@yemi33/minions 0.1.2053 → 0.1.2055

package/dashboard/js/command-center.js

@@ -1064,7 +1064,18 @@ async function _ccDoSend(message, skipUserMsg, forceTabId, intentMetadata) {
       activeTab._429retries = 0;
       var errText = await res.text();
       if (isReconnect && res.status === 409) return { interrupted: true, reconnectable: false, reason: errText || 'No live stream' };
-      throw new Error(errText || 'CC error');
+      // W-mpmwxni2000c25c7-d — try to parse the canonical error envelope from
+      // the non-2xx body. Backend wraps every pre-stream error in
+      // _buildCcErrorEnvelope, so when the JSON parses we surface
+      // envelope.message / envelope.code; otherwise fall back to raw text.
+      var ccEnvelope = null;
+      try {
+        var parsed = JSON.parse(errText);
+        if (parsed && parsed.type === 'error' && typeof parsed.message === 'string') ccEnvelope = parsed;
+      } catch (_e) { /* not JSON — keep raw text */ }
+      var thrown = new Error((ccEnvelope && ccEnvelope.message) || errText || 'CC error');
+      if (ccEnvelope) thrown._ccErrorEnvelope = ccEnvelope;
+      throw thrown;
     }
 
     activeTab._429retries = 0;
@@ -1075,6 +1086,11 @@ async function _ccDoSend(message, skipUserMsg, forceTabId, intentMetadata) {
     var decoder = new TextDecoder();
     var buf = '';
     var terminalEventSeen = false;
+    // W-mpmwxni2000c25c7-d — SSE spec: `event:` lines name the event type for
+    // the data lines that follow, reset on a blank line. Tracked so backend
+    // `event: error` frames are recognized even by clients that don't read
+    // `data.type` (and so the integration test can assert wire format).
+    var pendingEventName = '';
 
     async function _handleEvent(evt) {
       if (evt.type === 'chunk') {
@@ -1148,7 +1164,23 @@ async function _ccDoSend(message, skipUserMsg, forceTabId, intentMetadata) {
       } else if (evt.type === 'error') {
         terminalEventSeen = true;
         _cleanupStreamDiv();
-        addMsg('assistant', '<span style="color:var(--red)">' + escHtml(evt.error) + '</span>');
+        // W-mpmwxni2000c25c7-d — render the typed error envelope as an
+        // accessible red bubble (role=alert) with a Retry button. We honor
+        // `evt.message` (canonical envelope) and fall back to `evt.error` for
+        // any pre-envelope frames still in flight from older backends.
+        var ccErrMsg = (typeof evt.message === 'string' && evt.message) ? evt.message
+                      : (typeof evt.error === 'string' && evt.error) ? evt.error
+                      : 'Command Center reported an unknown error.';
+        var ccErrCode = typeof evt.code === 'string' ? evt.code : '';
+        var ccRetry = _ccStoreRetryRequest(activeTab, activeTabId, message);
+        var codeChip = ccErrCode
+          ? '<span style="display:inline-block;margin-left:6px;padding:1px 6px;font-size:9px;color:var(--muted);background:var(--surface2);border:1px solid var(--border);border-radius:3px;font-family:monospace">' + escHtml(ccErrCode) + '</span>'
+          : '';
+        var availList = Array.isArray(evt.availableModels) && evt.availableModels.length
+          ? '<div style="font-size:10px;color:var(--muted);margin-top:6px">Available models: ' + escHtml(evt.availableModels.slice(0, 8).join(', ')) + (evt.availableModels.length > 8 ? '…' : '') + '</div>'
+          : '';
+        var errorBubble = '<div class="cc-error" role="alert" aria-live="assertive" style="padding:8px 12px;background:rgba(220,80,80,0.08);border-left:3px solid var(--red);border-radius:4px;color:var(--red);font-size:12px"><strong>Error</strong>' + codeChip + '<div style="margin-top:4px;color:var(--text)">' + escHtml(ccErrMsg) + '</div>' + availList + '</div>';
+        addMsg('assistant', errorBubble + _ccRetryControls(ccRetry, '', false), false, { retryId: ccRetry.id });
       }
     }
 
