@yemi33/minions 0.1.2144 → 0.1.2146

package/engine/shared.js

@@ -2906,6 +2906,51 @@ function _resetLegacyCcModelMigrationFlag() {
   _legacyCcModelMigrationLogged = false;
 }
 
+/**
+ * One-time force-on for the CC worker pool.
+ *
+ * The pool has been the resolved default for copilot CC since PR #2492
+ * (`resolveCcUseWorkerPool` returns true when the config has no explicit
+ * value). But configs that carried an explicit `ccUseWorkerPool: false` —
+ * set before the default flipped, or copied from an old template — stay
+ * opted out forever. This migration flips those explicit-false opt-outs to
+ * `true` ONCE, on both surfaces the value lives in (`engine.ccUseWorkerPool`
+ * which the resolver reads, and `features.ccUseWorkerPool` which drives the
+ * Settings toggle / `isFeatureOn`), so the two stay consistent.
+ *
+ * Idempotency: records `engine._ccPoolForcedOnV1` after running. Once that
+ * marker is set the migration never touches the value again — so an operator
+ * who *deliberately* turns the pool off afterward is never re-forced. The
+ * marker is persisted even when nothing needed flipping, which is what lets a
+ * later opt-out be distinguished from a never-migrated config.
+ *
+ * Pure + idempotent: safe to call in-memory then re-apply to the on-disk copy
+ * under a lock (mirrors backfillProjectWorkSourceDefaults). Returns
+ * `{ changed, flipped }` — `changed` true means the config was mutated (marker
+ * set and/or values flipped) and should be persisted; `flipped` lists which
+ * surfaces ('engine'/'features') were actually turned on.
+ */
+function applyCcWorkerPoolForceOnMigration(config) {
+  const result = { changed: false, flipped: [] };
+  if (!config || typeof config !== 'object') return result;
+  const engine = (config.engine && typeof config.engine === 'object') ? config.engine : null;
+  if (!engine) return result; // no engine section — retry next start, harmless
+  if (engine._ccPoolForcedOnV1) return result; // already forced once; respect later opt-out
+
+  if (engine.ccUseWorkerPool === false) {
+    engine.ccUseWorkerPool = true;
+    result.flipped.push('engine');
+  }
+  const features = (config.features && typeof config.features === 'object') ? config.features : null;
+  if (features && features.ccUseWorkerPool === false) {
+    features.ccUseWorkerPool = true;
+    result.flipped.push('features');
+  }
+  engine._ccPoolForcedOnV1 = true; // marker — never force again
+  result.changed = true; // marker always needs persisting on first run
+  return result;
+}
+
 // ─── Runtime Config Preflight Warnings ──────────────────────────────────────
 //
 // Emit non-fatal warnings about runtime/CLI configuration drift. Consumed by
@@ -5547,39 +5592,17 @@ function normalizePrLinkItems(value) {
   return [...new Set(items.filter(item => typeof item === 'string' && item))];
 }
 
-/**
- * Single source of truth for "should the engine dispatch review/fix for this PR?"
- *
- * Used by `discoverFromPrs` in engine.js to gate review + fix dispatch, and by
- * `upsertPullRequestRecord` to decide whether to preserve auto-managed metadata
- * on merge. Dispatch-loop callers MUST go through this helper — do NOT inline
- * variants like `knownAgents.has(pr.agent) || pr.prdItems?.length || pr._manual`
- * because they silently drop the `_autoObserve` case (PR linked with
- * autoObserve=true but no prdItems and no configured-agent author) and the
- * sourcePlan/itemType cases. See W-mq5rs2eq000da8a9 for the bug repro.
- *
- * A PR is auto-managed when ANY of the following hold (and `_contextOnly` is
- * not explicitly true — context-only always wins):
- *   - It carries one or more `prdItems` (linked to work items)
- *   - It was explicitly opted-in via `_autoObserve: true` (manual link with
- *     autoObserve, or per-row toggle via POST /api/pull-requests/observe)
- *   - It was created from a plan or has an itemType (`sourcePlan`/`itemType`)
- *   - It has a non-empty agent author other than the literal string `'human'`
- *     (the helper deliberately does NOT require the agent be in
- *     `config.agents` — once `_autoObserve` is the explicit opt-in for
- *     non-agent authors, the loosened agent-string check has no operational
- *     downside for managed flows and avoids the silent-skip bug.)
