcript, { currentMessage: body.message });
-          const freshPrompt = _joinCcPromptParts(freshPreamble, freshCarryover, turnHeader, body.message);
+          const freshPrompt = _joinCcPromptParts(freshPreamble, freshCarryover, turnHeader, projectContextPart, body.message);
           toolUses = []; // discard stale metadata from the failed resume attempt
           const retryPromise = _invokeCcStream({
             prompt: freshPrompt, sessionId: undefined, liveState, toolUses,
@@ -7446,6 +7706,38 @@ What would you like to discuss or change? When you're happy, say "approve" and I
     } catch (e) { return jsonReply(res, e.statusCode || 500, { error: e.message }); }
   }
 
+  // Slim UX surface for the experimental redesigned dashboard.
+  // The HTML lives in dashboard/slim.html so the human can iterate on the
+  // markup directly — we read the file from disk on each request (no in-
+  // memory cache) so editing it and refreshing the browser shows the change
+  // without a server restart. Gating happens in the request dispatcher: this
+  // helper is only invoked when features.isFeatureOn('slim-ux', CONFIG) is
+  // true at request time, so the flag toggle takes effect with no restart.
+  async function serveSlimUx(req, res) {
+    try {
+      const slimPath = path.join(MINIONS_DIR, 'dashboard', 'slim.html');
+      const html = fs.readFileSync(slimPath, 'utf8')
+        .replace(/\{\{favicon_emoji\}\}/g, FAVICON_EMOJI)
+        .replace(/\{\{title_suffix\}\}/g, TITLE_SUFFIX);
+      res.statusCode = 200;
+      res.setHeader('Content-Type', 'text/html; charset=utf-8');
+      res.setHeader('Cache-Control', 'no-store');
+      // slim.html ships an inline <script> IIFE for the chatbox + settings dialog
+      // and a data: SVG favicon. Override the baseline strict CSP from
+      // buildSecurityHeaders() (which forbids inline scripts) the same way the
+      // full SPA route does — strict CSP still applies to all /api/* responses.
+      res.setHeader(
+        'Content-Security-Policy',
+        "default-src 'self'; " +
+        "script-src 'self' 'unsafe-inline'; " +
+        "style-src 'self' 'unsafe-inline'; " +
+        "img-src 'self' data:; " +
+        "connect-src 'self'"
+      );
+      res.end(html);
+    } catch (e) { return jsonReply(res, e.statusCode || 500, { error: e.message }); }
+  }
+
   async function handleHealth(req, res) {
     // /api/health is on the restart-verification hot path (polled every 250ms
     // for 15s after `minions restart`). The previous implementation called
@@ -7511,6 +7803,95 @@ What would you like to discuss or change? When you're happy, say "approve" and I
     }
   }
 
