@yemi33/minions 0.1.2177 → 0.1.2178

package/engine/shared.js

@@ -2369,9 +2369,31 @@ const ENGINE_DEFAULTS = {
   autoFixConflicts: true, // auto-dispatch fix agents when a PR has merge conflicts
   autoFixBuilds: true, // auto-dispatch fix agents when a PR build fails
   autoReviewPrs: true, // auto-dispatch review agents for newly opened agent PRs
+  // P-a1f3c2d4 — hard-stop polling kill-switch / master override. When true,
+  // section 2.6 (pollPrStatus) and 2.7 (pollPrHumanComments) skip both
+  // providers regardless of adoPollEnabled / ghPollEnabled, and
+  // discoverFromPrs treats pollEnabled as false for every project so the
+  // downstream auto-dispatch gates (autoFixBuilds / autoFixConflicts /
+  // autoReviewPrs / autoFixReviewFeedback / autoFixHumanComments) all
+  // become inert. Default false so a fresh install behaves identically to
+  // before this knob existed. Flip via Dashboard → Settings → Polling, or
+  // set `engine.pollingPaused: true` in config.json. Reconciliation still
+  // runs (it's a recovery sweep, not a convenience poll) — see section 2.7.
+  pollingPaused: false, // hard-stop kill-switch / master override (see comment above)
   autoReReviewPrs: true, // auto-dispatch review agents after a PR fix is pushed
   autoFixReviewFeedback: true, // auto-dispatch fix agents for minions review changes-requested verdicts
   autoFixHumanComments: true, // auto-dispatch fix agents for actionable human PR comments
+  // P-b2e5d8c7 — hard-stop auto-fix kill-switch / master override. When true,
+  // discoverFromPrs treats every auto-fix gate (autoFixBuilds /
+  // autoFixConflicts / autoFixReviewFeedback / autoFixHumanComments) as false
+  // for every project, so no fix agent is auto-dispatched against any PR.
+  // Review polling, review dispatch (autoReviewPrs / autoReReviewPrs), and
+  // reconciliation are intentionally NOT gated — operators can pause the
+  // fix-storm during an incident while still seeing fresh PR status and
+  // review verdicts. Default false so a fresh install behaves identically
+  // to before this knob existed. Flip via Dashboard → Settings → Auto-fix
+  // & Review Loop, or set `engine.autoFixPaused: true` in config.json.
+  autoFixPaused: false, // hard-stop kill-switch / master override (see comment above)
   autoConsolidateMemory: false, // opt-in: periodically spawn engine/kb-sweep-runner.js from the tick loop (4h cadence). Inbox→notes consolidation already runs every tick via consolidateInbox; this flag only controls the KB sweep.
   prNoOpFixPauseAttempts: 2, // pause one PR automation cause after repeated no-op fixes for unchanged evidence
   quarantineAutoRecoveryMax: 2, // #2996 follow-up: cap on auto-flipping WORKTREE_DIRTY/WORKTREE_DIVERGENT failures back to pending (the quarantine is self-healing so the next dispatch starts clean; the cap prevents infinite loops if quarantine itself keeps failing).
@@ -2468,6 +2490,39 @@ const ENGINE_DEFAULTS = {
   maxBuildFixRetries: 3,
   adoPollEnabled: true, // poll ADO PR status, comments, and reconciliation on each tick cycle
   ghPollEnabled: true, // poll GitHub PR status, comments, and reconciliation on each tick cycle
+  // P-c4d8e1a3 — granular per-poller flags for the 6 PR-poll axes + rebase
+  // processor. Each one defaults true and silently inherits a `false` from
+  // its legacy bundle macro (adoPollEnabled / ghPollEnabled) for backward
+  // compat, so existing config.json knobs keep working. New behavior:
+  // setting `adoPollEnabled: false` (or `ghPollEnabled: false`) alone now
+  // also silences the matching reconcile sweep — operators who want the
+  // recovery sweep back must explicitly set `adoPrReconcileEnabled: true`
+  // (or `ghPrReconcileEnabled: true`). processPendingRebasesEnabled has no
+  // legacy counterpart; the rebase processor was previously ungated. See
+  // shared.resolvePollFlag for the resolution order and the per-axis
+  // surfaces in engine.js section 2.6 / 2.7.
