@yemi33/minions 0.1.2080 → 0.1.2082

package/dashboard/js/refresh.js

@@ -104,6 +104,22 @@ const _sectionCacheVersions = {};
 // into the ring-buffer entry then resets _lastChangedFlags to null so steady-
 // state has no side effect. See "Refresh diagnostics" block below.
 let _lastChangedFlags = null;
+
+// Per-renderer isolation: a bare `renderX(...)` call that throws used to
+// abort the rest of _processStatusUpdate, leaving the work-items and
+// dispatch tables frozen until a hard refresh. _safeRender wraps each
+// call so one throw can't take out the chain — every downstream renderer
+// still runs and paints fresh DOM. Throws are logged to Console for
+// triage but don't surface a UI banner (intentional — silent recovery is
+// less disruptive than a red banner for what's typically a transient
+// data-shape blip).
+function _safeRender(name, fn) {
+  try { fn(); }
+  catch (e) {
+    // eslint-disable-next-line no-console
+    console.error('[render] ' + name + ' threw:', e);
+  }
+}
 function _changed(key, value, version) {
   var v = version == null ? (RENDER_VERSIONS[key] || 0) : version;
   // Drop the stale-version entry so the cache doesn't grow unbounded across bumps.
@@ -294,12 +310,13 @@ function _processStatusUpdate(data) {
   window._lastStatus = data;
 