@@ -1160,6 +1192,13 @@ async function _ccDoSend(message, skipUserMsg, forceTabId, intentMetadata) {
       buf = lines.pop();
       for (var li = 0; li < lines.length; li++) {
         var line = lines[li];
+        // W-mpmwxni2000c25c7-d — track SSE `event:` lines per spec. The
+        // event-name applies to the next data line and resets on a blank
+        // line. The backend emits `event: error\ndata: {...}` for errors;
+        // listeners that prefer event-typed dispatch see them as named
+        // events rather than having to sniff `data.type`.
+        if (line === '') { pendingEventName = ''; continue; }
+        if (line.startsWith('event: ')) { pendingEventName = line.slice(7).trim(); continue; }
         if (!line.startsWith('data: ')) continue;
         // W-mpdavudb000v8446 — these used to swallow ALL errors via `catch {}`,
         // hiding JSON.parse failures AND any DOM/render exception thrown by
@@ -1178,6 +1217,9 @@ async function _ccDoSend(message, skipUserMsg, forceTabId, intentMetadata) {
           try { console.error('[cc-sse] parse-failed', { tab: activeTabId, len: rawJson.length, error: String(parseErr && parseErr.message || parseErr) }); } catch (_e) {}
           continue;
         }
+        // If the server named the event but the payload didn't carry a `type`,
+        // backfill from the event line so `_handleEvent` dispatch still works.
+        if (pendingEventName && evt && typeof evt === 'object' && !evt.type) evt.type = pendingEventName;
         try { await _handleEvent(evt); }
         catch (handleErr) {
           try { console.error('[cc-sse] handle-failed', { tab: activeTabId, type: evt && evt.type, error: String(handleErr && handleErr.message || handleErr), stack: handleErr && handleErr.stack }); } catch (_e) {}
@@ -1188,6 +1230,8 @@ async function _ccDoSend(message, skipUserMsg, forceTabId, intentMetadata) {
       var remainingLines = buf.split('\n');
       for (var ri = 0; ri < remainingLines.length; ri++) {
         var rline = remainingLines[ri];
+        if (rline === '') { pendingEventName = ''; continue; }
+        if (rline.startsWith('event: ')) { pendingEventName = rline.slice(7).trim(); continue; }
         if (!rline.startsWith('data: ')) continue;
         var trailRaw = rline.slice(6);
         var trailEvt;
@@ -1196,6 +1240,7 @@ async function _ccDoSend(message, skipUserMsg, forceTabId, intentMetadata) {
           try { console.error('[cc-sse] parse-failed-trailing', { tab: activeTabId, len: trailRaw.length, error: String(parseErr && parseErr.message || parseErr) }); } catch (_e) {}
           continue;
         }
+        if (pendingEventName && trailEvt && typeof trailEvt === 'object' && !trailEvt.type) trailEvt.type = pendingEventName;
         try { await _handleEvent(trailEvt); }
         catch (handleErr) {
           try { console.error('[cc-sse] handle-failed-trailing', { tab: activeTabId, type: trailEvt && trailEvt.type, error: String(handleErr && handleErr.message || handleErr), stack: handleErr && handleErr.stack }); } catch (_e) {}
@@ -1265,8 +1310,26 @@ async function _ccDoSend(message, skipUserMsg, forceTabId, intentMetadata) {
             : '<div style="font-size:10px;color:var(--muted);margin-top:4px">Dashboard connection lost. Restart Minions to reconnect.</div>';
       }
       var errorRetry = _ccStoreRetryRequest(activeTab, activeTabId, message);
+      // W-mpmwxni2000c25c7-d — if the thrower attached a parsed CC error
+      // envelope (non-2xx body with `{type:'error', message, code}` shape),
+      // render the styled bubble + code chip + available-models hint to
+      // match the SSE error path. Bare network errors keep the legacy red
+      // "Error: <msg>" span so connection-loss UX is unchanged.
+      var ccEnv = e && e._ccErrorEnvelope;
+      var errorRendered;
+      if (ccEnv) {
+        var ccCodeChip = ccEnv.code
+          ? '<span style="display:inline-block;margin-left:6px;padding:1px 6px;font-size:9px;color:var(--muted);background:var(--surface2);border:1px solid var(--border);border-radius:3px;font-family:monospace">' + escHtml(ccEnv.code) + '</span>'
+          : '';
+        var ccAvail = Array.isArray(ccEnv.availableModels) && ccEnv.availableModels.length
+          ? '<div style="font-size:10px;color:var(--muted);margin-top:6px">Available models: ' + escHtml(ccEnv.availableModels.slice(0, 8).join(', ')) + (ccEnv.availableModels.length > 8 ? '…' : '') + '</div>'
+          : '';
+        errorRendered = '<div class="cc-error" role="alert" aria-live="assertive" style="padding:8px 12px;background:rgba(220,80,80,0.08);border-left:3px solid var(--red);border-radius:4px;color:var(--red);font-size:12px"><strong>Error</strong>' + ccCodeChip + '<div style="margin-top:4px;color:var(--text)">' + escHtml(ccEnv.message) + '</div>' + ccAvail + '</div>';
+      } else {
+        errorRendered = '<span style="color:var(--red)">Error: ' + escHtml(e.message) + '</span>';
+      }
       addMsg('assistant', (streamedText ? renderMd(streamedText) + _ccElapsedFooter('Stream interrupted after {seconds}s') : '') +
-        '<span style="color:var(--red)">Error: ' + escHtml(e.message) + '</span>' +
+        errorRendered +
         _ccRetryControls(errorRetry, connectionHint, isNetworkError && (!dashboardHealth.reachable || dashboardHealth.restarted)), false, { retryId: errorRetry.id });
     }
   } finally {

