@yemi33/minions 0.1.2177 → 0.1.2179

package/dashboard.js

@@ -43,6 +43,7 @@ const steeringStore = require('./engine/steering-store');
 const projectDiscovery = require('./engine/project-discovery');
 const features = require('./engine/features');
 const ccWorkerPool = require('./engine/cc-worker-pool');
+const diagnosticsMemory = require('./engine/diagnostics-memory');
 const os = require('os');
 
 const { safeRead, safeReadOrNull, safeReadDir, safeWrite, safeJson, safeJsonObj, safeJsonArr, safeJsonNoRestore, safeUnlink, mutateJsonFileLocked, mutateTextFileLocked, mutateControl, mutateCooldowns, mutateWorkItems, getProjects: _getProjects, DONE_STATUSES, WI_STATUS, WORK_TYPE, WORKTREE_REQUIRING_TYPES, reopenWorkItem } = shared;
@@ -104,6 +105,75 @@ const KB_PINS_PATH = shared.PINNED_ITEMS_PATH;
 const DASHBOARD_BROWSER_PRESENCE_PATH = path.join(ENGINE_DIR, 'dashboard-browser.json');
 const DASHBOARD_BROWSER_PRESENCE_MAX_AGE_MS = 45000;
 
+// P-c3d4e5f6 — diagnostics-memory dashboard surface.
+// The engine writes its latest sample to engine/diagnostics-memory.json on
+// every memoryBaselineEveryTicks ticks; the dashboard reads it for
+// /api/diagnostics/memory and accumulates polled engine samples into its
+// own ring buffer (separate from diagnosticsMemory's own dashboard-self
+// buffer) for /api/diagnostics/memory/history?process=engine. Both rings
+// are in-process — restarting the dashboard zeroes them.
+const DIAGNOSTICS_MEMORY_SIDECAR_PATH = path.join(ENGINE_DIR, 'diagnostics-memory.json');
+const DIAGNOSTICS_MEMORY_STALE_MS = 5 * 60 * 1000;
+const DIAGNOSTICS_MEMORY_SAMPLE_INTERVAL_MS = 60000;
+const DIAGNOSTICS_MEMORY_ENGINE_RING_CAP = 1440;
+const _engineMemoryRing = [];
+let _lastEngineSampleCapturedAt = 0;
+let _memorySamplerStop = null;
+
+// Pure: assemble the /api/diagnostics/memory payload from already-read
+// inputs. Exported for direct unit testing — handler callers feed it the
+// live dashboard sample + the sidecar contents + Date.now().
+function _buildMemoryDiagnostics({ dashboardSample, engineSample, now } = {}) {
+  const _now = Number.isFinite(now) ? now : Date.now();
+  const dashboard = dashboardSample && typeof dashboardSample === 'object' ? dashboardSample : null;
+  // engineSample may be the literal object from the sidecar OR null/{} when
+  // the sidecar is missing/unparseable. Treat anything without a finite
+  // capturedAt as stale (covers both "file missing" and "ancient sample").
+  let engine = null;
+  let engineStale = true;
+  if (engineSample && typeof engineSample === 'object' && Number.isFinite(engineSample.capturedAt)) {
+    engine = engineSample;
+    engineStale = (_now - engineSample.capturedAt) > DIAGNOSTICS_MEMORY_STALE_MS;
+  }
+  return { dashboard, engine, engineStale };
+}
+
+// Pure: slice the requested ring buffer. Returns up to `limit` newest
+// samples (oldest first). `limit` defaults to the full buffer when missing
+// or non-positive (matches diagnosticsMemory.getHistory semantics).
+function _buildMemoryHistory({ ring, limit } = {}) {
+  if (!Array.isArray(ring)) return [];
+  const n = ring.length;
+  if (!Number.isInteger(limit) || limit <= 0 || limit >= n) return ring.slice();
+  return ring.slice(n - limit);
+}
+
+// Read the engine sidecar and, when it carries a never-seen-before
+// capturedAt, push it onto the engine-side ring buffer. Dedup is by
+// capturedAt so re-reads between engine baseline ticks don't bloat the
+// ring. Best-effort: any failure leaves the ring untouched.
+function _pollAndAccumulateEngineSample() {
+  let sample;
+  try { sample = safeJsonObj(DIAGNOSTICS_MEMORY_SIDECAR_PATH); }
+  catch { return; }
+  if (!sample || typeof sample !== 'object') return;
+  if (!Number.isFinite(sample.capturedAt)) return;
+  if (sample.capturedAt === _lastEngineSampleCapturedAt) return;
+  _lastEngineSampleCapturedAt = sample.capturedAt;
+  _engineMemoryRing.push(sample);
+  while (_engineMemoryRing.length > DIAGNOSTICS_MEMORY_ENGINE_RING_CAP) _engineMemoryRing.shift();
+}
+
+function _resetDiagnosticsMemoryForTesting() {
+  _engineMemoryRing.length = 0;
+  _lastEngineSampleCapturedAt = 0;
+  if (_memorySamplerStop) {
+    try { _memorySamplerStop(); } catch { /* ignore */ }
+    _memorySamplerStop = null;
+  }
+  try { diagnosticsMemory._resetForTest(); } catch { /* ignore */ }
+}
+
 function ensureConfiguredProjectStateFiles() {
   for (const p of PROJECTS) {
     const root = p.localPath ? path.resolve(p.localPath) : null;
@@ -182,6 +252,27 @@ function mutateDashboardConfig(mutator) {
   }, { defaultValue: { projects: [], agents: {}, engine: {} }, skipWriteIfUnchanged: true });
 }
 
