@yemi33/minions 0.1.2168 → 0.1.2170

package/dashboard.js

@@ -5805,8 +5805,16 @@ const server = http.createServer(async (req, res) => {
       fs.mkdirSync(inboxDir, { recursive: true });
       const today = new Date().toISOString().slice(0, 10);
       const author = body.author || os.userInfo().username;
+      // BUG-H15 / P-h15-traversal: sanitize `author` before composing the
+      // filename. Without slugify, a body like `{ author: "../../escape" }`
+      // collapsed via path.join and wrote outside the inbox directory.
+      // The Origin gate (dashboard.js handleCors above) explicitly allows
+      // missing-Origin requests (curl / CLI tooling), so this sink is
+      // reachable from any local process — including a malicious npm
+      // postinstall or an agent processing an <UNTRUSTED-INPUT> block.
+      const safeAuthor = shared.slugify(author, 40) || 'unknown';
       const slug = shared.slugify(body.title || 'note', 40);
-      const filename = `${author}-${slug}-${today}-${shared.uid().slice(-4)}.md`;
+      const filename = `${safeAuthor}-${slug}-${today}-${shared.uid().slice(-4)}.md`;
       const content = `# ${body.title}\n\n**By:** ${author}\n**Date:** ${today}\n\n${body.what}\n${body.why ? '\n**Why:** ' + body.why + '\n' : ''}`;
       safeWrite(shared.uniquePath(path.join(inboxDir, filename)), content);
       invalidateStatusCache();

package/engine/ado.js

@@ -1057,6 +1057,131 @@ async function forEachActivePr(config, token, callback) {
     }
   }
 