package/dashboard/js/settings.js

@@ -130,6 +130,11 @@ async function openSettings() {
             '<div style="font-size:9px;color:var(--muted);margin-top:1px">CC reasoning depth</div>' +
           '</div>' +
         '</div>' +
+        // W-mpmwxni2000c25c7-d — per-turn watchdog. Surfaced under CC overrides
+        // because it gates CC/doc-chat error visibility (not the agent fleet).
+        '<div style="display:grid;grid-template-columns:1fr;gap:8px;margin-top:8px">' +
+          settingsField('CC Turn Timeout', 'set-ccTurnTimeoutMs', e.ccTurnTimeoutMs || 300000, 'ms', 'Per-turn watchdog for CC + doc-chat. If no terminal SSE event arrives within this window the handler emits event: error with code: cc-turn-timeout, the spinner stops, and a Retry button is shown. Clamped to 10000–3600000 ms.') +
+        '</div>' +
       '</details>' +
     '</div>' +
     '<h4>Agents</h4>' +
@@ -833,6 +838,7 @@ async function saveSettings() {
       ccCli: (document.getElementById('set-ccCli')?.value ?? '').trim(),
       ccModel: (document.getElementById('set-ccModel')?.value ?? '').trim(),
       ccEffort: document.getElementById('set-ccEffort').value || null,
+      ccTurnTimeoutMs: document.getElementById('set-ccTurnTimeoutMs')?.value,
       claudeBareMode: !!document.getElementById('set-claudeBareMode')?.checked,
       claudeFallbackModel: (document.getElementById('set-claudeFallbackModel')?.value ?? '').trim(),
       copilotFallbackModel: (document.getElementById('set-copilotFallbackModel')?.value ?? '').trim(),

package/dashboard/styles.css

@@ -715,8 +715,13 @@
      vertical nav + per-tab pane. Search input filters control rows across all tabs
      by data-search attribute. .modal.modal-wide is added by openSettings() so the
      rail + content fit comfortably side-by-side. */
-  .modal-body.settings-body { padding: 0; white-space: normal; font-size: var(--text-md); line-height: 1.45; color: var(--text); font-family: 'Segoe UI', system-ui, sans-serif; }
-  .settings-layout { display: flex; min-height: 480px; max-height: calc(80vh - 64px); }
+  /* Lock the settings body so the dialog dimensions stay constant across tabs.
+     `overflow: hidden` on the body suppresses the inherited `.modal-body`
+     scroll-y; only `.settings-content` should ever show a scrollbar. The
+     layout is pinned to a single fixed height (was min/max range) so empty
+     tabs don't shrink the dialog and full tabs don't stretch it. */
+  .modal-body.settings-body { padding: 0; white-space: normal; font-size: var(--text-md); line-height: 1.45; color: var(--text); font-family: 'Segoe UI', system-ui, sans-serif; overflow: hidden; }
+  .settings-layout { display: flex; height: calc(80vh - 64px); }
   .settings-rail { width: 220px; min-width: 220px; background: var(--surface2); border-right: 1px solid var(--border); display: flex; flex-direction: column; overflow: hidden; }
   .settings-search-wrap { padding: var(--space-5) var(--space-5) var(--space-4); border-bottom: 1px solid var(--border); }
   .settings-search { width: 100%; padding: var(--space-3) var(--space-4); background: var(--surface); border: 1px solid var(--border); border-radius: var(--radius-sm); color: var(--text); font-size: var(--text-md); font-family: inherit; }
@@ -959,3 +964,14 @@
     max-height: 160px; overflow: auto; white-space: pre;
   }
   .qa-artifact-log { max-width: 480px; }
+
+  /* W-mpmwxni2000c25c7-d - Command Center / doc-chat typed error bubble. */
+  /* Token-only styling so dark/light themes stay consistent; the inline */
+  /* styles emitted by command-center.js use the same vars and are kept */
+  /* for backward compat with existing render paths. */
+  .cc-error { padding: 8px 12px; background: rgba(248, 81, 73, 0.08);
+    border-left: 3px solid var(--red); border-radius: var(--radius-sm);
+    color: var(--red); font-size: var(--text-sm); }
+  .cc-error strong { color: var(--red); }
+  .cc-error code { font-family: monospace; font-size: var(--text-xs);
+    color: var(--muted); }