 
-  // Render every section every tick (W-mpn7keq9000302c9 + this commit).
-  // Every `_changed(...)` GATE was producing the same class of bug —
-  // ref-equality or JSON.stringify short-circuit falsely matching across
-  // ticks, leaving the DOM frozen until the user did a hard refresh. The
-  // gates were a small CPU win at the cost of real-time correctness on
-  // every screen.
+  // Render every section every tick, each call ISOLATED via _safeRender so a
+  // single bad-data renderer can't abort the rest of the chain. Prior bug:
+  // an upstream throw (e.g. renderEngineStatus on a partial engine slice)
+  // propagated to refresh()'s outer catch, skipping every downstream
+  // renderer — including renderWorkItems below — until the offending record
+  // cycled out of the slim /api/status payload. Per-call try/catch keeps
+  // each renderer independent; throws log to Console (no UI banner).
   //
   // We KEEP the `_changed(...)` CALLS (their side effect of populating
   // `_lastChangedFlags` is still load-bearing for the diag ring-buffer
@@ -308,80 +325,78 @@ function _processStatusUpdate(data) {
   // value to gate the render. Each renderer is a contained DOM rewrite
   // (~ a few KB of HTML); ~10–20 of them per 4s tick is well under one
   // frame's budget.
-  //
-  // Gates intentionally kept: none on the render path. The render-versions
-  // bump path (RENDER_VERSIONS map + _changed's stringify cache) is still
-  // useful for the diag flag, just not as a render skip.
   _changed('agents', data.agents);
-  renderAgents(data.agents);
-  cmdUpdateAgentList(data.agents);
+  _safeRender('agents', function() { renderAgents(data.agents); });
+  _safeRender('cmdUpdateAgentList', function() { cmdUpdateAgentList(data.agents); });
   // prdProgress + prdPrs are captured together so both flags publish to
   // the diag buffer; the renderer + cachePrdItems run unconditionally.
   _changed('prdProgress', data.prdProgress);
   _changed('prdPrs', data.pullRequests?.length);
-  renderPrdProgress(data.prdProgress);
-  _cachePrdItems(data.prdProgress);
+  _safeRender('prdProgress', function() { renderPrdProgress(data.prdProgress); });
+  _safeRender('cachePrdItems', function() { _cachePrdItems(data.prdProgress); });
   _changed('inbox', data.inbox);
-  renderInbox(data.inbox || []);
+  _safeRender('inbox', function() { renderInbox(data.inbox || []); });
   _changed('projects', data.projects);
-  cmdUpdateProjectList(data.projects || []);
-  renderProjects(data.projects || []);
+  _safeRender('cmdUpdateProjectList', function() { cmdUpdateProjectList(data.projects || []); });
+  _safeRender('projects', function() { renderProjects(data.projects || []); });
   // FRE banner — safe to call every tick (idempotent + cheap). Pass the full
   // status payload so the runtime-CLI explainer reads autoMode.defaultCli from
   // THIS tick (window._lastStatus is hoisted above, but renderFre takes the
   // payload directly to avoid the window-global indirection).
   if (typeof renderFre === 'function') {
-    try { renderFre(data); } catch { /* expected on first load */ }
+    _safeRender('fre', function() { renderFre(data); });
   }
   _changed('notes', data.notes);
-  renderNotes(data.notes);
+  _safeRender('notes', function() { renderNotes(data.notes); });
   _changed('prd', [data.prd, data.prdProgress]);
-  renderPrd(data.prd, data.prdProgress);
+  _safeRender('prd', function() { renderPrd(data.prd, data.prdProgress); });
   // Capture prs + workItems change signals once — also reused by the cross-slice
   // render triggers at the bottom of this function (F1/F3, W-mpgb0xbh000e3b86).
   // _changed mutates _sectionCache so it must be called exactly once per key.
   var _prsChanged = _changed('prs', data.pullRequests);
   var _workItemsChanged = _changed('workItems', data.workItems);
-  renderPrs(data.pullRequests || []);
+  _safeRender('prs', function() { renderPrs(data.pullRequests || []); });
   _changed('archivedPrds', data.archivedPrds);
-  renderArchiveButtons(data.archivedPrds || []);
+  _safeRender('archiveButtons', function() { renderArchiveButtons(data.archivedPrds || []); });
   _changed('engine', data.engine);
-  if (data.engine) renderEngineStatus(data.engine);
-  var qs = document.getElementById('engine-quick-stats');
-  if (qs && data.engine) {
-    var wt = data.engine.worktreeCount != null ? data.engine.worktreeCount : '-';
-    var pid = data.engine.pid || '-';
-    // W-mpnc4u8c001d9d6c — replace the dead "Tick: -" chip (control.json
-    // never carried a `tick` field) with a live "Next tick in Xs" countdown
-    // driven by engine.lastTickAt (stamped at the start of every tickInner)
-    // and engine.tickInterval (config, surfaced in the status payload).
-    // _updateNextTickChip below ticks the inner span every 1s without
-    // re-rendering this whole row.
-    _engineCountdown.lastTickAt = Number(data.engine.lastTickAt) || 0;
-    _engineCountdown.tickInterval = Number(data.engine.tickInterval) || 0;
-    _engineCountdown.engineState = data.engine.state || 'stopped';
-    // Feed the cadence ring buffer so the overshoot label can surface the
-    // observed tick-to-tick gap (W-mpodheao0006a37a).
-    _recordEngineTickObservation(_engineCountdown.lastTickAt);
-    // eslint-disable-next-line no-unsanitized/property -- reason: composed from internal engine metrics (pid, lastTickAt/tickInterval, worktreeCount) and a literal id; no user data flows in