+// P-f3c9d0e7 — shared body for the four convenience pause/resume endpoints
+// (`/api/engine/polling/{pause,resume}` and `/api/engine/auto-fix/{pause,resume}`).
+// Persists `config.engine[key] = paused`, busts the in-memory CONFIG so the
+// dashboard sees the new value immediately, invalidates the status cache so
+// the SPA's next poll picks it up, and replies `{ paused, at: <iso> }` per
+// the plan's wire contract. Idempotent — repeating the same call writes the
+// same value (mutateDashboardConfig short-circuits when unchanged) and
+// returns the same shape.
+function _setEnginePauseFlag(res, key, paused) {
+  mutateDashboardConfig(config => {
+    if (!config.engine || typeof config.engine !== 'object' || Array.isArray(config.engine)) {
+      config.engine = {};
+    }
+    config.engine[key] = paused;
+    return config;
+  });
+  reloadConfig();
+  invalidateStatusCache();
+  return jsonReply(res, 200, { paused, at: new Date().toISOString() });
+}
+
 function mergeSettingsConfigUpdate(current, candidate, body, patch = {}) {
   if (!current || typeof current !== 'object' || Array.isArray(current)) current = {};
   if (body.engine) {
@@ -366,6 +457,25 @@ function inferActionPrRecord(action, prs, project = null) {
 }
 
 function copyWorkItemPrFields(item, input, pr = null) {
+  // W-mqbaby2a000pa8ee: Gate the LOOSE description/title scan in
+  // `shared.extractWorkItemPrRef` on `type: "fix"`. Without this gate,
+  // an implement/explore/test WI that merely mentions an existing PR
+  // in prose ("Class bug surfaced today on pull request 130") gets
+  // `targetPr` / `pr_id` / `prNumber` stamped, the engine then treats
+  // the WI as a fix against that PR, the PR-branch lookup fails, and
+  // the dispatch silently skips with `_pendingReason: null` forever.
+  //
+  // Structured PR pointers (`targetPr` / `pr_id` / `prUrl` / `prNumber` /
+  // `references[].url` / `meta.pr_followup.parent_pr_url`) are explicit
+  // operator intent — they stamp on EVERY type. An explicit `pr` record
+  // (caller already resolved the PR) also bypasses the gate. Only the
+  // last-resort description/title regex scan is type-gated.
+  if (!pr) {
+    const structuredRef = shared.extractStructuredWorkItemPrRef(input);
+    if (!structuredRef && String(item?.type || '').toLowerCase() !== WORK_TYPE.FIX) {
+      return;
+    }
+  }
   const prRef = getWorkItemPrRef(input);
   if (!prRef && !pr) return;
   const prNumber = pr ? shared.getPrNumber(pr) : shared.getPrNumber(prRef);
@@ -1907,6 +2017,11 @@ function _buildStatusFastState() {
         && hbAge > ENGINE_HEARTBEAT_STALE_MS
         && tickAge > tickStaleThresholdMs),
       tickInterval: tickInterval,
+      // P-g7a2b4c5 — surface the two operator kill-switches on every status
+      // payload so the cross-page sticky banner can render without a second
+      // round-trip. Both default to false when unset in config.engine.
+      pollingPaused: !!CONFIG?.engine?.pollingPaused,
+      autoFixPaused: !!CONFIG?.engine?.autoFixPaused,
     },
     adoThrottle: ado.getAdoThrottleState(),
     ghThrottle: gh.getGhThrottleState(),
@@ -1932,6 +2047,7 @@ function _buildStatusSlowState() {
       const branchMismatch = !!(mainBranch && status.remoteDefaultBranch && mainBranch !== status.remoteDefaultBranch);
       return {
         name: p.name,
+        displayName: shared.projectDisplayName(p),
         path: p.localPath,
         description: p.description || '',
         ...status,
@@ -3471,13 +3587,25 @@ function getWorkItemPrRef(input) {
   // the dispatch to the existing PR branch instead of a fresh `work/<wi-id>`
   // parallel branch (issue #2999 / W-mpx6i5kh000ac040).
   //
-  // ASYMMETRY (W-mq18ec6h000p7b87): the engine's pr_not_found *gate* uses
-  // the strict `shared.extractStructuredWorkItemPrRef` — gate uses
-  // structured-only; stamp uses loose. Rationale: operators creating fix
-  // WIs via API often paste the PR URL in description prose and expect
-  // `targetPr` to get auto-stamped here (best-effort, reversible). The gate
-  // blocks dispatch and must require explicit operator intent (a structured
-  // field) before doing so.
+  // STRUCTURED-vs-LOOSE SPLIT (W-mq18ec6h000p7b87): two extractors exist —
+  //   - `shared.extractStructuredWorkItemPrRef`: structured fields +
+  //     `references[].url` + `meta.pr_followup.parent_pr_url`. NO scan.
+  //   - `shared.extractWorkItemPrRef` (this helper): structured walk + a
+  //     last-resort first-paragraph/title scan.
+  // The engine's `pr_not_found` dispatch gate uses the structured-only
+  // variant. The original design intent was that the stamp path could
+  // afford to be loose because gating would still require explicit
+  // operator intent.
+  //
+  // FIX-TYPE GATE on the stamp path (W-mqbaby2a000pa8ee): in practice
+  // the asymmetry leaked — the loose stamp writes to `item.pr_id` (a
+  // canonical structured field), and the strict gate later reads
+  // `item.pr_id` and sees the loose stamp AS IF it were structured
+  // intent. To stop that leak without changing the loose detector
+  // (which has other legitimate callers), `copyWorkItemPrFields` now
+  // gates the loose result on `item.type === "fix"`. Non-fix WIs only
+  // get stamped from structured fields (incl. references/follow-up).
+  // See the comment block on `copyWorkItemPrFields` above for details.
   return shared.extractWorkItemPrRef(input);
 }
 
