@yemi33/minions 0.1.2057 → 0.1.2058

package/dashboard/js/render-agents.js

@@ -138,7 +138,6 @@ async function openAgentDetail(id) {
     renderDetailTabs(detail);
     renderDetailContent(detail, currentTab);
   } catch(e) {
-    // eslint-disable-next-line no-unsanitized/property -- reason: structural HTML is a string literal; all user data wrapped in escapeHtml() (fields: error message, agent id)
     document.getElementById('detail-content').innerHTML =
       '<div style="padding:24px;text-align:center">' +
         '<div style="color:var(--red);margin-bottom:12px">Error loading agent detail: ' + escapeHtml(e.message) + '</div>' +

package/dashboard/js/render-other.js

@@ -296,7 +296,7 @@ function renderTokenUsage(metrics) {
   const engAgg = _aggregateEngineUsageForTokenTile(engine);
   const engineCost = engAgg.cost, engineInput = engAgg.input,
     engineOutput = engAgg.output, engineCache = engAgg.cache,
-    engineCalls = engAgg.calls; // eslint-disable-line no-unused-vars
+    engineCalls = engAgg.calls;
 
   const totalCost = agentCost + engineCost;
   const totalInput = agentInput + engineInput;

package/dashboard/js/render-plans.js

@@ -459,7 +459,6 @@ async function planExecute(file, project, btn) {
 function planReexecuteModal(file, project) {
   const inputStyle = 'display:block;width:100%;margin-top:4px;padding:6px 8px;background:var(--bg);border:1px solid var(--border);border-radius:var(--radius-sm);color:var(--text);font-size:var(--text-md);font-family:inherit';
   document.getElementById('modal-title').textContent = 'Re-execute Plan';
-  // eslint-disable-next-line no-unsanitized/property -- reason: structural HTML is a string literal; all user data wrapped in escapeHtml() (fields: plan file, project)
   document.getElementById('modal-body').innerHTML =
     '<div style="display:flex;flex-direction:column;gap:10px">' +
       '<div style="font-size:12px;color:var(--muted)">' + escapeHtml(file) + '</div>' +
@@ -549,7 +548,6 @@ function _renderPlanModal(normalizedFile, raw, lastMod) {
   if (normalizedFile.endsWith('.json')) {
     let plan;
     try { plan = JSON.parse(raw); } catch (e) {
-      // eslint-disable-next-line no-unsanitized/property -- reason: structural HTML is a string literal; all user data wrapped in escapeHtml() (fields: parse error message, raw plan excerpt)
       document.getElementById('modal-body').innerHTML = '<p style="color:var(--red)">Failed to parse plan JSON: ' + escapeHtml(e.message) + '</p><pre style="font-size:10px;max-height:200px;overflow:auto">' + escapeHtml((raw || '').slice(0, 500)) + '</pre>';
       return;
     }

package/dashboard/js/render-work-items.js

@@ -374,7 +374,6 @@ let _feedbackRating = null;
 function feedbackWorkItem(id, source) {
   _feedbackRating = null;
   document.getElementById('modal-title').textContent = 'Feedback on ' + id;
-  // eslint-disable-next-line no-unsanitized/property -- reason: structural HTML is a string literal; all user data wrapped in escapeHtml() (fields: work item id, source)
   document.getElementById('modal-body').innerHTML =
     '<div style="display:flex;flex-direction:column;gap:16px">' +
       '<div style="display:flex;gap:16px;justify-content:center">' +

package/dashboard/js/utils.js

@@ -460,6 +460,7 @@ function _renderMdChunked(fullText) {
         el.remove();
         return;
       }
+      // eslint-disable-next-line no-unsanitized/method -- reason: _renderMdCore() escapes input via escHtml() at the top (utils.js:242) before applying safe markdown transforms; chunks are slices of the same fullText whose first chunk is already injected via firstHtml above (utils.js:445)
       el.insertAdjacentHTML('beforebegin', _renderMdCore(chunks[idx]));
       idx++;
       if (idx >= chunks.length) {