+  // BUG-C2 — Also poll manually-linked ADO PRs from central pull-requests.json.
+  // Mirror of engine/github.js:540-633. Without this block, any ADO PR enrolled
+  // into central pull-requests.json via the dashboard attach UI or
+  // lifecycle.enrollPrFromCanonicalId is never polled (status, build, review,
+  // comments, abandoned-reconciliation all freeze permanently).
+  //
+  // MIRROR-SYMMETRY CONTRACT: any future divergence between
+  // engine/github.js:540-633 and this branch is itself a bug class. The
+  // canonical 'mirror-ado-github-poll-fix' skill applies. Keep filter, gating,
+  // per-PR iteration, and merge-back semantics symmetric.
+  //
+  // Notable host-specific differences vs github.js:
+  //   1. Tick-scoped probe gating uses per-org ADO throttle state (isAdoThrottled
+  //      keyed by orgBase) rather than ghApi('', slug). Rationale: adoFetch throws
+  //      on 404/auth failure (no GH_NOT_FOUND-equivalent sentinel), and an extra
+  //      per-org probe would only burn throttle budget. Throttle skip mirrors the
+  //      same gate used by the project-loop above (lines 991-994).
+  //   2. The project arg is synthesized from parseCanonicalAdoPrId per AC
+  //      option (b) — the existing callbacks at lines 1076 and 1618 dereference
+  //      project.adoProject; tolerate-null would require touching both call sites
+  //      whereas synthesizing keeps the callback contract identical.
+  //   3. The repo-host filter is explicit (repoHost === 'ado') so a future
+  //      central poll that loops over both forks doesn't accidentally treat
+  //      github PRs as ADO records.
+  //   4. Already-configured PRs are skipped (isPrCompatibleWithProject against
+  //      any configured ADO project) so we never double-poll PRs that the
+  //      project loop above already handled.
+  const centralPath = path.join(shared.MINIONS_DIR, 'pull-requests.json');
+  const centralPrs = shared.safeJsonArr(centralPath);
+  const configuredAdoProjects = projects.filter(p => !isGitHubProject(p) && p.adoOrg && p.adoProject);
+  const isConfiguredAdoCanonical = (canonicalId) => {
+    if (!canonicalId) return false;
+    return configuredAdoProjects.some(p => shared.isPrCompatibleWithProject(p, { id: canonicalId }, ''));
+  };
+
+  const activeCentral = centralPrs.filter(pr => {
+    if (!shared.PR_POLLABLE_STATUSES.has(pr.status)) return false;
+    if (String(pr.repoHost || 'ado').toLowerCase() !== 'ado') return false;
+    if (!parseCanonicalAdoPrId(pr.id, 'central ADO PR poll')) return false;
+    if (isConfiguredAdoCanonical(pr.id)) return false;
+    return true;
+  });
+
+  // Per-org throttle probe (mirrors github.js:563-581 slug-probe gating).
+  // Cached per tick (Map cleared each forEachActivePr invocation) so multiple
+  // central PRs sharing one orgBase do a single throttle check.
+  const centralOrgProbes = new Map(); // orgBase → 'ok' | 'throttled'
+  for (const pr of activeCentral) {
+    const parsed = parseCanonicalAdoPrId(pr.id, 'central ADO PR poll');
+    if (!parsed) continue;
+    const orgBase = getAdoOrgBase(parsed);
+    if (centralOrgProbes.has(orgBase)) continue;
+    if (isAdoThrottled(orgBase)) {
+      log('info', `[ado] central PR poll skipped for ${orgBase} — throttled`);
+      centralOrgProbes.set(orgBase, 'throttled');
+    } else {
+      centralOrgProbes.set(orgBase, 'ok');
+    }
+  }
+
+  let centralUpdated = 0;
+  const updatedCentralRecords = [];
+  for (const pr of activeCentral) {
+    const parsed = parseCanonicalAdoPrId(pr.id, 'central ADO PR poll');
+    if (!parsed) continue;
+    const orgBase = getAdoOrgBase(parsed);
+    if (centralOrgProbes.get(orgBase) !== 'ok') continue;
+    const prNum = shared.getPrNumber(pr);
+    if (!prNum) continue;
+
+    // Option (b) per BUG-C2 AC: synthesize a minimal project object from the
+    // parsed canonical id. Mirrors the shape the existing callbacks expect
+    // (project.adoOrg / project.adoProject / project.repoName / project.repositoryId)
+    // so neither pollPrStatus nor pollPrHumanComments needs a tolerate-null branch.
+    const synthesizedProject = {
+      adoOrg: parsed.adoOrg,
+      adoProject: parsed.adoProject,
+      repoName: parsed.repoName,
+      repositoryId: parsed.repositoryId,
+      repoHost: 'ado',
+      prUrlBase: parsed.prUrlBase || '',
+      name: `central:${parsed.adoOrg}/${parsed.adoProject}/${parsed.repoName || parsed.repositoryId || 'unknown'}`,
+      _synthesizedFromCentralPr: true,
+    };
+    const adoRepositoryId = getAdoRepositoryId(synthesizedProject);
+    if (!adoRepositoryId) {
+      log('warn', `[ado] central PR ${pr.id}: cannot resolve adoRepositoryId from canonical id — skipping`);
+      continue;
+    }
+
+    try {
+      const before = shared.snapshotPrRecord(pr);
+      const updated = await callback(synthesizedProject, pr, prNum, orgBase, adoRepositoryId);
+      if (updated) {
+        centralUpdated++;
+        updatedCentralRecords.push({ before, after: shared.snapshotPrRecord(pr) });
+      }
+    } catch (err) {
+      log('warn', `ADO: failed to poll central PR ${pr.id}: ${err.message}`);
+    }
+  }
+
+  if (centralUpdated > 0) {
+    mutateJsonFileLocked(centralPath, (currentPrs) => {
+      for (const { before, after } of updatedCentralRecords) {
+        const idx = currentPrs.findIndex(p => p.id === after.id);
+        if (idx >= 0) {
+          // Never downgrade reviewStatus from 'approved' — permanent terminal state
+          // (mirrors project-loop guard at lines 1038-1040).
+          if (currentPrs[idx].reviewStatus === REVIEW_STATUS.APPROVED && after.reviewStatus !== REVIEW_STATUS.APPROVED) {
+            after.reviewStatus = REVIEW_STATUS.APPROVED;
+          }
+          // Never downgrade status from 'merged' — permanent terminal state
+          // (mirrors github.js:634-636 central merged-status guard).
+          if (currentPrs[idx].status === PR_STATUS.MERGED && after.status !== PR_STATUS.MERGED) {
+            after.status = PR_STATUS.MERGED;
+          }
+          shared.applyPrFieldDelta(currentPrs[idx], before, after);
+        }
+      }
+      return currentPrs;
+    }, { defaultValue: [] });
+    totalUpdated += centralUpdated;
+  }
+
   return totalUpdated;
 }
 
@@ -2603,6 +2728,7 @@ async function reconcileAbandonedPrs(config) {
 module.exports = {
   getAdoToken,
   adoFetch,
+  forEachActivePr, // BUG-C2 — exported for central-PR mirror-symmetry tests
   pollPrStatus,
   pollPrHumanComments,
   reconcilePrs,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yemi33/minions",
-  "version": "0.1.2168",
+  "version": "0.1.2170",
   "description": "Multi-agent AI dev team that runs from ~/.minions/ — five autonomous agents share a single engine, dashboard, and knowledge base",
   "bin": {
     "minions": "bin/minions.js"