@@ -6700,9 +6828,50 @@ const server = http.createServer(async (req, res) => {
           try {
             const plan = JSON.parse(content);
             const status = plan.status || 'active';
+            // W-mqacrzis0003df4a Bug 2 — fresh staleness from plans/*.md mtime.
+            // plan.planStale lags by an engine tick; stat the source plan here
+            // so the Plans tab does not silently mirror a stale-but-cached false.
+            let freshStale = false;
+            if (!archived && plan.source_plan) {
+              try {
+                const sourceMtime = Math.floor(fs.statSync(path.join(PLANS_DIR, plan.source_plan)).mtimeMs);
+                const recorded = plan.sourcePlanModifiedAt ? new Date(plan.sourcePlanModifiedAt).getTime() : null;
+                if (recorded && sourceMtime > recorded) freshStale = true;
+              } catch { /* source plan may have been deleted/renamed */ }
+            }
+            // P-e8d49105 — _projects rollup feeds the plan-card multi-badge
+            // path in dashboard/js/render-plans.js. For PRD JSONs, walk
+            // missing_features[].project (order-preserving dedup) and fall
+            // back to plan.project for items that omit it. Single-project
+            // plans collapse to a single-element array, identical to today's
+            // single `p.project` badge.
+            const _projects = [];
+            const _seen = new Set();
+            for (const it of (plan.missing_features || [])) {
+              const proj = (it && it.project) || plan.project || '';
+              if (proj && !_seen.has(proj)) { _seen.add(proj); _projects.push(proj); }
+            }
+            if (_projects.length === 0 && plan.project) _projects.push(plan.project);
+            // P-66b1faec — _perProjectProgress feeds the per-project status
+            // pills in the plan card meta line (dashboard/js/render-plans.js
+            // renderPlanCard). Group missing_features by item.project (with
+            // fallback to plan.project) and count `status === 'done'` per
+            // bucket. Keys are first-seen order so the rendered pill row is
+            // stable. Always emitted on PRD JSON records (possibly empty);
+            // MD drafts omit it since they carry no item-level statuses.
+            const _perProjectProgress = {};
+            for (const it of (plan.missing_features || [])) {
+              const proj = (it && it.project) || plan.project || '';
+              if (!proj) continue;
+              if (!_perProjectProgress[proj]) _perProjectProgress[proj] = { complete: 0, total: 0 };
+              _perProjectProgress[proj].total += 1;
+              if (it && it.status === 'done') _perProjectProgress[proj].complete += 1;
+            }
             return {
               file: f, format: 'prd', archived,
               project: plan.project || '',
+              _projects,
+              _perProjectProgress,
               summary: plan.plan_summary || '',
               status,
               branchStrategy: plan.branch_strategy || 'parallel',
@@ -6717,7 +6886,7 @@ const server = http.createServer(async (req, res) => {
               sourcePlan: plan.source_plan || null,
               archiveReady: plan._archiveReady || false,
               archiveReadyAt: plan._archiveReadyAt || null,
-              planStale: plan.planStale || false,
+              planStale: freshStale || plan.planStale || false,
             };
           } catch { return null; /* JSON parse fallback */ }
         } else {
@@ -6726,9 +6895,19 @@ const server = http.createServer(async (req, res) => {
           const authorMatch = content.match(/\*\*Author:\*\*\s*(.+)/m);
           const dateMatch = content.match(/\*\*Date:\*\*\s*(.+)/m);
           const versionMatch = f.match(/-v(\d+)/);
+          // P-e8d49105 — for MD drafts, the cross-repo marker / **Projects:**
+          // line is the source of truth (parsed by shared.extractPlanTargetProjects).
+          // If neither is present, fall back to the singular **Project:** header
+          // so single-project drafts render the same badge as today.
+          const declaredProject = projectMatch ? projectMatch[1].trim() : '';
+          const targetProjects = shared.extractPlanTargetProjects(content);
+          const _projects = targetProjects.length > 0
+            ? targetProjects
+            : (declaredProject ? [declaredProject] : []);
           return {
             file: f, format: 'draft', archived,
-            project: projectMatch ? projectMatch[1].trim() : '',
+            project: declaredProject,
+            _projects,
             summary: titleMatch ? titleMatch[1].trim() : f.replace('.md', ''),
             status: archived ? 'completed' : completedPrdFiles.has(f) ? 'converted' : 'draft',
             branchStrategy: '',
@@ -6842,6 +7021,22 @@ const server = http.createServer(async (req, res) => {
         return data;
       }, { defaultValue: {} });
 