-    qs.innerHTML = '<span>PID: <b>' + pid + '</b></span>' +
-      '<span>Next tick in: <b id="engine-next-tick">' + _formatNextTickText() + '</b></span>' +
-      '<span>Worktrees: <b>' + wt + '</b></span>';
-    _startNextTickTicker();
-  }
+  if (data.engine) _safeRender('engineStatus', function() { renderEngineStatus(data.engine); });
+  _safeRender('engineQuickStats', function() {
+    var qs = document.getElementById('engine-quick-stats');
+    if (qs && data.engine) {
+      var wt = data.engine.worktreeCount != null ? data.engine.worktreeCount : '-';
+      var pid = data.engine.pid || '-';
+      // W-mpnc4u8c001d9d6c — replace the dead "Tick: -" chip (control.json
+      // never carried a `tick` field) with a live "Next tick in Xs" countdown
+      // driven by engine.lastTickAt (stamped at the start of every tickInner)
+      // and engine.tickInterval (config, surfaced in the status payload).
+      // _updateNextTickChip below ticks the inner span every 1s without
+      // re-rendering this whole row.
+      _engineCountdown.lastTickAt = Number(data.engine.lastTickAt) || 0;
+      _engineCountdown.tickInterval = Number(data.engine.tickInterval) || 0;
+      _engineCountdown.engineState = data.engine.state || 'stopped';
+      // Feed the cadence ring buffer so the overshoot label can surface the
+      // observed tick-to-tick gap (W-mpodheao0006a37a).
+      _recordEngineTickObservation(_engineCountdown.lastTickAt);
+      // eslint-disable-next-line no-unsanitized/property -- reason: composed from internal engine metrics (pid, lastTickAt/tickInterval, worktreeCount) and a literal id; no user data flows in
+      qs.innerHTML = '<span>PID: <b>' + pid + '</b></span>' +
+        '<span>Next tick in: <b id="engine-next-tick">' + _formatNextTickText() + '</b></span>' +
+        '<span>Worktrees: <b>' + wt + '</b></span>';
+      _startNextTickTicker();
+    }
+  });
   _changed('version', data.version);
-  renderVersionBanner(data.version);
+  _safeRender('versionBanner', function() { renderVersionBanner(data.version); });
   _changed('adoThrottle', data.adoThrottle);
-  renderAdoThrottleAlert(data.adoThrottle);
+  _safeRender('adoThrottle', function() { renderAdoThrottleAlert(data.adoThrottle); });
   _changed('ghThrottle', data.ghThrottle);
-  renderGhThrottleAlert(data.ghThrottle);
+  _safeRender('ghThrottle', function() { renderGhThrottleAlert(data.ghThrottle); });
   _changed('dispatch', data.dispatch);
-  renderDispatch(data.dispatch);
-  prunePrdRequeueState(window._lastWorkItems);
+  _safeRender('dispatch', function() { renderDispatch(data.dispatch); });
+  _safeRender('prunePrdRequeueState', function() { prunePrdRequeueState(window._lastWorkItems); });
   _changed('engineLog', data.engineLog);
-  renderEngineLog(data.engineLog || []);
+  _safeRender('engineLog', function() { renderEngineLog(data.engineLog || []); });
   _changed('metrics', data.metrics);
-  renderMetrics(data.metrics || {});
+  _safeRender('metrics', function() { renderMetrics(data.metrics || {}); });
   // managed-processes panel — ETag-gated so unchanged ticks return 304 with
   // no body (P-6e2a8b13). Sequenced BEFORE the keep-processes call below via
   // .then() so the keep renderer reads a populated managed-PID cache for
@@ -400,21 +415,23 @@ function _processStatusUpdate(data) {
       .catch(function () { /* keep render even if managed fetch failed — getLastItems() returns the last good cache (or []) */ })
       .then(function () { try { renderKeepProcesses(); } catch {} });
   }
-  renderWorkItems(data.workItems || []);
+  _safeRender('workItems', function() { renderWorkItems(data.workItems || []); });
   _changed('skills', data.skills);
-  renderSkills(data.skills || []);
+  _safeRender('skills', function() { renderSkills(data.skills || []); });
   _changed('mcpServers', data.mcpServers);
-  renderMcpServers(data.mcpServers || []);
+  _safeRender('mcpServers', function() { renderMcpServers(data.mcpServers || []); });
   _changed('schedules', data.schedules);
-  renderSchedules(data.schedules || []);
+  _safeRender('schedules', function() { renderSchedules(data.schedules || []); });
   _changed('watches', data.watches);
-  renderWatches(data.watches || []);
+  _safeRender('watches', function() { renderWatches(data.watches || []); });
   _changed('meetings', data.meetings);
-  renderMeetings(data.meetings || []);
+  _safeRender('meetings', function() { renderMeetings(data.meetings || []); });
   _changed('pipelines', data.pipelines);
-  if (typeof renderPipelines === 'function') renderPipelines(data.pipelines || []);
+  if (typeof renderPipelines === 'function') {
+    _safeRender('pipelines', function() { renderPipelines(data.pipelines || []); });
+  }
   _changed('pinned', data.pinned);
-  renderPinned(data.pinned || []);
+  _safeRender('pinned', function() { renderPinned(data.pinned || []); });
   // Sidebar counts (cheap)
   const swi = document.getElementById('sidebar-wi');
   if (swi) swi.textContent = (data.workItems || []).length || '';
@@ -430,8 +447,8 @@ function _processStatusUpdate(data) {
   //     and after every kb-sweep (engine/queries.js _kbCache / kb-sweep.js).
   // Previously throttled to every 3rd cycle (~12s) — see W-mphfb6ss000a3b9e
   // for the cadence audit + Playwright coverage.
-  refreshKnowledgeBase();
-  refreshPlans();
+  _safeRender('refreshKnowledgeBase', function() { refreshKnowledgeBase(); });
+  _safeRender('refreshPlans', function() { refreshPlans(); });
 