- *
- * @param {object} pr Pull request record
- * @returns {boolean} true when the engine should drive review/fix for this PR
- */
+// W-mq5s5ttx000j7ab8-a — canonical `contextOnly` gate. The 6-clause legacy
+// body (prdItems / _autoObserve / sourcePlan / itemType / agent-heuristic) is
+// replaced by a single read of the canonical field. The one-shot boot
+// migration (migratePrGateFlags) projects the legacy signals onto
+// `contextOnly` so every on-disk record has the canonical value before any
+// tick fires. Anything new written via upsertPullRequestRecord (and the
+// dashboard link/observe paths consolidated in PR #3137 / `-c`) also lands
+// on `contextOnly` directly. See W-mq5rs2eq000da8a9 for the bug repro that
+// motivated consolidating onto a single helper.
 function isAutoManagedPrRecord(pr) {
-  if (!pr || typeof pr !== 'object' || pr._contextOnly === true) return false;
-  if (normalizePrLinkItems(pr.prdItems).length > 0) return true;
-  if (pr._autoObserve === true) return true;
-  if (pr.sourcePlan || pr.itemType) return true;
-  const agent = String(pr.agent || '').trim().toLowerCase();
-  return !!agent && agent !== 'human';
+  return !!pr && typeof pr === 'object' && pr.contextOnly !== true;
 }
 
 function mergePrLinkItems(links, prId, itemIds) {
@@ -5757,12 +5780,24 @@ function upsertPullRequestRecord(prPath, entry, { project = null, itemId = null,
           target[key] = normalizedEntry[key];
         }
       }
-      for (const key of ['_manual', '_autoObserve', '_context', '_projectResolution']) {
+      // W-mq5s5ttx000j7ab8-a — `_manual` and `_autoObserve` are no longer
+      // copied through; the engine reads gate state from the canonical
+      // `contextOnly` field (see isAutoManagedPrRecord above + the boot
+      // migration migratePrGateFlags). `_context`/`_projectResolution` are
+      // unrelated breadcrumbs and stay.
+      for (const key of ['_context', '_projectResolution']) {
         if (normalizedEntry[key] != null) target[key] = normalizedEntry[key];
       }
-      if (normalizedEntry._contextOnly != null) {
-        const wouldDemoteManagedPr = normalizedEntry._contextOnly === true && targetWasAutoManaged;
-        if (!wouldDemoteManagedPr) target._contextOnly = normalizedEntry._contextOnly;
+      // Accept either the canonical `contextOnly` (preferred) or the legacy
+      // `_contextOnly` from callers that haven't been migrated yet
+      // (dashboard.js manual-link path, lifecycle.js oneShot tagging — items
+      // (b)/(c) of the decomposition). Persist as canonical `contextOnly`.
+      const incomingContextOnly = normalizedEntry.contextOnly != null
+        ? normalizedEntry.contextOnly
+        : normalizedEntry._contextOnly;
+      if (incomingContextOnly != null) {
+        const wouldDemoteManagedPr = incomingContextOnly === true && targetWasAutoManaged;
+        if (!wouldDemoteManagedPr) target.contextOnly = incomingContextOnly === true;
       }
     }
     target.prdItems = normalizePrLinkItems(target.prdItems || []);
@@ -5785,6 +5820,105 @@ function upsertPullRequestRecord(prPath, entry, { project = null, itemId = null,
   return { id: canonicalId, prNumber, created, linked, skipped, record };
 }
 
+// ─── PR Gate Migration (W-mq5s5ttx000j7ab8-a) ───────────────────────────────
+//
+// One-shot boot migration that projects the legacy gate signals
+// (`_contextOnly`, `_autoObserve`, `_manual`) onto the canonical
+// `contextOnly` field on every `projects/<name>/pull-requests.json` record.
+// Wired from `engine/cli.js#start()` before the first tick fires so the new
+// `isAutoManagedPrRecord` (which only reads `contextOnly`) returns the same
+// verdict as the legacy 6-clause helper for pre-existing data.