+      // W-mqacrzis0003df4a — Fresh source-plan staleness check. Approve is the
+      // last gate before materialization, and the diff-aware regen block below
+      // gates on `wasStale`. The persisted `data.planStale` flag lags by an
+      // engine tick (~10s); without this fresh stat a fast user can Approve
+      // within the tick window, `wasStale` stays false, the diff-aware regen
+      // is silently skipped, and items materialize from the OLD PRD. Mirrors
+      // the staleness logic in engine/queries.js#getPrdInfo + the /api/plans
+      // handler above so all three readers agree.
+      if (!wasStale && plan && plan.source_plan && plan.sourcePlanModifiedAt) {
+        try {
+          const sourceMtime = Math.floor(fs.statSync(path.join(PLANS_DIR, plan.source_plan)).mtimeMs);
+          const recorded = new Date(plan.sourcePlanModifiedAt).getTime();
+          if (recorded && sourceMtime > recorded) wasStale = true;
+        } catch { /* source plan may have been deleted/renamed — fall through with wasStale=false */ }
+      }
+
       // Resume paused work items across all projects
       let resumed = 0;
       const resumedItemIds = [];
@@ -7193,7 +7388,9 @@ const server = http.createServer(async (req, res) => {
 
       let archivedSource = null;
       let plan = {};
-      let archiveWarnings = [];
+      const archiveWarnings = [];
+      let archivedPrd = null;
+      const archivedPrds = [];
       if (isPrd) {
         const result = _archivePrdPostProcess({
           planFile: body.file,
@@ -7202,8 +7399,75 @@ const server = http.createServer(async (req, res) => {
           plansDir: PLANS_DIR,
         });
         archivedSource = result.archivedSource;
-        archiveWarnings = result.archiveWarnings;
+        archiveWarnings.push(...result.archiveWarnings);
         plan = result.plan;
+      } else {
+        // W-mqa27r9b0004c055 — symmetric cascade: archiving a .md must also
+        // archive any PRD whose `source_plan` points back at it. Without this,
+        // the dashboard still renders the PRD as a status-completed plan card
+        // forever (real incident: killswitches-and-granular-controls.md →
+        // minions-opg-2026-06-10-2.json). The per-PRD status-flip / sidecar /
+        // source-plan-move steps are delegated to _archivePrdPostProcess so
+        // both branches share the per-concern try/catch granularity Dallas
+        // shipped for the PRD branch in W-mqa13ulk0002def5 (PR #3222) — the
+        // helper's source-plan move is a safe no-op here because the outer
+        // handler already renamed body.file into plans/archive/.
+        let prdFiles = [];
+        try {
+          prdFiles = fs.readdirSync(PRD_DIR).filter(f => f.endsWith('.json'));
+        } catch (e) {
+          // ENOENT on prd/ is expected for projects without a PRD dir yet —
+          // don't surface as a user-visible warning. Other errors (EACCES,
+          // EIO) get logged + warned.
+          if (e.code !== 'ENOENT') {
+            const warning = `Archive could not enumerate ${PRD_DIR}: ${e.message}`;
+            archiveWarnings.push(warning);
+            console.warn(warning);
+          }
+        }
+        for (const prdFile of prdFiles) {
+          const prdLivePath = path.join(PRD_DIR, prdFile);
+          let prd = null;
+          try {
+            prd = safeJsonObj(prdLivePath);
+          } catch (e) {
+            const warning = `Archive could not read PRD ${prdFile}: ${e.message}`;
+            archiveWarnings.push(warning);
+            console.warn(warning);
+            continue;
+          }
+          if (!prd || prd.source_plan !== body.file) continue;
+
+          const prdArchiveDir = path.join(PRD_DIR, 'archive');
+          try {
+            if (!fs.existsSync(prdArchiveDir)) fs.mkdirSync(prdArchiveDir, { recursive: true });
+          } catch (e) {
+            const warning = `Archive could not create PRD archive dir for ${prdFile}: ${e.message}`;
+            archiveWarnings.push(warning);
+            console.warn(warning);
+            continue;
+          }
+          const prdArchivePath = path.join(prdArchiveDir, prdFile);
+          try {
+            fs.renameSync(prdLivePath, prdArchivePath);
+          } catch (e) {
+            const warning = `Archive could not move PRD ${prdFile}: ${e.message}`;
+            archiveWarnings.push(warning);
+            console.warn(warning);
+            continue;
+          }
+          // Delegate status-flip + sidecar cleanup + (no-op) source-plan move
+          // to the shared helper so both branches stay in lockstep.
+          const cascadeResult = _archivePrdPostProcess({
+            planFile: prdFile,
+            archivePath: prdArchivePath,
+            planPath: prdLivePath,
+            plansDir: PLANS_DIR,
+          });
+          archiveWarnings.push(...cascadeResult.archiveWarnings);
+          archivedPrds.push(prdFile);
+        }
+        if (archivedPrds.length > 0) archivedPrd = archivedPrds[0];
       }
 