+  adoPrStatusPollEnabled: true,
+  adoPrCommentsPollEnabled: true,
+  adoPrReconcileEnabled: true,
+  ghPrStatusPollEnabled: true,
+  ghPrCommentsPollEnabled: true,
+  ghPrReconcileEnabled: true,
+  processPendingRebasesEnabled: true,
+  // P-d6f0a2b5 — granular work-discovery flags. Each one gates a single
+  // discovery phase inside `engine.discoverWork()`. Default true so the
+  // out-of-box tick behaviour is unchanged; flip OFF via
+  // `config.engine.<flag>` to silence a single discovery source without
+  // touching the per-project `project.workSources.*.enabled` toggles
+  // (those keep composing independently inside the matching discoverFrom*
+  // helper — a `false` at either level skips the call). Wired inline as
+  // `config.engine?.<flag> !== false` at each call site —
+  // shared.resolvePollFlag is intentionally NOT used here because no
+  // legacy macro bundle ever covered these phases.
+  prDiscoveryEnabled: true,             // discoverFromPrs (per-project PR-driven fix/review/test discovery)
+  workItemsDiscoveryEnabled: true,      // discoverFromWorkItems (per-project work-items.json scan)
+  centralWorkDiscoveryEnabled: true,    // discoverCentralWorkItems (top-level work-items.json scan)
+  scheduledWorkDiscoveryEnabled: true,  // discoverScheduledWork (cron-style scheduled tasks + meetings)
+  planMaterializationEnabled: true,     // reconcilePrdStatuses + materializePlansAsWorkItems pair
   prPollStatusEvery: 72,   // poll PR build/review/merge status every N ticks for both ADO and GitHub (~12 min at default 10s tick)
   prPollCommentsEvery: 72, // poll PR human comments every N ticks for both ADO and GitHub (~12 min at default 10s tick)
   // W-mpxpckey000laa4f: lifted inline tick-counter literals to named constants
@@ -2522,6 +2577,26 @@ const ENGINE_DEFAULTS = {
   agentBusyReassignMs: 600000, // 10min — reassign work item to another agent if preferred agent is busy beyond this threshold
   ccEffort: null, // effort level for CC/doc-chat (null, 'low', 'medium', 'high')
   enablePreDispatchEval: true, // P-d2a9f6e5: cheap LLM gate before queueing — on by default. See engine/pre-dispatch-eval.js (Ripley §3 recommendation, 2026-05-11 architecture review). Validates from acceptance_criteria when present, falls back to description when criteria are absent but description is rich (≥80 chars). Fail-open on any validator error.
+  // W-mq9acoo800177bcb — bounded-concurrency for the pre-dispatch validator. The
+  // discoverWork loop in engine.js used to run validateAcceptanceCriteria
+  // sequentially, costing ~25-30s per item × N items per tick (an 11-item
+  // approved PRD took ~5 min to queue). This caps the parallel LLM calls per
+  // tick — 6 is a balance between LLM-provider concurrency tolerance and not
+  // starving the rest of the tick budget. Clamped to [1, 20] in
+  // dashboard.js#handleSettingsUpdate; engine.js#resolvePreDispatchEvalConcurrency
+  // applies the same clamp at read time so a hand-edited config can't bypass it.
+  preDispatchEvalConcurrency: 6,
+  // W-mq9acoo800177bcb — short-circuit the validator for items materialized
+  // from an approved/active PRD. plan-to-prd already LLM-vets every item that
+  // lands in a PRD, so re-validating each item per discovery tick is the
+  // dominant cost of the workflow that triggered this optimization (user-
+  // observed: 2 PRDs / 11 items → ~5 min queueing). Items keep the
+  // `_preDispatchEvalSkipped: 'prd-sourced'` marker on their dispatch entry for
+  // observability. The bypass fires only when item.meta.item.sourcePlan is set
+  // AND the parent PRD's status is approved/active; rejected/paused/revision-
+  // requested/completed PRDs still flow through the normal validator path so a
+  // stale PRD reopen can't smuggle in unvetted items.