package/dashboard.js

@@ -1717,6 +1717,18 @@ function _buildStatusFastState() {
   // outside so the async path can yield between reload and rebuild.
   const engineState = getEngineState();
   const hbAge = engineState.heartbeat ? Date.now() - engineState.heartbeat : 0;
+  // W-mpof1xxe000ac689 — Two-signal liveness check. heartbeat (15s cadence,
+  // engine/cli.js writeHeartbeatNow) and lastTickAt (tickInterval cadence,
+  // engine.js#tickInner) are written by independent setIntervals. If the
+  // heartbeat writer silently dies but tickInner keeps running, the heartbeat
+  // ages past 120s while lastTickAt stays fresh — the dashboard used to lie
+  // ("STALE") on a provably-ticking engine. Engine is alive iff ANY signal is
+  // fresh; only when BOTH age past threshold do we trip the badge. The tick
+  // threshold is floored by ENGINE_HEARTBEAT_STALE_MS so a misconfigured 5s
+  // tickInterval cannot trip the boolean in 10s.
+  const tickInterval = Number(CONFIG?.engine?.tickInterval) || shared.ENGINE_DEFAULTS.tickInterval;
+  const tickStaleThresholdMs = Math.max(ENGINE_HEARTBEAT_STALE_MS, 2 * tickInterval);
+  const tickAge = engineState.lastTickAt ? Date.now() - engineState.lastTickAt : Infinity;
   return {
     agents: getAgents(),
     inbox: getInbox(),
@@ -1729,12 +1741,14 @@ function _buildStatusFastState() {
       // off these instead of recomputing Date.now() - heartbeat against a
       // possibly-cached payload (false-positive banner regression #2754).
       heartbeatAgeMs: engineState.heartbeat ? hbAge : null,
-      heartbeatStale: !!(engineState.heartbeat && hbAge > ENGINE_HEARTBEAT_STALE_MS),
+      heartbeatStale: !!(engineState.heartbeat
+        && hbAge > ENGINE_HEARTBEAT_STALE_MS
+        && tickAge > tickStaleThresholdMs),
       // W-mpnc4u8c001d9d6c — Surface the tick cadence so the client's
       // #engine-quick-stats "Next tick in Xs" countdown reads the SAME value
       // the engine actually uses (Settings parity rule). Paired with
       // control.lastTickAt (above) stamped at the start of every tickInner.
-      tickInterval: Number(CONFIG?.engine?.tickInterval) || shared.ENGINE_DEFAULTS.tickInterval,
+      tickInterval: tickInterval,
     },
     adoThrottle: ado.getAdoThrottleState(),
     ghThrottle: gh.getGhThrottleState(),
@@ -2165,10 +2179,47 @@ function getStatus() {
 //     next caller — including the synchronous fallback inside
 //     `_handleStatusRequest` — rebuilds against the post-invalidate signal
 //     and bumps the version then.
+// ── /api/status profiling (W-mpodww9h000b460a) ─────────────────────────────
+// Feature-flagged per-phase timing emitter. Off by default (no perf cost).
+// Enable with:
+//   DEBUG_STATUS_TIMING=1                      — log every rebuild forever
+//   DEBUG_STATUS_TIMING_SAMPLES=N              — log the next N rebuilds then
+//                                                 auto-disable (one-shot mode
+//                                                 for live triage; preferred)
+// Output goes to stderr as a tagged single line so it's easy to grep:
+//   [status-timing] fastBuild=350ms slowBuild=120ms stringify=45ms gzip=180ms
+//                   total=695ms fastStale=true slowStale=false cacheV=42
+// All four phases are timed regardless of which actually ran — phases that
+// were skipped (cache hit) report 0ms, so the columns line up across calls.
+const _STATUS_TIMING_ENABLED = !!process.env.DEBUG_STATUS_TIMING;
+let _statusTimingSamplesRemaining = (() => {
+  const raw = process.env.DEBUG_STATUS_TIMING_SAMPLES;
+  if (!raw) return null;
+  const n = Number.parseInt(raw, 10);
+  return Number.isFinite(n) && n > 0 ? n : null;
+})();
+function _statusTimingActive() {
+  if (_STATUS_TIMING_ENABLED) return true;
+  return _statusTimingSamplesRemaining != null && _statusTimingSamplesRemaining > 0;
+}
+function _emitStatusTiming(parts) {
+  if (_statusTimingSamplesRemaining != null && _statusTimingSamplesRemaining > 0) {
+    _statusTimingSamplesRemaining -= 1;
+  }
+  const cols = Object.entries(parts)
+    .map(([k, v]) => `${k}=${typeof v === 'number' ? v.toFixed(1) + 'ms' : v}`)
+    .join(' ');
+  try { process.stderr.write('[status-timing] ' + cols + '\n'); } catch { /* stderr unavailable */ }
+}
+
 function refreshStatusAsync() {
   if (_statusRebuildPromise) return _statusRebuildPromise;
 
   _statusRebuildPromise = (async () => {
+    const profile = _statusTimingActive();
+    const tOverall = profile ? process.hrtime.bigint() : null;
+    let fastBuildMs = 0;
+    let slowBuildMs = 0;
     try {
       const now = Date.now();
       const startGeneration = _statusInvalidationGeneration;
@@ -2188,7 +2239,16 @@ function refreshStatusAsync() {
         }
       }
 