       // Cancel pending work items linked to this plan so the engine stops
@@ -7233,6 +7497,8 @@ const server = http.createServer(async (req, res) => {
       invalidateStatusCache();
       invalidatePlansCache();
       const payload = { ok: true, archived: body.file, archivedSource, cancelledItems };
+      if (archivedPrd) payload.archivedPrd = archivedPrd;
+      if (archivedPrds.length > 1) payload.archivedPrds = archivedPrds;
       if (archiveWarnings.length > 0) payload.warnings = archiveWarnings;
       return jsonReply(res, 200, payload);
     } catch (e) { return jsonReply(res, 400, { error: e.message }); }
@@ -9384,6 +9650,12 @@ What would you like to discuss or change? When you're happy, say "approve" and I
       for (const key of Object.keys(childEnv)) {
         if (key === 'CLAUDECODE' || key.startsWith('CLAUDE_CODE') || key.startsWith('CLAUDECODE_')) delete childEnv[key];
       }
+      // W-mqb9y83o — suppress auto-open in the respawned dashboard. The
+      // restart endpoint is fired by CC or the dashboard UI; the operator
+      // already has a tab open (that's how they hit the button), so the
+      // post-restart hook must not pop a second one. Hard kill-switch read
+      // by bin/minions.js#spawnFullStackAndVerify.
+      childEnv.MINIONS_NO_AUTO_OPEN = '1';
       const proc = cpSpawn(process.execPath, [minionsBin, 'restart'], {
         cwd: MINIONS_DIR, stdio: 'ignore', detached: true, env: childEnv, windowsHide: true,
       });
@@ -9501,6 +9773,10 @@ What would you like to discuss or change? When you're happy, say "approve" and I
           // larger models); max 1h (matches CC_CALL_TIMEOUT_MS so the watchdog
           // never outlives the outer abort).
           ccTurnTimeoutMs: [10000, 3600000],
+          // W-mq9acoo800177bcb — bounded-concurrency for pre-dispatch validator.
+          // 1 floor (sequential fallback) and 20 ceiling (above this the LLM
+          // provider's per-second rate limits dominate; throughput gains taper).
+          preDispatchEvalConcurrency: [1, 20],
         };
         for (const [key, [min, max]] of Object.entries(numericFields)) {
           if (e[key] !== undefined) {
@@ -9624,6 +9900,17 @@ What would you like to discuss or change? When you're happy, say "approve" and I
           else if (valid.includes(e.copilotStreamMode)) _setEngineConfig('copilotStreamMode', e.copilotStreamMode);
           else _clamped.push(`copilotStreamMode: "${e.copilotStreamMode}" not in [on, off] (kept previous value)`);
         }
+        // P-mcp-storm — MCP server names to disable for autonomous Copilot agents
+        // (--disable-mcp-server). Accept an array OR a comma/whitespace string;
+        // normalize to a deduped array of trimmed names. Empty clears (inherit all).
+        if (e.copilotAgentDisabledMcpServers !== undefined) {
+          const src = Array.isArray(e.copilotAgentDisabledMcpServers)
+            ? e.copilotAgentDisabledMcpServers
+            : String(e.copilotAgentDisabledMcpServers || '').split(/[\s,]+/);
+          const names = [...new Set(src.map(s => String(s == null ? '' : s).trim()).filter(Boolean))];
+          if (names.length) _setEngineConfig('copilotAgentDisabledMcpServers', names);
+          else _deleteEngineConfig('copilotAgentDisabledMcpServers');
+        }
         // W-mpmwxkrw000872ec — fontSize allowlist. Clamps invalid values
         // (rather than silently failing) so the dashboard bootstrap never
         // ends up with an unknown data-font-size attribute.
@@ -9942,6 +10229,58 @@ What would you like to discuss or change? When you're happy, say "approve" and I
     } catch (e) { return jsonReply(res, e.statusCode || 500, { error: e.message }); }
   }
 