   // Cross-slice render triggers (F1/F3, W-mpgb0xbh000e3b86): renderPrs reads
   // window._lastWorkItems for the +N follow-up chip count and derivePlanStatus
@@ -444,14 +461,14 @@ function _processStatusUpdate(data) {
     // F1: only the work-item slice moved this tick — renderPrs wasn't called
     // above, so the +N follow-up chip would otherwise stay stale until the
     // next PR mutation.
-    renderPrs(data.pullRequests || []);
+    _safeRender('prs:cross-slice', function() { renderPrs(data.pullRequests || []); });
   }
   if ((_workItemsChanged || _prsChanged) && Array.isArray(window._lastPlans) && typeof renderPlans === 'function') {
     // F3: derivePlanStatus + _renderVerifyBadge derive from pullRequests +
     // workItems. Re-render against cached plans so plan status flips within
     // one /api/status tick (~4s) instead of one refreshPlans poll. No-op
     // until _lastPlans is populated.
-    renderPlans(window._lastPlans);
+    _safeRender('plans:cross-slice', function() { renderPlans(window._lastPlans); });
   }
 
   // Sidebar activity indicators — show red dot on pages with new activity

package/dashboard.js

@@ -5593,6 +5593,9 @@ const server = http.createServer(async (req, res) => {
     try {
       const body = await readBody(req);
       if (!body.source || !body.itemId) return jsonReply(res, 400, { error: 'source and itemId required' });
+      // Reject markdown filenames — mutateJsonFileLocked below silently overwrites
+      // the file with JSON, destroying source plans (see /api/plans/approve trap).
+      if (!body.source.endsWith('.json')) return jsonReply(res, 400, { error: 'expected a PRD JSON filename in `source` (got `' + body.source + '`). Pass prd/<plan>.json, not plans/<plan>.md.' });
       const planPath = resolvePlanPath(body.source);
       if (!fs.existsSync(planPath)) return jsonReply(res, 404, { error: 'plan file not found' });
       // Pre-check: verify item exists before taking the lock
@@ -5649,6 +5652,7 @@ const server = http.createServer(async (req, res) => {
     try {
       const body = await readBody(req);
       if (!body.source || !body.itemId) return jsonReply(res, 400, { error: 'source and itemId required' });
+      if (!body.source.endsWith('.json')) return jsonReply(res, 400, { error: 'expected a PRD JSON filename in `source` (got `' + body.source + '`). Pass prd/<plan>.json, not plans/<plan>.md.' });
       const planPath = resolvePlanPath(body.source);
       if (!fs.existsSync(planPath)) return jsonReply(res, 404, { error: 'plan file not found' });
       let removed = false;
@@ -6381,6 +6385,7 @@ const server = http.createServer(async (req, res) => {
     try {
       const body = await readBody(req);
       if (!body.file) return jsonReply(res, 400, { error: 'file required' });
+      if (!body.file.endsWith('.json')) return jsonReply(res, 400, { error: 'expected a PRD JSON filename (got `' + body.file + '`). To approve a plan, pass prd/<plan>.json, not the source plans/<plan>.md.' });
       const planPath = resolvePlanPath(body.file);
       let wasStale = false;
       const plan = mutateJsonFileLocked(planPath, (data) => {
@@ -6474,6 +6479,7 @@ const server = http.createServer(async (req, res) => {
     try {
       const body = await readBody(req);
       if (!body.file) return jsonReply(res, 400, { error: 'file required' });
+      if (!body.file.endsWith('.json')) return jsonReply(res, 400, { error: 'expected a PRD JSON filename (got `' + body.file + '`). Pass prd/<plan>.json, not the source plans/<plan>.md.' });
       const planPath = resolvePlanPath(body.file);
       mutateJsonFileLocked(planPath, (plan) => {
         if (!plan || Array.isArray(plan) || typeof plan !== 'object') plan = {};
@@ -6624,6 +6630,7 @@ const server = http.createServer(async (req, res) => {
     try {
       const body = await readBody(req);
       if (!body.file) return jsonReply(res, 400, { error: 'file required' });
+      if (!body.file.endsWith('.json')) return jsonReply(res, 400, { error: 'expected a PRD JSON filename (got `' + body.file + '`). Pass prd/<plan>.json, not the source plans/<plan>.md.' });
       const planPath = resolvePlanPath(body.file);
       const plan = mutateJsonFileLocked(planPath, (data) => {
         if (!data || Array.isArray(data) || typeof data !== 'object') data = {};
@@ -6882,6 +6889,7 @@ const server = http.createServer(async (req, res) => {
     try {
       const body = await readBody(req);
       if (!body.file || !body.feedback) return jsonReply(res, 400, { error: 'file and feedback required' });
+      if (!body.file.endsWith('.json')) return jsonReply(res, 400, { error: 'expected a PRD JSON filename (got `' + body.file + '`). Pass prd/<plan>.json, not the source plans/<plan>.md.' });
       const planPath = resolvePlanPath(body.file);
       const plan = mutateJsonFileLocked(planPath, (data) => {
         if (!data || Array.isArray(data) || typeof data !== 'object') data = {};