+//
+// Per-record decision:
+//   1. contextOnly := (_contextOnly === true)
+//   2. legacyManaged := prdItems.length > 0 || _autoObserve === true ||
+//                       sourcePlan || itemType || (agent is a Minions persona)
+//      "Minions persona" = non-empty kebab-case identifier other than 'human'.
+//      Anything with whitespace (human display names like "yemi shin", which
+//      github poller writes into `agent` from `prData.user.login`) is treated
+//      as a human author, not a managed agent.
+//   3. If !contextOnly && !legacyManaged, set contextOnly = true and stamp
+//      `_migrationNote: 'auto-set-contextOnly-by-pr-gate-simplification'`.
+//   4. Persist `contextOnly`; delete `_autoObserve`, `_manual`, `_contextOnly`.
+//
+// Idempotent: records that already have `contextOnly` and none of the legacy
+// keys are skipped (no rewrite, no log line, JSON mtime unchanged).
+const _PR_GATE_MIGRATION_NOTE = 'auto-set-contextOnly-by-pr-gate-simplification';
+const _AGENT_PERSONA_RE = /^[a-z0-9_-]+$/;
+
+function _prRecordHasLegacyGateKey(record) {
+  return Object.prototype.hasOwnProperty.call(record, '_contextOnly')
+    || Object.prototype.hasOwnProperty.call(record, '_autoObserve')
+    || Object.prototype.hasOwnProperty.call(record, '_manual');
+}
+
+function _prRecordIsLegacyManaged(record) {
+  const prdItemsCount = Array.isArray(record.prdItems) ? record.prdItems.length : 0;
+  if (prdItemsCount > 0) return true;
+  if (record._autoObserve === true) return true;
+  if (record.sourcePlan) return true;
+  if (record.itemType) return true;
+  if (typeof record.agent === 'string') {
+    const agent = record.agent.trim().toLowerCase();
+    if (agent && agent !== 'human' && _AGENT_PERSONA_RE.test(agent)) return true;
+  }
+  return false;
+}
+
+function migratePrGateFlags(projectsRoot) {
+  const summary = { projectsScanned: 0, projectsMigrated: 0, totalRecords: 0, totalMigrated: 0 };
+  if (!projectsRoot || typeof projectsRoot !== 'string') return summary;
+  let entries;
+  try {
+    entries = fs.readdirSync(projectsRoot, { withFileTypes: true });
+  } catch {
+    return summary;
+  }
+  for (const entry of entries) {
+    if (!entry.isDirectory()) continue;
+    const projectName = entry.name;
+    const prPath = path.join(projectsRoot, projectName, 'pull-requests.json');
+    if (!fs.existsSync(prPath)) continue;
+    summary.projectsScanned++;
+
+    let migrated = 0;
+    let stamped = 0;
+    let alreadyMigrated = 0;
+
+    mutatePullRequests(prPath, (prs) => {
+      if (!Array.isArray(prs)) return prs;
+      for (const record of prs) {
+        if (!record || typeof record !== 'object') continue;
+        const hasLegacy = _prRecordHasLegacyGateKey(record);
+        const hasCanonical = Object.prototype.hasOwnProperty.call(record, 'contextOnly');
+        if (hasCanonical && !hasLegacy) { alreadyMigrated++; continue; }
+
+        let contextOnly = (record._contextOnly === true);
+        if (!contextOnly && !_prRecordIsLegacyManaged(record)) {
+          contextOnly = true;
+          record._migrationNote = _PR_GATE_MIGRATION_NOTE;
+          stamped++;
+        }
+        record.contextOnly = contextOnly;
+        delete record._autoObserve;
+        delete record._manual;
+        delete record._contextOnly;
+        migrated++;
+      }
+      return prs;
+    });
+
+    summary.totalRecords += (migrated + alreadyMigrated);
+    summary.totalMigrated += migrated;
+    if (migrated > 0) {
+      summary.projectsMigrated++;
+      // One line per project that actually moved. Keep idempotent runs silent.