+  // P-c3d4e5f6 — /api/diagnostics/memory.
+  // Returns the latest in-process dashboard sample, the latest engine
+  // sample (read fresh from engine/diagnostics-memory.json via safeJsonObj),
+  // and an engineStale boolean. Engine staleness is true when the sidecar
+  // is missing/unparseable OR its capturedAt is > 5 min old. The handler
+  // does one small JSON read and one in-process sample — < 10ms warm.
+  function handleDiagnosticsMemory(req, res) {
+    try {
+      let dashboardSample = null;
+      try { dashboardSample = diagnosticsMemory.sampleSelf({ label: 'dashboard' }); }
+      catch { /* leave dashboardSample null on sampler failure */ }
+      const engineSample = safeJsonObj(DIAGNOSTICS_MEMORY_SIDECAR_PATH);
+      const payload = _buildMemoryDiagnostics({
+        dashboardSample,
+        engineSample,
+        now: Date.now(),
+      });
+      return jsonReply(res, 200, payload, req);
+    } catch (e) {
+      return jsonReply(res, 500, { error: e.message }, req);
+    }
+  }
+
+  // P-c3d4e5f6 — /api/diagnostics/memory/history?process=engine|dashboard&limit=N.
+  // process=dashboard returns the diagnosticsMemory module's own ring
+  // buffer (populated by startPeriodicSampling on dashboard boot).
+  // process=engine returns the dashboard's accumulated polled snapshots
+  // of engine/diagnostics-memory.json — engine.js only persists the
+  // latest sample to the sidecar, so engine-side history is rebuilt by
+  // the dashboard's poller (dedup by capturedAt). Limit defaults to the
+  // full buffer when missing / non-positive.
+  function handleDiagnosticsMemoryHistory(req, res) {
+    try {
+      const u = new URL(req.url, 'http://x');
+      const proc = (u.searchParams.get('process') || '').trim().toLowerCase();
+      const limitRaw = u.searchParams.get('limit');
+      const limitParsed = limitRaw == null || limitRaw === '' ? null : parseInt(limitRaw, 10);
+      const limit = Number.isInteger(limitParsed) && limitParsed > 0 ? limitParsed : null;
+      let samples;
+      if (proc === 'dashboard') {
+        samples = diagnosticsMemory.getHistory(limit ? { limit } : {});
+      } else if (proc === 'engine') {
+        samples = _buildMemoryHistory({ ring: _engineMemoryRing, limit });
+      } else {
+        return jsonReply(res, 400, { error: 'process must be one of: engine, dashboard' }, req);
+      }
+      return jsonReply(res, 200, { process: proc, count: samples.length, samples }, req);
+    } catch (e) {
+      return jsonReply(res, 500, { error: e.message }, req);
+    }
+  }
+
   // Slim UX surface for the experimental redesigned dashboard.
   // The markup/CSS/JS live as fragments under dashboard/slim/ (layout.html +
   // styles.css + body.html + js/*.js) and are assembled by buildSlimHtml() —
@@ -11746,6 +12085,37 @@ What would you like to discuss or change? When you're happy, say "approve" and I
       return jsonReply(res, 200, { ok: true, cleared: cause, prId });
     }},
 
+    // ─── P-f3c9d0e7: convenience pause/resume endpoints ─────────────────────
+    // Single-call wrappers over `POST /api/settings { engine: { <flag>: bool } }`
+    // for the two operator kill-switches:
+    //   - engine.pollingPaused (P-a1f3c2d4) — pauses all PR polling
+    //   - engine.autoFixPaused (P-b2e5d8c7) — pauses auto-fix dispatch
+    //
+    // These exist so the dashboard "Emergency Stop" buttons and any future
+    // `minions pause` / `minions autopause` CLI commands are one-line
+    // implementations (no JSON body construction needed).
+    //
+    // Engine pickup contract: engine.js calls reloadConfig() each tick and
+    // reads `config.engine.<flag> === true` at every gate site, so the next
+    // tick observes the change. Setting the flag to `false` on resume is
+    // enough — the engine has its own log-throttle reset
+    // (`_resetPollingPausedLogState`, `_resetAutoFixPausedLogState`) that
+    // fires automatically when the gate reads `!paused`. The engine and
+    // dashboard run in separate processes, so the dashboard can't (and
+    // doesn't need to) scrub engine-process module state directly.
+    { method: 'POST', path: '/api/engine/polling/pause', desc: 'Pause all PR polling — sets engine.pollingPaused=true (P-f3c9d0e7 convenience over POST /api/settings)', handler: async (req, res) => {
+      return _setEnginePauseFlag(res, 'pollingPaused', true);
+    }},
+    { method: 'POST', path: '/api/engine/polling/resume', desc: 'Resume PR polling — sets engine.pollingPaused=false', handler: async (req, res) => {
+      return _setEnginePauseFlag(res, 'pollingPaused', false);
+    }},
+    { method: 'POST', path: '/api/engine/auto-fix/pause', desc: 'Pause auto-fix dispatch — sets engine.autoFixPaused=true', handler: async (req, res) => {
+      return _setEnginePauseFlag(res, 'autoFixPaused', true);
+    }},
+    { method: 'POST', path: '/api/engine/auto-fix/resume', desc: 'Resume auto-fix dispatch — sets engine.autoFixPaused=false', handler: async (req, res) => {
+      return _setEnginePauseFlag(res, 'autoFixPaused', false);
+    }},
+
     { method: 'POST', path: '/api/plans/create', desc: 'Create a plan from user-provided content', params: 'title, content, project?', handler: async (req, res) => {
       const body = await readBody(req);
       const { title, content, project: projectName, meetingId } = body;
@@ -11758,6 +12128,29 @@ What would you like to discuss or change? When you're happy, say "approve" and I
         return jsonReply(res, 400, { error: 'Plan content must start with a markdown heading (#), bold text (**), or a list item' });
       }
 