package/engine/pipeline.js

@@ -299,11 +299,19 @@ function evaluateCondition(condition, ctx) {
 
   switch (cond.check) {
     case 'runSucceeded': {
-      // True when the current/last run completed with all stages succeeded (none failed)
+      // P-bfa1e finding #21: tightened predicate.
+      // Previously this accepted PENDING as "succeeded" via `s.status === COMPLETED || s.status === PENDING`,
+      // which let `stopWhen`/`stop-pipeline` short-circuit fire while stages were still queued for the next
+      // dispatch cycle. A "succeeded" run is one where:
+      //   1. The run object exists (no run → nothing has succeeded).
+      //   2. At least one stage exists (vacuous-truth empty `.every()` would otherwise lie about success).
+      //   3. EVERY stage is COMPLETED — RUNNING/PENDING/WAITING_HUMAN/PAUSED/FAILED/STOPPED all fail the check.
+      // Any `stopWhen` or condition-stage `stop-pipeline` consumer wired to `runSucceeded` now sees `false`
+      // until the run is fully done, so it cannot prematurely terminate the pipeline.
       if (!run) return false;
-      return Object.values(run.stages || {}).every(
-        s => s.status === PIPELINE_STATUS.COMPLETED || s.status === PIPELINE_STATUS.PENDING
-      );
+      const stages = Object.values(run.stages || {});
+      if (stages.length === 0) return false;
+      return stages.every(s => s && s.status === PIPELINE_STATUS.COMPLETED);
     }
     case 'noFailedItems': {
       // True when all work items created by the pipeline are done (not failed)
@@ -1156,6 +1164,23 @@ async function discoverPipelineWork(config) {
           // Condition stage signaled pipeline stop — complete the run immediately
           if (result._stopPipeline) {
             completeRun(pipeline.id, activeRun.runId, PIPELINE_STATUS.STOPPED);
+            // P-bfa1e finding #24: the local `activeRun` reference still has
+            // `status === RUNNING` because we captured it at L980 before any
+            // completion writes. The post-loop `allComplete` block at L1138
+            // guards with `activeRun.status !== PIPELINE_STATUS.STOPPED`
+            // before re-calling `completeRun(..., COMPLETED)` — if we leave
+            // the stale RUNNING status in place that guard fails and we
+            // clobber the STOPPED status with COMPLETED. Refresh the local
+            // reference from disk so downstream reads in this same tick see
+            // STOPPED. `getActiveRun` excludes terminal runs, so fall back
+            // to a defensive in-place status patch when the refresh comes
+            // back empty.
+            const refreshed = getActiveRun(pipeline.id);
+            if (refreshed) {
+              activeRun = refreshed;
+            } else {
+              activeRun.status = PIPELINE_STATUS.STOPPED;
+            }
             allComplete = true;
             break;
           }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yemi33/minions",
-  "version": "0.1.2080",
+  "version": "0.1.2082",
   "description": "Multi-agent AI dev team that runs from ~/.minions/ — five autonomous agents share a single engine, dashboard, and knowledge base",
   "bin": {
     "minions": "bin/minions.js"