-      if (!fastStale && !slowStale && _statusCache) return _statusCache;
+      if (!fastStale && !slowStale && _statusCache) {
+        if (profile) {
+          _emitStatusTiming({
+            phase: 'cache-hit',
+            total: Number(process.hrtime.bigint() - tOverall) / 1e6,
+            fastStale: false, slowStale: false, cacheV: _statusCacheVersion,
+          });
+        }
+        return _statusCache;
+      }
 
       let fast = _fastState;
       // Pre-build mtime snapshot (see getStatus() for the rationale). The async
@@ -2199,7 +2259,9 @@ function refreshStatusAsync() {
       if (fastStale) {
         reloadConfig();
         preBuildMtimes = _getMtimes();
+        const tFast = profile ? process.hrtime.bigint() : null;
         fast = _buildStatusFastState();
+        if (profile) fastBuildMs = Number(process.hrtime.bigint() - tFast) / 1e6;
       }
 
       // Unconditional cooperative yield between phases — guarantees the event
@@ -2217,7 +2279,9 @@ function refreshStatusAsync() {
       if (slowStale) {
         if (slowMtimeChanged) _invalidateSlowInnerCachesForMtimeChange();
         preBuildSlowMtimes = _getSlowMtimes();
+        const tSlow = profile ? process.hrtime.bigint() : null;
         slow = _buildStatusSlowState();
+        if (profile) slowBuildMs = Number(process.hrtime.bigint() - tSlow) / 1e6;
       }
 
       // Invalidation-race guard: if an invalidation fired during the await
@@ -2226,6 +2290,14 @@ function refreshStatusAsync() {
       // next sync getStatus() OR async refreshStatusAsync() rebuilds fresh
       // against the post-invalidate generation.
       if (_statusInvalidationGeneration !== startGeneration) {
+        if (profile) {
+          _emitStatusTiming({
+            phase: 'discarded-invalidation-race',
+            fastBuild: fastBuildMs, slowBuild: slowBuildMs,
+            total: Number(process.hrtime.bigint() - tOverall) / 1e6,
+            cacheV: _statusCacheVersion,
+          });
+        }
         return _statusCache;
       }
 
@@ -2241,6 +2313,14 @@ function refreshStatusAsync() {
       }
       _statusCache = { ..._fastState, ..._slowState, timestamp: new Date().toISOString() };
       _markStatusCacheBuilt();
+      if (profile) {
+        _emitStatusTiming({
+          phase: 'rebuilt',
+          fastBuild: fastBuildMs, slowBuild: slowBuildMs,
+          total: Number(process.hrtime.bigint() - tOverall) / 1e6,
+          fastStale, slowStale, cacheV: _statusCacheVersion,
+        });
+      }
       return _statusCache;
     } finally {
       _statusRebuildPromise = null;
@@ -2279,8 +2359,22 @@ function _resetStatusCacheForTesting() {
 function getStatusJson() {
   getStatus(); // ensure _statusCache is fresh
   if (!_statusCacheJson) {
+    const profile = _statusTimingActive();
+    const tStringify = profile ? process.hrtime.bigint() : null;
     _statusCacheJson = JSON.stringify(_statusCache);
+    const stringifyMs = profile ? Number(process.hrtime.bigint() - tStringify) / 1e6 : 0;
+    const tGzip = profile ? process.hrtime.bigint() : null;
     _statusCacheGzip = zlib.gzipSync(_statusCacheJson); // pre-compute gzip once per cache rebuild
+    if (profile) {
+      const gzipMs = Number(process.hrtime.bigint() - tGzip) / 1e6;
+      _emitStatusTiming({
+        phase: 'serialize',
+        stringify: stringifyMs, gzip: gzipMs,
+        jsonKB: (_statusCacheJson.length / 1024).toFixed(1),
+        gzipKB: (_statusCacheGzip.length / 1024).toFixed(1),
+        cacheV: _statusCacheVersion,
+      });
+    }
   }
   return _statusCacheJson;
 }
@@ -11082,6 +11176,10 @@ module.exports = {
   _setStatusRefreshHook,
   _resetStatusCacheForTesting,
   _ifNoneMatchHasEtag,
+  // Exported for the engine-stale-two-signal test (W-mpof1xxe000ac689) — the
+  // staleness verdict it stamps on engine.heartbeatStale is the contract under
+  // test. No production caller imports this; it is a test seam.
+  _buildStatusFastState,
 };
 