package/dashboard.js

@@ -2400,6 +2400,37 @@ const DOC_CHAT_TIMEOUT_MS = 60 * 60 * 1000;
 // reconnect-replay protocol (dashboard.js:7048-7083).
 const SSE_MAX_QUEUE_BYTES = 4 * 1024 * 1024;   // 4 MB per-tab — conservative, tunable
 const SSE_STUCK_KILL_MS = 30 * 1000;           // 30s of continuous backpressure → res.destroy()
+
+// W-mpmwxni2000c25c7-d — CC + doc-chat error envelope contract.
+// Canonical shape: `{ type: 'error', message, code, retryable, ...extra }`.
+// `code` is one of: 'model-unavailable', 'auth-failure', 'context-limit',
+// 'budget-exceeded', 'crash', 'cc-turn-timeout', 'worker-spawn-failed',
+// 'acp-handshake-failed', 'worker-died'. `retryable` tells the client whether
+// the same input has a chance of succeeding without operator intervention
+// (e.g. transient overload retries; auth/budget/timeout don't). Extra fields
+// (`availableModels`, `runtime`) are envelope-shape-stable so the client can
+// surface them without sniffing types.
+const CC_ERROR_CODES = Object.freeze([
+  'model-unavailable',
+  'auth-failure',
+  'context-limit',
+  'budget-exceeded',
+  'crash',
+  'cc-turn-timeout',
+  'worker-spawn-failed',
+  'acp-handshake-failed',
+  'worker-died',
+]);
+function _buildCcErrorEnvelope({ message, code, retryable, ...extra } = {}) {
+  const normalizedCode = CC_ERROR_CODES.includes(code) ? code : 'crash';
+  return {
+    type: 'error',
+    message: String(message == null ? '' : message) || 'Unknown error',
+    code: normalizedCode,
+    retryable: !!retryable,
+    ...extra,
+  };
+}
 function _releaseCCTab(tabId) { ccInFlightTabs.delete(tabId); ccInFlightAborts.delete(tabId); }
 function _getCcLiveStream(tabId) {
   return ccLiveStreams.get(tabId) || null;
@@ -6981,7 +7012,12 @@ What would you like to discuss or change? When you're happy, say "approve" and I
       // heartbeat force-close pattern from the writeCcEvent closure
       // (dashboard.js, search for SSE_MAX_QUEUE_BYTES).
       try {
-        res.write('data: ' + JSON.stringify(payload) + '\n\n');
+        const type = payload && payload.type;
+        // W-mpmwxni2000c25c7-d — mirror the writeCcEvent change so doc-chat
+        // also emits `event: error` for terminal errors. Same back-compat:
+        // the JSON still carries `type: 'error'` for data-line parsers.
+        const eventLine = (type === 'error') ? 'event: error\n' : '';
+        res.write(eventLine + 'data: ' + JSON.stringify(payload) + '\n\n');
         return true;
       } catch {
         return false;
@@ -7117,9 +7153,11 @@ What would you like to discuss or change? When you're happy, say "approve" and I
       if (!res.headersSent) {
         res.statusCode = e.statusCode || 500;
         res.setHeader('Content-Type', 'application/json');
-        try { res.end(JSON.stringify({ error: e.message })); } catch {}
+        // W-mpmwxni2000c25c7-d — non-SSE error path mirrors the envelope shape
+        // so the frontend's non-2xx branch can render the same red bubble.
+        try { res.end(JSON.stringify(_buildCcErrorEnvelope({ message: e.message, code: e.code || 'crash', retryable: false }))); } catch {}
       } else {
-        writeDocEvent({ type: 'error', error: e.message });
+        writeDocEvent(_buildCcErrorEnvelope({ message: e.message, code: e.code || 'crash', retryable: false }));
         _docStreamEnded = true;
         try { res.end(); } catch {}
       }
@@ -8031,7 +8069,16 @@ What would you like to discuss or change? When you're happy, say "approve" and I
         return false;
       }
       let wire;
-      try { wire = 'data: ' + JSON.stringify(payload) + '\n\n'; }
+      try {
+        // W-mpmwxni2000c25c7-d — terminal error frames go out as `event: error`
+        // so SSE consumers using addEventListener('error', …) and tests
+        // matching the raw wire format can target them directly. The JSON
+        // payload still carries `type: 'error'` so the existing
+        // data-line parser (and any client code that only reads `data:`
+        // lines) keeps working.
+        const eventLine = (type === 'error') ? 'event: error\n' : '';
+        wire = eventLine + 'data: ' + JSON.stringify(payload) + '\n\n';
+      }
       catch (err) {
         _logFail('json-serialize-failed', { error: String((err && err.message) || err).slice(0, 200) });
         return false;
@@ -8312,13 +8359,48 @@ What would you like to discuss or change? When you're happy, say "approve" and I
         const streamModel = CONFIG.engine?.ccModel || shared.ENGINE_DEFAULTS.ccModel;
         const streamEffort = CONFIG.engine?.ccEffort || shared.ENGINE_DEFAULTS.ccEffort;
         const ccMaxTurns = CONFIG.engine?.ccMaxTurns || shared.ENGINE_DEFAULTS.ccMaxTurns;