+  preDispatchEvalSkipPrdSourced: true,
   completionNonceRequired: false, // P-d2a8f6c1 (agent trust boundary F8): when true, a missing `nonce` field in the completion JSON hard-fails the dispatch with failure_class:'completion-nonce-mismatch'. Default false for one release so older agents/runtime caches that haven't picked up the prompt change degrade with a warning instead of breaking. Mismatched nonces hard-fail regardless of this flag. See docs/completion-reports.md → "Trust boundary".
   autoApplyReviewVote: false, // W-mpea9fyb0010febf / P-f7splitgate: gates POSITIVE auto-actions only — when true, the engine mirrors live platform vote state into local pull-requests.json reviewStatus (so platform-side approves auto-promote local status). When false (default), the verdict is recorded in pull-requests.json reviewStatus from the agent's completion only — informational. NEGATIVE-correction (dismissing the engine's own prior REQUEST_CHANGES / resetting its own prior negative ADO vote on a verdict flip to APPROVE) is correctness and runs UNCONDITIONALLY regardless of this flag.
 
@@ -2541,6 +2616,20 @@ const ENGINE_DEFAULTS = {
   copilotSuppressAgentsMd: true,     // Copilot --no-custom-instructions: stop AGENTS.md auto-load from fighting Minions playbook prompts
   copilotStreamMode: 'on',           // Copilot --stream <on|off>: 'on' streams assistant.message_delta events live; 'off' batches them
   copilotReasoningSummaries: false,  // Copilot --enable-reasoning-summaries (Anthropic-family models only)
+  // P-mcp-storm — Copilot loads `~/.copilot/mcp-config.json` (the operator's
+  // user-scope MCP servers) UNCONDITIONALLY on every process start: it is NOT
+  // gated by `--add-dir`, cwd, or `hermeticHarness` (proven empirically — a
+  // copilot spawned from a neutral dir with no `--add-dir ~/.copilot` still
+  // connects every server). So every spawned Copilot agent boots the operator's
+  // full interactive MCP stack; on Windows each `type:local`/`stdio` server
+  // (e.g. playwright, maestro) launches its own visible console window and
+  // playwright opens browser tabs. The only lever Copilot exposes is
+  // `--disable-mcp-server <name>` (repeatable). This list names the servers the
+  // engine disables for autonomous agent dispatches. Default [] = inherit ALL
+  // (no behavior change). Per-agent override `agent.copilotAgentDisabledMcpServers`.
+  // Resolved through `shared.resolveCopilotAgentDisabledMcpServers(agent, engine)`.
+  // NOTE: `hermeticHarness` does NOT suppress these (it only strips `--add-dir`).
+  copilotAgentDisabledMcpServers: [],
   ccUseWorkerPool: false,            // Sub-task C of W-mp2w003600196c51 (CC perf): when true AND CC runtime is copilot, _invokeCcStream routes through engine/cc-worker-pool.js (persistent `copilot --acp` per CC tab) instead of spawning a fresh CLI per turn. Off by default — opt-in feature flag. **Structurally copilot-only**: the pool spawns `copilot --acp` (Agent Client Protocol); Claude Code does not implement ACP, so resolveCcUseWorkerPool returns false on non-copilot CC runtimes even with explicit-true (W-mphlriic00095f69 — prevents silent runtime switch). Engine/agent dispatch path stays per-process regardless.
   maxBudgetUsd: undefined,       // fleet USD ceiling for --max-budget-usd (per-agent override: agents.<id>.maxBudgetUsd). Honors 0 via ?? so a literal cap of $0 works
   disableModelDiscovery: false,  // skip runtime.listModels() REST calls fleet-wide (settings UI falls back to free-text)
@@ -2770,6 +2859,31 @@ const ENGINE_DEFAULTS = {
   operatorLogin: null,
 };
 
+// ── P-c4d8e1a3: granular per-poller flag resolution ──────────────────────────
+//
+// Helper for the 6 PR-poll axes + processPendingRebases. Each axis has a
+// granular `*Enabled` flag in ENGINE_DEFAULTS (default true) plus an
+// optional legacy bundle macro (`adoPollEnabled` / `ghPollEnabled`) that
+// silences the matching ADO/GitHub trio when set to false. Resolution
+// order, in priority:
+//
+//   1. granular key explicitly present on engineCfg  → use it
+//   2. legacyMacroKey is set on engineCfg AND === false → false
+//      (legacy users keep working — and now reconcile is silenced too)
+//   3. fall through to ENGINE_DEFAULTS[granularKey]   (default true)
+//
+// legacyMacroKey may be `null` for axes that have no legacy counterpart
+// (today: processPendingRebasesEnabled).