+      console.log(`[pr-gate-migration] ${projectName}: migrated ${migrated} records (${stamped} stamped contextOnly, ${alreadyMigrated} already-migrated)`);
+    }
+  }
+  return summary;
+}
+
 // ─── Cross-Platform Process Kill Helpers ─────────────────────────────────────
 
 function normalizeKillPid(proc) {
@@ -6442,13 +6576,126 @@ function _purgeReservedFiles(dirPath) {
   }
 }
 
-function removeWorktree(wtPath, gitRoot, worktreeRoot) {
+// ── Live-worktree guard (W-mq5rwwss000f30a7) ─────────────────────────────────
+// Single source of truth for "is some non-terminal dispatch currently using
+// this worktree?" Every code path that wants to wipe / reset / recycle /
+// quarantine a worktree MUST call isWorktreePathLive() first and skip on
+// true. Without this guard the engine has wiped agents mid-task four times
+// in a row (W-mq5n1zx5000hcfb5 post-mortem) by reaping a worktree whose
+// dispatch was still active.
+//
+// Fail-open semantics: when SQLite is unreachable or the query throws, the
+// helper returns true (assume live). Better to leak a worktree than nuke
+// an agent's unpushed work.
+
+function _normalizeWorktreePath(p) {
+  if (!p || typeof p !== 'string') return '';
+  let resolved;
+  try { resolved = path.resolve(p); }
+  catch { return ''; }
+  resolved = resolved.replace(/\\/g, '/').replace(/\/+$/g, '');
+  if (process.platform === 'win32') resolved = resolved.toLowerCase();
+  return resolved;
+}
+
+function isWorktreePathLive(worktreePath, opts = {}) {
+  if (!worktreePath) return false;
+  const target = _normalizeWorktreePath(worktreePath);
+  if (!target) return false;
+  const excludeDispatchId = opts.excludeDispatchId ? String(opts.excludeDispatchId) : null;
+  let db = opts.db || null;
+  if (!db) {
+    try { db = require('./db').getDb(); }
+    catch (e) {
+      log('warn', `isWorktreePathLive: SQL unavailable for ${worktreePath} (${e.message}) — fail-open (assume live)`);
+      return true;
+    }
+  }
+  if (!db) {
+    log('warn', `isWorktreePathLive: no db handle for ${worktreePath} — fail-open (assume live)`);
+    return true;
+  }
+  let rows;
+  try {
+    rows = db.prepare(`
+      SELECT id,
+             json_extract(data, '$.worktreePath') AS top_wt,
+             json_extract(data, '$.meta.worktreePath') AS meta_wt
+      FROM dispatches
+      WHERE status IN ('pending', 'active')
+    `).all();
+  } catch (e) {
+    log('warn', `isWorktreePathLive: query threw for ${worktreePath} (${e.message}) — fail-open (assume live)`);
+    return true;
+  }
+  for (const row of rows || []) {
+    if (excludeDispatchId && String(row.id) === excludeDispatchId) continue;
+    if (row.top_wt && _normalizeWorktreePath(row.top_wt) === target) return true;
+    if (row.meta_wt && _normalizeWorktreePath(row.meta_wt) === target) return true;
+  }
+  return false;
+}
+
+// Drop a deduped inbox note when a wipe site skips due to the live guard so
+// operators can see when the guard fires. Filename is keyed on basename +
+// UTC date — a single skip per worktree per day produces one note; further
+// skips that day silently no-op.