 // Start the HTTP server only when run directly (node dashboard.js).

package/engine/meeting.js

@@ -334,12 +334,48 @@ function writeMeetingTranscriptToInbox(meeting, meetingId, agents) {
   } catch (e) { log('warn', `Meeting ${meetingId} inbox write: ${e.message}`); }
 }
 
+// Cache for getMeetings (W-mpodww9h000b460a). Dashboard fast-state calls
+// getMeetings() twice per rebuild — once for the slim slice and once for
+// the meetingsTotal sidebar counter — and each call reads + parses every
+// meetings/<id>.json on disk (~9 MB total at task time → ~30–45 ms).
+// 1 s TTL mirrors `_dispatchCache` / `_prsCache` / `_workItemsCache`:
+// short enough that the next SPA poll (~4 s) reflects new rounds, and the
+// dashboard mtime tracker on meetings/*.json busts the upstream
+// `_statusCache` on real writes anyway.
+//
+// mtime gate: a single statSync on MEETINGS_DIR catches new/deleted
+// meetings (NTFS + ext4 both advance dir mtime on entry add/remove),
+// covering tests and any code path that bypasses mutateMeeting.
+let _meetingsCache = null;
+let _meetingsCacheAt = 0;
+let _meetingsCacheDirMtime = 0;
+function invalidateMeetingsCache() {
+  _meetingsCache = null;
+  _meetingsCacheAt = 0;
+  _meetingsCacheDirMtime = 0;
+}
+
 function getMeetings() {
-  if (!fs.existsSync(MEETINGS_DIR)) return [];
-  return fs.readdirSync(MEETINGS_DIR)
+  const now = Date.now();
+  if (_meetingsCache && (now - _meetingsCacheAt) < 1000) {
+    let currDirMtime = 0;
+    try { currDirMtime = fs.statSync(MEETINGS_DIR).mtimeMs; } catch { /* missing */ }
+    if (currDirMtime === _meetingsCacheDirMtime) return _meetingsCache;
+  }
+  if (!fs.existsSync(MEETINGS_DIR)) {
+    _meetingsCache = [];
+    _meetingsCacheAt = now;
+    _meetingsCacheDirMtime = 0;
+    return _meetingsCache;
+  }
+  const result = fs.readdirSync(MEETINGS_DIR)
     .filter(f => f.endsWith('.json'))
     .map(f => safeJson(path.join(MEETINGS_DIR, f)))
     .filter(Boolean);
+  _meetingsCache = result;
+  _meetingsCacheAt = now;
+  try { _meetingsCacheDirMtime = fs.statSync(MEETINGS_DIR).mtimeMs; } catch { _meetingsCacheDirMtime = 0; }
+  return result;
 }
 
 function getMeeting(id) {
@@ -397,6 +433,10 @@ function mutateMeeting(id, fn) {
     }
     return userResult;
   }, { defaultValue: {}, skipWriteIfUnchanged: true });
+  // Invalidate the cached getMeetings() list so subsequent dashboard reads
+  // observe the write (W-mpodww9h000b460a). Mirrors the
+  // mutateDispatch → invalidateDispatchCache pattern.
+  invalidateMeetingsCache();
   return userResult === undefined ? null : userResult;
 }
 
@@ -818,6 +858,7 @@ function deleteMeeting(id) {
   // mutateMeeting writes a .backup sidecar; safeJson auto-restores from it
   // when the primary is missing, so deletion must also drop the backup.
   try { fs.unlinkSync(filePath + '.backup'); } catch { /* sidecar may not exist */ }
+  invalidateMeetingsCache();
   return true;
 }
 
@@ -914,6 +955,7 @@ function checkMeetingTimeouts(config) {
 }
 module.exports = {
   MEETINGS_DIR, getMeetings, getMeeting, saveMeeting, mutateMeeting, createMeeting,
+  invalidateMeetingsCache,
   discoverMeetingWork, collectMeetingFindings, checkMeetingTimeouts,
   addMeetingNote, advanceMeetingRound, endMeeting, archiveMeeting, unarchiveMeeting, deleteMeeting,
   EMPTY_OUTPUT_PATTERNS,