+
+        // W-mpmwxni2000c25c7-d — preflight model check inside the streaming
+        // path. ccCall() runs this guard for the non-stream surface; the SSE
+        // handler historically skipped it because the legacy "errorClass:
+        // unknown-model" envelope wasn't surfaced through writeCcEvent. Now
+        // that we have a typed error envelope, fail fast with
+        // `code: 'model-unavailable'` and the runtime-discovered catalog in
+        // `availableModels` / `message` — saves the user one round-trip into
+        // the CLI process that we already know cannot run the requested model.
+        const preflightFailure = await _preflightModelCheck({
+          model: streamModel, engineConfig: CONFIG.engine,
+        });
+        if (preflightFailure) {
+          const known = (preflightFailure.errorMessage || '').match(/known:\s*([^)]+)/);
+          const availableModels = known ? known[1].replace(/[…\u2026]\s*$/, '').split(',').map(s => s.trim()).filter(Boolean) : [];
+          const envelope = _buildCcErrorEnvelope({
+            message: preflightFailure.errorMessage,
+            code: 'model-unavailable',
+            retryable: false,
+            runtime: preflightFailure.runtime || null,
+            availableModels,
+          });
+          writeCcEvent(envelope);
+          liveState.donePayload = envelope;
+          _ccStreamEnded = true;
+          if (liveState.endResponse) liveState.endResponse();
+          _scheduleCcLiveCleanup(tabId);
+          _logCcStreamEnd(_ccTelemetry, 'error-preflight-model-unavailable', { runtime: preflightFailure.runtime });
+          return;
+        }
+
         let toolUses = [];
-        // W-mpmwxni2000c25c7-b — turn-level watchdog. Wraps the initial
+        // W-mpmwxni2000c25c7-b/-d — turn-level watchdog. Wraps the initial
         // _invokeCcStream PLUS the post-resume-fail retry so the wall clock
         // covers the entire CC turn (not just one underlying LLM call). On
         // expiry, whichever call is in flight is aborted; the watchdog
         // resolves with a synthetic `{ error: { code: 'cc-turn-timeout' } }`
-        // envelope so the SSE error path below kicks in.
+        // envelope so the SSE error path below kicks in. The frontend
+        // (dashboard/js/command-center.js) recognizes `cc-turn-timeout` as a
+        // retryable typed error and offers a Retry affordance instead of
+        // hanging the spinner. The per-turn cap is configurable via
+        // `engine.ccTurnTimeoutMs` (Settings UI; clamped 10s..1h).
         const turnTimeoutMs = _resolveCcTurnTimeoutMs();
         const result = await withTimeout({
           timeoutMs: turnTimeoutMs, label: 'command-center-stream',
@@ -8465,10 +8547,13 @@ What would you like to discuss or change? When you're happy, say "approve" and I
       if (!res.headersSent) {
         res.statusCode = e.statusCode || 500;
         res.setHeader('Content-Type', 'application/json');
-        try { res.end(JSON.stringify({ error: e.message })); } catch {}
+        // W-mpmwxni2000c25c7-d — non-2xx response carries the same envelope
+        // so the frontend's `if (!res.ok)` branch can render the red error
+        // bubble with the same code/message/retryable surface.
+        try { res.end(JSON.stringify(_buildCcErrorEnvelope({ message: e.message, code: e.code || 'crash', retryable: false }))); } catch {}
         _logCcStreamEnd(_ccTelemetry, 'error-pre-stream', { error: (e && e.message ? e.message.slice(0, CC_LOG_ERROR_MAX_LEN) : 'unknown') });
       } else {
-        writeCcEvent({ type: 'error', error: e.message });
+        writeCcEvent(_buildCcErrorEnvelope({ message: e.message, code: e.code || 'crash', retryable: false }));
         _ccStreamEnded = true; try { res.end(); } catch {}
         _logCcStreamEnd(_ccTelemetry, 'error-mid-stream', { error: (e && e.message ? e.message.slice(0, CC_LOG_ERROR_MAX_LEN) : 'unknown') });
       }
@@ -8858,6 +8943,11 @@ What would you like to discuss or change? When you're happy, say "approve" and I
           prPollStatusEvery: [1], prPollCommentsEvery: [1],
           agentBusyReassignMs: [0],
           maxRetriesPerAgent: [1, 20],
+          // W-mpmwxni2000c25c7-d — per-turn CC/doc-chat watchdog. Min 10s
+          // (anything shorter would fire on legitimate first-token latency for
+          // larger models); max 1h (matches CC_CALL_TIMEOUT_MS so the watchdog
+          // never outlives the outer abort).
+          ccTurnTimeoutMs: [10000, 3600000],
         };
         for (const [key, [min, max]] of Object.entries(numericFields)) {
           if (e[key] !== undefined) {