+function _writeWorktreeSkipLiveInboxNote(worktreePath, callerTag) {
+  try {
+    const base = path.basename(String(worktreePath || '').replace(/[\\/]+$/g, '')) || 'unknown';
+    const safeBase = base.replace(/[^a-zA-Z0-9._-]+/g, '-').slice(0, 80);
+    const date = new Date().toISOString().slice(0, 10);
+    const fname = `engine-worktree-skip-live-${safeBase}-${date}.md`;
+    const inboxDir = path.join(MINIONS_DIR, 'notes', 'inbox');
+    try { fs.mkdirSync(inboxDir, { recursive: true }); } catch { /* exists */ }
+    const fpath = path.join(inboxDir, fname);
+    if (fs.existsSync(fpath)) return; // deduped
+    const body = [
+      '---',
+      `id: NOTE-${crypto.randomBytes(8).toString('hex')}`,
+      'agent: engine',
+      `date: ${date}`,
+      '---',
+      '',
+      `# Engine skipped worktree wipe — live dispatch guard fired (W-mq5rwwss000f30a7)`,
+      '',
+      `- caller: ${callerTag || 'unknown'}`,
+      `- worktree: ${worktreePath}`,
+      `- timestamp: ${new Date().toISOString()}`,
+      '',
+      'A non-terminal dispatch row still claims this worktree. The wipe was skipped to',
+      'protect agent state. If this fires repeatedly, inspect engine/state.db dispatches',
+      "table to find which dispatch is stuck claiming the path.",
+      '',
+    ].join('\n');
+    fs.writeFileSync(fpath, body);
+  } catch { /* best-effort — never throw from the skip-note writer */ }
+}
+
+function removeWorktree(wtPath, gitRoot, worktreeRoot, opts = {}) {
   const resolved = path.resolve(wtPath);
   const resolvedRoot = path.resolve(worktreeRoot) + path.sep;
   if (!resolved.startsWith(resolvedRoot)) {
     log('warn', `removeWorktree: refusing to remove ${wtPath} — not under ${worktreeRoot}`);
     return false;
   }
+  // W-mq5rwwss000f30a7 — never wipe a worktree while an agent is actively
+  // dispatched inside it. isWorktreePathLive fails OPEN (returns true) when
+  // the dispatches table is unreachable, so we err on the side of leaking
+  // the worktree rather than destroying agent work.
+  //
+  // PR #3133 review: callers that are themselves the owning dispatch (e.g.
+  // the W-mpbqhstz001lf518 dispatch-end orphan GC, or the pool-return
+  // chain) can pass `excludeDispatchId` so their OWN active row — which
+  // legitimately claims the worktreePath via the pending→active persistence
+  // at engine.js — is ignored by the guard. Any OTHER non-terminal row
+  // still blocks the wipe.
+  const excludeDispatchId = opts && opts.excludeDispatchId ? String(opts.excludeDispatchId) : null;
+  if (isWorktreePathLive(resolved, excludeDispatchId ? { excludeDispatchId } : undefined)) {
+    log('warn', `removeWorktree: skip — live dispatch in ${wtPath}`);
+    _writeWorktreeSkipLiveInboxNote(wtPath, 'shared.removeWorktree');
+    return false;
+  }
   _pruneRemoveWorktreeFailures();
   // Skip paths that failed 3+ times — retry after 1 hour cooldown
   const prior = _removeWorktreeFailures.get(resolved);
@@ -6772,6 +7019,7 @@ module.exports = {
   resolveAgentCli, resolveCcCli, resolveCcUseWorkerPool, resolveAgentModel, resolveCcModel,
   resolveAgentMaxBudget, resolveAgentBareMode,
   applyLegacyCcModelMigration, _resetLegacyCcModelMigrationFlag,
+  applyCcWorkerPoolForceOnMigration,
   runtimeConfigWarnings,
   projectWorkSourceWarnings,
   backfillProjectWorkSourceDefaults,
@@ -6841,6 +7089,8 @@ module.exports = {
   mergePrLinkItems, // exported for testing
   isAutoManagedPrRecord,
   upsertPullRequestRecord,
+  isAutoManagedPrRecord, // W-mq5s5ttx000j7ab8-a — exported for engine + watch-plugin gate consolidation
+  migratePrGateFlags, // W-mq5s5ttx000j7ab8-a — boot migration wired from engine/cli.js
   nextWorkItemId,
   getProjectOrg,
   getAdoOrgBase,
@@ -6893,6 +7143,9 @@ module.exports = {
   listProcessDescendants,
   listProcessReachable,
   removeWorktree,
+  isWorktreePathLive,
+  _normalizeWorktreePath, // exported for testing
+  _writeWorktreeSkipLiveInboxNote, // exported for testing
   _retryFsOp, // exported for testing (W-mq5o6bvy000x7191)
   bumpWorktreeGcMetric, // exported for testing (W-mq5o6bvy000x7191)
   _WORKTREE_RETRYABLE_CODES, // exported for testing (W-mq5o6bvy000x7191)