+  // ── keep_processes (W-mp68q6ke0010de68) ───────────────────────────────────
+  // Surfaces the live `agents/<id>/keep-pids.json` set + per-PID kill control.
+  // The sweep in engine.js already TTL-expires + dead-PID-prunes these files;
+  // these endpoints expose the same view + a manual-kill escape hatch.
+
+  function handleKeepProcessesList(req, res) {
+    try {
+      const keepProcessSweep = require('./engine/keep-process-sweep');
+      const now = Date.now();
+      const items = keepProcessSweep.listAllKeepPidsFiles({ now }).map((rec) => {
+        const ageMinutes = (() => {
+          try { return Math.round((now - fs.statSync(rec.filePath).mtimeMs) / 60000); }
+          catch { return null; }
+        })();
+        if (!rec.valid) {
+          return {
+            agentId: rec.agentId,
+            valid: false,
+            reason: rec.reason,
+            filePath: rec.filePath,
+            age_minutes: ageMinutes,
+          };
+        }
+        return {
+          agentId: rec.agentId,
+          valid: true,
+          wi_id: rec.value.wi_id,
+          purpose: rec.value.purpose,
+          cwd: rec.value.cwd,
+          ports: rec.value.ports,
+          pids: rec.value.pids.map((pid) => ({
+            pid,
+            alive: keepProcessSweep.alivePids([pid]).length > 0,
+          })),
+          expires_at: rec.value.expires_at,
+          expires_in_minutes: Math.max(0, Math.round((rec.value.expiresAtMs - now) / 60000)),
+          written_by: rec.value.written_by,
+          age_minutes: ageMinutes,
+        };
+      });
+      return jsonReply(res, 200, { items, generatedAt: new Date(now).toISOString() }, req);
+    } catch (e) {
+      return jsonReply(res, 500, { error: e.message }, req);
+    }
+  }
+
+  async function handleKeepProcessesKill(req, res) {
+    try {
+      const body = await readBody(req);
+      const agentId = String(body.agentId || '').trim();
+      const pidNum = Number(body.pid);
+      if (!agentId || !/^[a-z0-9_-]+$/i.test(agentId)) {
+        return jsonReply(res, 400, { error: 'valid agentId required' }, req);
+      }
+      if (!Number.isInteger(pidNum) || pidNum <= 0) {
+        return jsonReply(res, 400, { error: 'valid pid required' }, req);
+      }
+      const keepProcessSweep = require('./engine/keep-process-sweep');
+      const filePath = path.join(MINIONS_DIR, 'agents', agentId, keepProcessSweep.KEEP_PIDS_FILENAME);
+      let raw;
+      try { raw = fs.readFileSync(filePath, 'utf8'); }
+      catch { return jsonReply(res, 404, { error: 'keep-pids.json not found for agent' }, req); }
+      let parsed;
+      try { parsed = JSON.parse(raw); }
+      catch (e) { return jsonReply(res, 400, { error: `keep-pids.json malformed: ${e.message}` }, req); }
+      const pidsBefore = Array.isArray(parsed.pids) ? parsed.pids.map(Number) : [];
+      if (!pidsBefore.includes(pidNum)) {
+        return jsonReply(res, 404, { error: `pid ${pidNum} not declared in ${filePath}` }, req);
+      }
+      const killed = shared.killByPidImmediate(pidNum);
+      const remaining = pidsBefore.filter((p) => p !== pidNum);
+      let action;
+      if (remaining.length === 0) {
+        try { fs.unlinkSync(filePath); } catch {}
+        action = 'killed-and-removed-file';
+      } else {
+        parsed.pids = remaining;
+        try { fs.writeFileSync(filePath, JSON.stringify(parsed, null, 2)); } catch (e) {
+          return jsonReply(res, 500, { error: `failed to update keep-pids.json: ${e.message}` }, req);
+        }
+        action = 'killed-and-updated-file';
+      }
+      shared.log('info', `keep-processes manual kill: agent=${agentId} pid=${pidNum} killed=${killed} action=${action}`);
+      return jsonReply(res, 200, { ok: true, killed, action, remaining }, req);
+    } catch (e) {
+      return jsonReply(res, 500, { error: e.message }, req);
+    }
+  }
+
   // ── Route Registry ──────────────────────────────────────────────────────────
   // Order matters: specific routes before general ones (e.g., /api/plans/approve before /api/plans/:file)
 