+function resolvePollFlag(engineCfg, granularKey, legacyMacroKey) {
+  if (engineCfg && Object.prototype.hasOwnProperty.call(engineCfg, granularKey)) {
+    return engineCfg[granularKey] !== false;
+  }
+  if (legacyMacroKey && engineCfg && engineCfg[legacyMacroKey] === false) {
+    return false;
+  }
+  return ENGINE_DEFAULTS[granularKey] !== false;
+}
+
 // ─── Runtime Fleet Resolution (P-3b8e5f1d) ──────────────────────────────────
 //
 // Six helpers that are the single source of truth for "which CLI runtime + model
@@ -2921,6 +3035,36 @@ function resolveAgentBareMode(agent, engine) {
   return false;
 }
 
+// P-mcp-storm — Resolve the list of MCP server names to disable for spawned
+// Copilot agents (emitted as `--disable-mcp-server <name>`). Chain: per-agent
+// `agent.copilotAgentDisabledMcpServers` → `engine.copilotAgentDisabledMcpServers`
+// → `[]` (inherit all). Tolerant of either an array OR a comma/whitespace-
+// separated string (Settings UI / `MINIONS_*` env deliver strings). Always
+// returns a deduped array of trimmed, non-empty strings. See ENGINE_DEFAULTS
+// for why this exists (Copilot loads ~/.copilot MCP config unconditionally;
+// `hermeticHarness` does NOT suppress it).
+function _normalizeMcpServerList(v) {
+  if (v == null) return null;
+  const raw = Array.isArray(v) ? v : String(v).split(/[\s,]+/);
+  const out = [];
+  const seen = new Set();
+  for (const item of raw) {
+    const name = String(item == null ? '' : item).trim();
+    if (!name || seen.has(name)) continue;
+    seen.add(name);
+    out.push(name);
+  }
+  return out;
+}
+
+function resolveCopilotAgentDisabledMcpServers(agent, engine) {
+  const a = agent ? _normalizeMcpServerList(agent.copilotAgentDisabledMcpServers) : null;
+  if (a) return a;
+  const e = engine ? _normalizeMcpServerList(engine.copilotAgentDisabledMcpServers) : null;
+  if (e) return e;
+  return [];
+}
+
 // ─── Legacy ccModel → defaultModel Migration ─────────────────────────────────
 //
 // Pre-P-3b8e5f1d, `engine.ccModel` was the single fleet-wide model knob (it
@@ -3704,6 +3848,49 @@ function extractPlanDeclaredProject(planContent) {
   }
   return '';
 }
+
+// P-7a3f1c08: Parse a cross-repo plan's list of target projects.
+// Primary signal: `<!-- minions:targetProjects=a, b, c -->` HTML comment.
+// Fallback (human): `**Projects:** a, b | c` markdown line in the first 80 lines.
+// Both forms accept `,`, `|`, or `;` as separators with surrounding whitespace.
+// Returns string[] of trimmed project names (empty array when nothing parseable).
+function extractPlanTargetProjects(planContent) {
+  if (typeof planContent !== 'string' || !planContent.trim()) return [];
+
+  const split = (raw) => {
+    if (typeof raw !== 'string') return [];
+    return raw
+      .split(/[,|;]/)
+      .map(s => s.trim().replace(/^["'`]+|["'`]+$/g, '').trim())
+      .filter(Boolean);
+  };
+
+  // Primary signal: structured HTML comment marker (case-insensitive on the key).
+  const markerMatch = planContent.match(/<!--\s*minions:targetProjects\s*=\s*([^>]*?)\s*-->/i);
+  if (markerMatch) {
+    const parsed = split(markerMatch[1]);
+    if (parsed.length > 0) return parsed;
+  }
+
+  // Fallback signal: human-readable plural `Projects:` line — distinct from the
+  // singular `Project:` line consumed by extractPlanDeclaredProject. Scan the
+  // first 80 lines, matching the same leading-bullet / bold-markdown tolerance.