package/engine/lifecycle.js

@@ -2067,6 +2067,90 @@ function updatePrAfterFix(pr, project, source, options = {}, legacyDispatchId =
       delete next.fixedAt;
       target.minionsReview = next;
     };
+    // W-mpoeirqx0007712a — Build-fix push verification. The agent may report
+    // SUCCESS while the git push silently failed to advance the remote head
+    // (stale-worktree push rejected non-fast-forward, agent ignores non-zero
+    // `git push` exit, etc). detectPrFixBranchChange falls back to
+    // local-head / worktree-diff evidence in those scenarios and returns
+    // `changed: true` even though origin/<branch> never moved. Without a
+    // guard here, the optimistic stamp + 10-min buildFixGracePeriod
+    // suppresses re-dispatch against a still-failing build that was never
+    // actually fixed (live repro: opg-microsoft/minions PR #57).
+    //
+    // Only `evidence: 'remote-head'` proves the push landed. For
+    // BUILD_FAILURE with changed=true AND evidence explicitly set to one of
+    // the unverified types, increment `_buildFixPushFailedCount`, write an
+    // inbox alert, route through recordPrNoOpFixAttempt so the cause stays
+    // unhandled, and never write `_buildFixPushedAt`. When the counter
+    // reaches `engine.maxBuildFixRetries`, flip `_buildFixNeedsHumanRebase`
+    // so the engine stops retrying.
+    //
+    // Note: callers that omit `branchChange.evidence` (legacy / tests
+    // predating evidence plumbing) still hit the trusted-push path below to
+    // preserve backward compatibility — only the explicitly unverified
+    // evidence kinds trigger this guard.
+    const _unverifiedPushEvidence = new Set(['local-head', 'worktree-diff']);
+    if (cause === shared.PR_FIX_CAUSE.BUILD_FAILURE
+        && explicitlyChangedBranch
+        && options.branchChange?.changed === true
+        && _unverifiedPushEvidence.has(options.branchChange?.evidence)) {
+      const maxRetries = options.config?.engine?.maxBuildFixRetries
+        ?? ENGINE_DEFAULTS.maxBuildFixRetries;
+      target._buildFixPushFailedCount = (Number(target._buildFixPushFailedCount) || 0) + 1;
+      const reachedCap = target._buildFixPushFailedCount >= maxRetries;
+      if (reachedCap) {
+        target._buildFixNeedsHumanRebase = ts();
+      }
+      const beforeHeadStr = String(options.branchChange?.beforeHead || '').slice(0, 40);
+      const afterHeadStr = String(options.branchChange?.afterHead || '').slice(0, 40);
+      const evidenceStr = String(options.branchChange?.evidence || 'unknown');
+      try {
+        const wiId = options.dispatchItem?.meta?.item?.id || null;
+        const noteBody = `# Build-fix push not verified for ${pr.id}\n\n`
+          + `**PR:** ${pr.url || pr.id}\n`
+          + `**Branch:** ${pr.branch || '(unknown)'}\n`
+          + `**Cause:** build-failure\n`
+          + `**Pre-dispatch head:** ${beforeHeadStr || '(unknown)'}\n`
+          + `**Post-completion head (live):** ${afterHeadStr || '(unknown)'}\n`
+          + `**Branch-change evidence:** ${evidenceStr}\n`
+          + `**Attempt:** ${target._buildFixPushFailedCount}/${maxRetries}\n\n`
+          + (reachedCap
+              ? `⚠️ **Reached \`engine.maxBuildFixRetries\` (${maxRetries}).** PR flagged \`_buildFixNeedsHumanRebase\` — engine will stop auto-retrying. Likely root cause: worktree stale vs origin/master, push rejected non-fast-forward, or branch protection blocks the engine identity.\n`