@@ -7566,6 +7947,8 @@ What would you like to discuss or change? When you're happy, say "approve" and I
       _trackSseClient(_statusStreamClients, req, res);
     }},
     { method: 'GET', path: '/api/health', desc: 'Lightweight health check for monitoring', handler: handleHealth },
+    { method: 'GET', path: '/api/keep-processes', desc: 'List all active agents/<id>/keep-pids.json entries (W-mp68q6ke0010de68)', handler: handleKeepProcessesList },
+    { method: 'POST', path: '/api/keep-processes/kill', desc: 'Kill a single kept PID and remove it from the agent\'s keep-pids.json', params: 'agentId, pid', handler: handleKeepProcessesKill },
     { method: 'GET', path: '/api/hot-reload', desc: 'SSE stream for dashboard hot-reload notifications', handler: (req, res) => {
       res.writeHead(200, { 'Content-Type': 'text/event-stream', 'Cache-Control': 'no-cache', 'Connection': 'keep-alive' });
       res.write('data: connected\n\n');
@@ -7729,7 +8112,11 @@ What would you like to discuss or change? When you're happy, say "approve" and I
           const ghMatch = url.match(/github\.com\/([^/]+\/[^/]+)\/pull\/(\d+)/);
           if (ghMatch) {
             const slug = ghMatch[1];
-            const result = await shared.execAsync(`gh api "repos/${slug}/pulls/${prNum}"`, { timeout: 15000, encoding: 'utf-8' });
+            // P-a7c4d2e8 (F1): argv-form gh + slug validation. `slug` is built from
+            // a regex match against untrusted PR-link input (the body of POST
+            // /api/pull-requests/link); validate before exec. `prNum` is already
+            // a number; coerce to string for argv.
+            const result = await shared.shellSafeGh(['api', `repos/${shared.validateGhSlug(slug)}/pulls/${String(prNum)}`], { timeout: 15000 });
             const d = JSON.parse(result);
             prData = { title: d.title, description: d.body, branch: d.head?.ref, author: d.user?.login };
           } else if (adoTarget && !initialPrData) {
@@ -7745,9 +8132,17 @@ What would you like to discuss or change? When you're happy, say "approve" and I
             if (prData.title) pr.title = prData.title.slice(0, 120);
             if (prData.description) pr.description = prData.description.slice(0, 500);
             if (!pr.branch && prData.branch) {
-              pr.branch = prData.branch;
-              if (pr._branchResolutionError) delete pr._branchResolutionError;
-              if (pr._pendingReason === shared.PR_PENDING_REASON.MISSING_BRANCH) delete pr._pendingReason;
+              // P-a7c4d2e8 (F3): validate API-derived branch before persistence
+              // so it can never flow into a later git command unchecked. On
+              // invalid ref, log and skip (defensive degrade — don't crash
+              // the enrichment IIFE).
+              try {
+                pr.branch = shared.validateGitRef(prData.branch);
+                if (pr._branchResolutionError) delete pr._branchResolutionError;
+                if (pr._pendingReason === shared.PR_PENDING_REASON.MISSING_BRANCH) delete pr._pendingReason;
+              } catch (e) {
+                shared.log('warn', `PR link enrichment: invalid head.ref for ${prId}, skipping branch persistence: ${e.message}`);
+              }
             }
             if (pr.agent === 'human' && prData.author) pr.agent = prData.author;
             return prs;
@@ -7901,6 +8296,7 @@ What would you like to discuss or change? When you're happy, say "approve" and I
     // Doc chat
     { method: 'POST', path: '/api/doc-chat', desc: 'Minions-aware doc Q&A + editing via CC session', params: 'message, document, title?, filePath?, selection?, contentHash?, transcript?', handler: handleDocChat },
     { method: 'POST', path: '/api/doc-chat/stream', desc: 'Streaming doc chat — SSE with text chunks and tool progress', params: 'message, document, title?, filePath?, selection?, contentHash?, transcript?', handler: handleDocChatStream },
+    { method: 'POST', path: '/api/doc-chat/warm', desc: 'Pre-warm the worker pool for a doc-chat session (process + MCP init, no LLM call). No-op when pool is off.', params: 'filePath? | title?', handler: handleDocChatWarm },
 
     // Inbox
     { method: 'POST', path: '/api/inbox/persist', desc: 'Promote an inbox item to team notes', params: 'name', handler: handleInboxPersist },
@@ -7927,6 +8323,7 @@ What would you like to discuss or change? When you're happy, say "approve" and I
     { method: 'POST', path: '/api/command-center', desc: 'Conversational command center with full minions context', params: 'message, tabId?, sessionId?, transcript?', handler: handleCommandCenter },
     { method: 'POST', path: '/api/command-center/stream', desc: 'Streaming CC — SSE with text chunks as they arrive', params: 'message, tabId?, sessionId?, transcript?', handler: handleCommandCenterStream },
     { method: 'GET', path: '/api/cc-sessions', desc: 'List CC session metadata for all tabs', handler: handleCCSessionsList },
+    { method: 'POST', path: '/api/cc-sessions/warm', desc: 'Pre-warm the worker pool for a CC tab (process + MCP init, no LLM call). No-op when pool is off.', params: 'tabId', handler: handleCcSessionWarm },
     { method: 'DELETE', path: /^\/api\/cc-sessions\/([\w-]+)$/, template: '/api/cc-sessions/:id', desc: 'Delete a CC session by tab ID', handler: handleCCSessionDelete },
 
     // Schedules
@@ -8254,6 +8651,14 @@ What would you like to discuss or change? When you're happy, say "approve" and I
     }
   }
 
+  // Slim UX takeover — when the 'slim-ux' feature flag is on, the root
+  // dashboard route serves dashboard/slim.html instead of the full SPA.
+  // Checked at request time so /api/features/toggle flips behavior with
+  // no restart; flag-off means zero behavior change for the catch-all.
+  if (pathname === '/' && features.isFeatureOn('slim-ux', CONFIG)) {
+    return serveSlimUx(req, res);
+  }
+
   // Serve dashboard HTML with gzip + caching
   res.setHeader('Content-Type', 'text/html; charset=utf-8');
   res.setHeader('ETag', HTML_ETAG);
@@ -8322,6 +8727,11 @@ module.exports = {
   _readWorkspaceMcpServers,
   _dedupeMcpServers,
   readBody,
+  _resolveBrowseInitialPath,
+  _pickPwshExe,
+  _resetPwshExeCache,
+  _buildBrowseScriptModern,
+  _buildBrowseScriptClassic,
   _filterCcTabSessions,
   _getVersionCheckInterval,
   _normalizeMeetingParticipants: normalizeMeetingParticipants,