+  const lines = planContent.split(/\r?\n/).slice(0, 80);
+  for (const rawLine of lines) {
+    const line = rawLine
+      .replace(/^\s*[-*]\s+/, '')
+      .replace(/\*\*/g, '')
+      .trim();
+    const match = line.match(/^Projects\s*:\s*(.+)$/i);
+    if (!match) continue;
+    let value = match[1].trim();
+    value = value.replace(/\s+#.*$/, '').trim();
+    const parsed = split(value);
+    if (parsed.length > 0) return parsed;
+  }
+
+  return [];
+}
 const DISPATCH_RESULT = { SUCCESS: 'success', ERROR: 'error', TIMEOUT: 'timeout' };
 const PIPELINE_STATUS = {
   PENDING: 'pending', RUNNING: 'running', COMPLETED: 'completed',
@@ -7504,14 +7691,16 @@ module.exports = {
   KB_READABLE_CATEGORIES,
   classifyInboxItem,
   ENGINE_DEFAULTS,
+  resolvePollFlag, // P-c4d8e1a3 — granular per-poller flag resolution
   resolveAgentCli, resolveCcCli, resolveCcUseWorkerPool, resolveAgentModel, resolveCcModel,
   resolveAgentMaxBudget, resolveAgentBareMode,
+  resolveCopilotAgentDisabledMcpServers,
   applyLegacyCcModelMigration, _resetLegacyCcModelMigrationFlag,
   applyCcWorkerPoolForceOnMigration,
   runtimeConfigWarnings,
   projectWorkSourceWarnings,
   backfillProjectWorkSourceDefaults,
-  WI_STATUS, DONE_STATUSES, PLAN_TERMINAL_STATUSES, WORK_TYPE, WORKTREE_REQUIRING_TYPES, VALID_WORK_TYPES, resolveWorkItemTypeFromPrdItem, PLAN_STATUS, PRD_ITEM_STATUS, PRD_MATERIALIZABLE, PR_STATUS, PR_POLLABLE_STATUSES, PR_PENDING_REASON, BUILD_STATUS, REVIEW_STATUS, FETCH_TIMEOUT_MS, RETRY_DELAY_MS, ADO_TOKEN_REFRESH_MAX_RETRIES, DISPATCH_RESULT, mutateMetrics, mutateWatches, mutateScheduleRuns, mutatePipelineRuns, mutateManagedProcesses, mutateWorktreePool, mutateQaRuns, mutateQaSessions, trackReviewMetric, queuePlanToPrd, extractPlanDeclaredProject,
+  WI_STATUS, DONE_STATUSES, PLAN_TERMINAL_STATUSES, WORK_TYPE, WORKTREE_REQUIRING_TYPES, VALID_WORK_TYPES, resolveWorkItemTypeFromPrdItem, PLAN_STATUS, PRD_ITEM_STATUS, PRD_MATERIALIZABLE, PR_STATUS, PR_POLLABLE_STATUSES, PR_PENDING_REASON, BUILD_STATUS, REVIEW_STATUS, FETCH_TIMEOUT_MS, RETRY_DELAY_MS, ADO_TOKEN_REFRESH_MAX_RETRIES, DISPATCH_RESULT, mutateMetrics, mutateWatches, mutateScheduleRuns, mutatePipelineRuns, mutateManagedProcesses, mutateWorktreePool, mutateQaRuns, mutateQaSessions, trackReviewMetric, queuePlanToPrd, extractPlanDeclaredProject, extractPlanTargetProjects,
   WATCH_STATUS, WATCH_TARGET_TYPE, WATCH_CONDITION, WATCH_ABSOLUTE_CONDITIONS, WATCH_ACTION_TYPE,
   WATCH_STALLED_DEFAULT_TICKS, WATCH_STUCK_STAGE_DEFAULT_TICKS,
   PIPELINE_STATUS, STAGE_TYPE, MEETING_STATUS, AGENT_STATUS,