+              : `_Engine will re-dispatch on the next \`discoverFromPrs\` pass (counter < cap)._\n`)
+          + `\nThe agent reported SUCCESS but the remote head did not advance — the optimistic \`_buildFixPushedAt\` stamp was suppressed to avoid the ${(ENGINE_DEFAULTS.buildFixGracePeriod / 60000) | 0}-minute grace-period blackout.\n`;
+        shared.writeToInbox(
+          'engine',
+          `build-fix-push-unverified-${pr.prNumber || pr.id}`,
+          noteBody,
+          null,
+          { wi: wiId, pr: pr.id, cause: shared.PR_FIX_CAUSE.BUILD_FAILURE }
+        );
+      } catch (err) {
+        log('warn', `build-fix push-verify inbox alert for ${pr.id}: ${err.message}`);
+      }
+      // Route through the noop path so the cause stays unhandled, the noop
+      // counter advances symmetrically with the genuine-noop case, and the
+      // existing `delete target._buildFixPushedAt` cleanup (line ~2016) runs.
+      const verifyBranchChange = {
+        changed: false,
+        beforeHead: options.branchChange?.beforeHead,
+        afterHead: options.branchChange?.afterHead,
+        evidence: 'push-unverified',
+      };
+      const noopReason = `build-fix push unverified (evidence: ${evidenceStr}); attempt ${target._buildFixPushFailedCount}/${maxRetries}${reachedCap ? ' — needs-human-rebase' : ''}`;
+      const record = recordPrNoOpFixAttempt(target, cause, source, options.dispatchItem, verifyBranchChange, options.config, noopReason);
+      result = {
+        noOp: true,
+        cause,
+        paused: !!record.paused,
+        count: record.count,
+        pushUnverified: true,
+        pushFailedCount: target._buildFixPushFailedCount,
+        needsHumanRebase: reachedCap,
+      };
+      log('warn', `Updated ${pr.id} → build-fix push unverified (${target._buildFixPushFailedCount}/${maxRetries}, evidence=${evidenceStr})${reachedCap ? ' [needs-human-rebase]' : ''}; remote head ${beforeHeadStr.slice(0, 8)} did not advance — inbox alert written, cause left unhandled for re-dispatch`);
+      return prs;
+    }
     if (explicitlyChangedBranch && options.branchChange?.changed === false) {
       const record = recordPrNoOpFixAttempt(target, cause, source, options.dispatchItem, options.branchChange, options.config, options.noopReason);
       result = { noOp: true, cause, paused: !!record.paused, count: record.count };
@@ -2086,6 +2170,19 @@ function updatePrAfterFix(pr, project, source, options = {}, legacyDispatchId =
       return prs;
     }
     clearPrNoOpFixAttempt(target, cause);
+    // W-mpoeirqx0007712a — verified-push stamping for BUILD_FAILURE. Reaching
+    // this point with explicitlyChangedBranch=true means the unverified-push
+    // guard above did NOT trigger, so either evidence === 'remote-head'
+    // (live remote refs prove the branch advanced) OR no branchChange info
+    // was supplied (legacy callers that didn't pass branchChange — keep
+    // existing behavior of trusting the agent's branchChanged claim).
+    // Clear the push-failure counter on confirmed success so future
+    // regressions start fresh.
+    if (cause === shared.PR_FIX_CAUSE.BUILD_FAILURE && explicitlyChangedBranch) {
+      target._buildFixPushedAt = ts();
+      delete target._buildFixPushFailedCount;
+      delete target._buildFixNeedsHumanRebase;
+    }
     if (source === 'pr-human-feedback') {
       const clearPendingFix = shouldClearHumanFeedbackPendingFix(target, pr, automationCauseKey);
       if (target.humanFeedback && clearPendingFix) target.humanFeedback.pendingFix = false;