package/engine/queries.js

@@ -1159,8 +1159,66 @@ function getKnowledgeBaseIndex() {
 
 // ── Work Items ──────────────────────────────────────────────────────────────
 
+// Cache: getWorkItems is called 5–7x per /api/status fast-state rebuild
+// (W-mpodww9h000b460a). The dashboard's `_buildStatusFastState` calls it
+// directly for the `workItems` slice, AND every idle agent's
+// `getAgentStatus()` fallback re-reads it to derive a work-item-marker
+// "working" state when dispatch.json briefly desyncs from per-project
+// work-items.json. With 5 agents (3 idle) and a 890 KB central
+// work-items.json, the pre-cache cost was ~300 ms per fast-state rebuild —
+// the single biggest hot-path offender. Mirrors `_prsCache` / `_dispatchCache`
+// (1 s TTL eliminates intra-request duplication without masking real
+// updates from the next 4 s SPA poll cycle).
+//
+// mtime-gated freshness (W-mpodww9h000b460a): bare TTL is not enough because
+// callers like tests and `safeWrite` write the central + per-project files
+// without going through `mutateWorkItems` (which busts the cache via
+// `invalidateWorkItemsCache`). One cheap `statSync` per file per cache hit
+// catches those writes within ~10 ms regardless of the TTL. Files that
+// don't exist record `null` so subsequent appearance still busts.
+let _workItemsCache = null;
+let _workItemsCacheAt = 0;
+let _workItemsCacheMtimes = null;
+function invalidateWorkItemsCache() {
+  _workItemsCache = null;
+  _workItemsCacheAt = 0;
+  _workItemsCacheMtimes = null;
+}
+
+function _workItemsFilePaths(config) {
+  const projects = getProjects(config);
+  const out = [path.join(MINIONS_DIR, 'work-items.json')];
+  for (const p of projects) {
+    try { out.push(projectWorkItemsPath(p)); } catch { /* missing path helper output */ }
+  }
+  return out;
+}
+function _snapshotWorkItemsMtimes(config) {
+  const out = Object.create(null);
+  for (const fp of _workItemsFilePaths(config)) {
+    try { out[fp] = fs.statSync(fp).mtimeMs; }
+    catch { out[fp] = null; /* ENOENT → null; flipping to present must bust */ }
+  }
+  return out;
+}
+function _workItemsMtimesDiffer(prev, curr) {
+  if (!prev || !curr) return true;
+  for (const fp of Object.keys(curr)) {
+    if (prev[fp] !== curr[fp]) return true;
+  }
+  for (const fp of Object.keys(prev)) {
+    if (!(fp in curr)) return true;
+  }
+  return false;
+}
+
 function getWorkItems(config) {
+  const now = Date.now();
   config = config || getConfig();
+  if (_workItemsCache && (now - _workItemsCacheAt) < 1000) {
+    const currMtimes = _snapshotWorkItemsMtimes(config);
+    if (!_workItemsMtimesDiffer(_workItemsCacheMtimes, currMtimes)) return _workItemsCache;
+  }
   const projects = getProjects(config);
   const allItems = [];
 
@@ -1326,6 +1384,9 @@ function getWorkItems(config) {
     return (b.created || '').localeCompare(a.created || '');
   });
 
+  _workItemsCache = allItems;
+  _workItemsCacheAt = now;
+  _workItemsCacheMtimes = _snapshotWorkItemsMtimes(config);
   return allItems;
 }
 
@@ -2367,5 +2428,5 @@ module.exports = {
   getKnowledgeBaseEntries, getKnowledgeBaseEntriesSnapshot, getKnowledgeBaseIndex,
 
   // Work items & PRD
-  getWorkItems, getPrdInfo,
+  getWorkItems, invalidateWorkItemsCache, getPrdInfo,
 };

package/engine/shared.js

@@ -4564,10 +4564,16 @@ function listProcessReachable(rootPids, allProcesses = null) {
  * @param {Function} mutator - Receives the array, mutates in place or returns new value
  */
 function mutateWorkItems(filePath, mutator) {
-  return mutateJsonFileLocked(filePath, (data) => {
+  const result = mutateJsonFileLocked(filePath, (data) => {
     if (!Array.isArray(data)) data = [];
     return mutator(data) || data;
   }, { defaultValue: [], skipWriteIfUnchanged: true });
+  // Invalidate the read cache so the next getWorkItems() sees fresh data
+  // (W-mpodww9h000b460a). Mirrors dispatch.js's invalidateDispatchCache
+  // call after mutateDispatch. Lazy-required to avoid the queries→shared
+  // require cycle.
+  try { require('./queries').invalidateWorkItemsCache(); } catch { /* queries not loaded */ }
+  return result;
 }
 
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yemi33/minions",
-  "version": "0.1.2057",
+  "version": "0.1.2058",
   "description": "Multi-agent AI dev team that runs from ~/.minions/ — five autonomous agents share a single engine, dashboard, and knowledge base",
   "bin": {
     "minions": "bin/minions.js"