+      // P-2e9b54d1: `project` may be a string (today's behavior) OR an array
+      // of project names (cross-repo plan). Normalize to a deduped, trimmed
+      // string[]. Empty values are dropped; ≥2 entries triggers the cross-
+      // repo plan shape (no singular `**Project:**` header, plural
+      // `**Projects:**` line + `<!-- minions:targetProjects=... -->` marker).
+      const rawProjects = Array.isArray(body.project)
+        ? body.project
+        : (body.project ? [body.project] : []);
+      const projectNames = [];
+      for (const raw of rawProjects) {
+        const name = String(raw || '').trim();
+        if (name && !projectNames.includes(name)) projectNames.push(name);
+      }
+      if (projectNames.length > 0) {
+        reloadConfig();
+        const projects = shared.getProjects(CONFIG);
+        for (const name of projectNames) {
+          if (!findProjectByName(projects, name)) {
+            return jsonReply(res, 400, { error: formatUnknownProjectError(name, projects) });
+          }
+        }
+      }
+
       const plansDir = path.join(MINIONS_DIR, 'plans');
       if (!fs.existsSync(plansDir)) fs.mkdirSync(plansDir, { recursive: true });
       const slug = shared.slugify(title);
@@ -11765,8 +12158,12 @@ What would you like to discuss or change? When you're happy, say "approve" and I
       const filename = `${slug}-${date}.md`;
       const filePath = shared.uniquePath(path.join(plansDir, filename));
 
+      const projectLines = projectNames.length >= 2
+        ? `**Projects:** ${projectNames.join(', ')}\n` +
+          `<!-- minions:targetProjects=${projectNames.join(',')} -->\n`
+        : (projectNames.length === 1 ? `**Project:** ${projectNames[0]}\n` : '');
       const header = `# ${title}\n\n` +
-        (projectName ? `**Project:** ${projectName}\n` : '') +
+        projectLines +
         (meetingId ? `**Source Meeting:** ${meetingId}\n` : '') +
         `**Created:** ${date}\n**By:** human teammate\n\n---\n\n`;
       safeWrite(filePath, header + content);
@@ -12260,6 +12657,9 @@ What would you like to discuss or change? When you're happy, say "approve" and I
     { method: 'POST', path: '/api/diagnostics/refresh', desc: 'Append a dashboard refresh-diagnostic ring buffer batch to engine/dashboard-diagnostics.log (rotated at 1 MB)', params: 'entries[]', handler: handleDiagnosticsRefresh },
     // Diagnostics — per-org ADO throttle state (W-mq03l6zh0006f0a1-d).
     { method: 'GET', path: '/api/diagnostics/ado-throttle', desc: 'Snapshot of per-org ADO throttle tracker state — { orgs: { [orgBase]: { throttled, retryAfter, consecutiveHits } } }. Falls back to a single `global` key when running against pre-per-org engines.', handler: handleDiagnosticsAdoThrottle },
+    // Diagnostics — engine + dashboard memory baseline (P-c3d4e5f6).
+    { method: 'GET', path: '/api/diagnostics/memory', desc: 'Latest in-process dashboard memory sample plus the most-recent engine sample read from engine/diagnostics-memory.json. engineStale=true when the sidecar is missing or its capturedAt is > 5 min old.', handler: handleDiagnosticsMemory },
+    { method: 'GET', path: '/api/diagnostics/memory/history', desc: 'In-memory ring buffer of memory samples. process=dashboard returns the dashboard\'s own collector (populated by startPeriodicSampling on boot). process=engine returns the dashboard\'s polled accumulation of engine/diagnostics-memory.json — engine.js only persists the latest sample to the sidecar, so engine-side history is rebuilt by the dashboard poller (dedup by capturedAt). Optional limit caps returned newest-N samples.', params: 'process (engine|dashboard), limit?', handler: handleDiagnosticsMemoryHistory },
   ];
 