package/engine/shared.js

@@ -1800,7 +1800,15 @@ const ENGINE_DEFAULTS = {
   logBufferSize: 50, // flush immediately when buffer exceeds this many entries
   lockRetries: 0, // no retries — single 5s timeout window with 25ms polling (200 attempts) is sufficient; stale lock recovery at 60s handles crashes
   lockRetryBackoffMs: 500, // base backoff between lock retries (doubles each attempt: 500ms, 1s, 2s, ...)
-  buildFixGracePeriod: 600000, // 10min — wait for CI to run after build fix before re-dispatching
+  buildFixGracePeriod: 600000, // 10min — wait for CI to run after a verified build-fix push before re-dispatching
+  // W-mpoeirqx0007712a: cap re-dispatch attempts when build-fix pushes
+  // silently fail to advance the remote head (stale-worktree push rejected,
+  // agent ignores non-zero git push exit and reports SUCCESS, etc).
+  // updatePrAfterFix increments `_buildFixPushFailedCount` whenever the
+  // post-completion branchChange has non-remote-head evidence; when the
+  // counter reaches this cap, the PR is flagged `_buildFixNeedsHumanRebase`
+  // so the dispatcher stops auto-retrying and a human can rescue the branch.
+  maxBuildFixRetries: 3,
   adoPollEnabled: true, // poll ADO PR status, comments, and reconciliation on each tick cycle
   ghPollEnabled: true, // poll GitHub PR status, comments, and reconciliation on each tick cycle
   prPollStatusEvery: 12,   // poll PR build/review/merge status every N ticks for both ADO and GitHub (~12 min at default interval)
@@ -1879,7 +1887,7 @@ const ENGINE_DEFAULTS = {
   removeWorktreeFailureTtlMs: 24 * 60 * 60 * 1000, // stale failed paths are forgotten after a day
   removeWorktreeFailureMaxEntries: 1000, // bound failed-worktree retry suppression cache
   ccMaxTurns: 50, // max tool-use turns per CC/doc-chat call before CLI stops (per response, not per session)
-  ccTurnTimeoutMs: 300000, // W-mpmwxni2000c25c7-b: wall-clock cap per CC/doc-chat turn; on expiry the in-flight LLM call is aborted and the handler surfaces `{code:'cc-turn-timeout', retriable:true}` instead of hanging the UI
+  ccTurnTimeoutMs: 300000, // W-mpmwxni2000c25c7-b/-d: 5min per-turn watchdog. Wall-clock cap per CC/doc-chat turn; on expiry the in-flight LLM call is aborted and the handler surfaces `{code:'cc-turn-timeout', retryable:true}` via the typed error envelope so the UI can stop the spinner and offer Retry. Clamped to [10000, 3600000] in the settings POST handler. Independent of CC_CALL_TIMEOUT_MS (the outer hour-long abort) — this is the visible-to-user no-progress cap.
   docSessionMaxEntries: 200, // cap doc-chat session map/disk store by least-recent activity (LRU; sessions are non-expiring otherwise)
   ccLiveStreamMaxAgeMs: 30 * 60 * 1000, // hard cap reconnect buffers if abort/cleanup stalls
   metricsFlushIntervalMs: 10000, // batch trackEngineUsage writes to metrics.json — flushed every 10s instead of per-call to cut lock contention and dashboard mtime churn

package/engine.js

@@ -4929,15 +4929,16 @@ async function discoverFromPrs(config, project) {
       }, `Fix build failure on ${pr.id}: ${pr.title || ''}`, { dispatchKey: key, cooldownKey: key, automationCauseKey: buildCauseKey, source: 'pr', pr, branch: prBranch, project: projMeta });
       if (item) {
         newWork.push(item); fixDispatched = true;
-        try {
-          const prPath = projectPrPath(project);
-          mutatePullRequests(prPath, prs => {
-            const target = shared.findPrRecord(prs, pr, project);
-            if (target) {
-              target._buildFixPushedAt = ts();
-            }
-          });
-        } catch (e) { log('warn', 'mark build fix dispatched: ' + e.message); }
+        // W-mpoeirqx0007712a — DO NOT stamp `_buildFixPushedAt` at dispatch
+        // time. The optimistic stamp here used to suppress re-dispatch for
+        // the buildFixGracePeriod window even when the agent never pushed
+        // (stale-worktree push silently rejected, agent reported SUCCESS
+        // anyway). `_buildFixPushedAt` is now written only by
+        // lifecycle.updatePrAfterFix after the post-completion branchChange
+        // confirms the remote head actually advanced (evidence ===
+        // 'remote-head'). In-flight dispatches are already deduplicated by
+        // `isPrAutomationCausePending` + `isAlreadyDispatched` above, so no
+        // race window opens by removing the optimistic stamp.
       }
 
       if (pr.agent && !pr._buildFailNotified) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yemi33/minions",
-  "version": "0.1.2053",
+  "version": "0.1.2055",
   "description": "Multi-agent AI dev team that runs from ~/.minions/ — five autonomous agents share a single engine, dashboard, and knowledge base",
   "bin": {
     "minions": "bin/minions.js"