   // ── Route Dispatcher ────────────────────────────────────────────────────────
@@ -12458,6 +12858,11 @@ module.exports = {
   refreshStatusAsync,
   handleStatus: _handleStatusRequest,
   invalidateStatusCache,
+  // exported for testing — see test/unit/status-snapshot-budget.test.js (P-f2a3b4c5).
+  // The slim snapshot builder is the synchronous assembler used by getStatusJson()
+  // and refreshStatusAsync(); the budget test calls it directly to measure byte
+  // size and rebuild-time without standing up an HTTP server.
+  getStatus,
   // Raw state-file passthrough — exported for direct unit testing.
   handleStateRead,
   STATE_READ_ALLOWED_DIRS,
@@ -12480,6 +12885,18 @@ module.exports = {
   // route's `builder` closure (getWorkItems().map(slimWorkItemForList)).
   _slimWorkItemForList: slimWorkItemForList,
   _WORK_ITEMS_SLIM_DESCRIPTION_CAP: WORK_ITEMS_SLIM_DESCRIPTION_CAP,
+  // P-c3d4e5f6 — diagnostics-memory dashboard surface (handlers live in
+  // the request-dispatch closure; expose the pure builders + constants so
+  // unit tests can exercise the staleness gate and history slicing
+  // without binding a server.)
+  _buildMemoryDiagnostics,
+  _buildMemoryHistory,
+  _pollAndAccumulateEngineSample,
+  _resetDiagnosticsMemoryForTesting,
+  DIAGNOSTICS_MEMORY_SIDECAR_PATH,
+  DIAGNOSTICS_MEMORY_STALE_MS,
+  DIAGNOSTICS_MEMORY_SAMPLE_INTERVAL_MS,
+  DIAGNOSTICS_MEMORY_ENGINE_RING_CAP,
 };
 
 // Start the HTTP server only when run directly (node dashboard.js).
@@ -12570,15 +12987,19 @@ if (require.main === module) {
     Promise.resolve(queries.getKnowledgeBaseEntries())
       .catch(err => console.warn(`[dashboard] KB cache warm failed: ${err && err.message}`));
 
-    // Auto-open the browser unless suppressed. `minions restart` and the
-    // upgrade path set MINIONS_NO_AUTO_OPEN=1 because the CLI orchestrates the
-    // open itself after observing whether an existing tab reconnected.
-    if (!process.env.MINIONS_NO_AUTO_OPEN) {
-      const result = shared.openUrlInBrowser(`http://localhost:${PORT}`);
-      if (!result.ok) {
-        console.log(`  Could not auto-open browser: ${result.error}`);
-        console.log(`  Please open http://localhost:${PORT} manually.`);
-      }
+    // Auto-open the browser. `minions restart` and the upgrade path set
+    // MINIONS_NO_AUTO_OPEN=1 because the CLI orchestrates the open itself
+    // after observing whether an existing tab reconnected; the primitive
+    // (engine/shared.js#openUrlInBrowser) now owns the env-var check and
+    // emits a debug-level SUPPRESSED log entry so we can prove the kill-
+    // switch is firing.
+    const result = shared.openUrlInBrowser(`http://localhost:${PORT}`, {
+      reason: 'dashboard-self-open',
+      callerHint: 'dashboard.js:13124',
+    });
+    if (!result.ok && !result.suppressed) {
+      console.log(`  Could not auto-open browser: ${result.error}`);
+      console.log(`  Please open http://localhost:${PORT} manually.`);
     }
 
     // Warm the CC runtime binary cache off the request path so the first CC /
@@ -12634,12 +13055,39 @@ if (require.main === module) {
       }
     }, 30000).unref();
     console.log(`  Engine watchdog: active (checks every 30s)`);
+
+    // ─── Diagnostics: dashboard memory sampler (P-c3d4e5f6) ─────────────────
+    // Drive the diagnosticsMemory ring buffer for /api/diagnostics/memory and
+    // /api/diagnostics/memory/history?process=dashboard. The internal
+    // setInterval already calls recordSample for us; the onSample callback
+    // doubles as the engine-sidecar poller so /…/history?process=engine
+    // accumulates one entry per fresh engine MEMORY_BASELINE write
+    // (deduplicated by capturedAt).
+    try {
+      _memorySamplerStop = diagnosticsMemory.startPeriodicSampling({
+        intervalMs: DIAGNOSTICS_MEMORY_SAMPLE_INTERVAL_MS,
+        onSample: () => { try { _pollAndAccumulateEngineSample(); } catch { /* swallow */ } },
+      });
+      // Seed the engine ring immediately so the first call to
+      // /api/diagnostics/memory/history?process=engine right after boot
+      // already returns the latest sidecar sample without waiting a full
+      // sampling interval.
+      try { _pollAndAccumulateEngineSample(); } catch { /* swallow */ }
+    } catch (e) {
+      console.warn(`[dashboard] memory sampler failed to start: ${e && e.message}`);
+    }
   })();
 
   // ── Graceful shutdown: flush debounced writes + clear runtime port file ──
   function _gracefulShutdown() {
     try { flushPendingDocSessions(); } catch {}
     try { shared.clearDashboardPortFile(MINIONS_DIR); } catch {}
+    // P-c3d4e5f6 — stop the diagnostics-memory sampler cleanly so the
+    // setInterval handle doesn't keep the event loop alive on SIGTERM.
+    if (_memorySamplerStop) {
+      try { _memorySamplerStop(); } catch { /* swallow */ }
+      _memorySamplerStop = null;
+    }
   }
   server.on('close', () => _gracefulShutdown());
   process.on('SIGTERM', () => { _gracefulShutdown(); process.exit(0); });