@yemi33/minions 0.1.2177 → 0.1.2179

package/engine/shared.js

@@ -484,18 +484,99 @@ function resolveEngineCacheDir(fallbackEngineDir) {
 // Cross-platform URL opener. Uses execSync so failures fall through the
 // try/catch and the caller sees them. Dashboard self-open and `minions dash`
 // / `minions restart` post-health open all funnel through here.
-function openUrlInBrowser(url) {
+//
+// Every call writes a structured `event: 'browser-open'` entry to log.json
+// (via shared.log) and bumps a per-reason counter in `_engine.browserOpens`
+// in metrics.json. Callers MUST pass `opts.reason` so the log/metric is
+// attributable; a missing reason is logged at `warn` level with
+// `reason: 'unknown'` to make a regression loud rather than silent.
+//
+// `MINIONS_NO_AUTO_OPEN=1` short-circuits the open and writes a debug-level
+// SUPPRESSED entry instead — this lets us prove the kill-switch is firing
+// in production (absence of opens otherwise looks identical whether the
+// guard worked, nobody tried to open, or the guard regressed).
+//
+// Note: browser windows opened by external MCP servers (e.g. @playwright/mcp)
+// do NOT funnel through this primitive and are therefore NOT logged. See
+// MTG-mqam2mjs000e39d7.
+//
+// @param {string} url - URL to open in the user's default browser.
+// @param {Object} [opts]
+// @param {string} [opts.reason] - Why we are opening (e.g. 'cli-dash-warm',
+//   'cli-start-force-open', 'dashboard-self-open'). Required-in-practice;
+//   missing values are logged at warn level.
+// @param {string} [opts.callerHint] - Optional `file:line` to disambiguate
+//   when one reason has multiple call sites.
+// @returns {{ok: boolean, error?: string, suppressed?: boolean}}
+function openUrlInBrowser(url, opts = {}) {
+  const reason = (opts && typeof opts.reason === 'string' && opts.reason) ? opts.reason : 'unknown';
+  const callerHint = (opts && typeof opts.callerHint === 'string') ? opts.callerHint : null;
+  // Heuristic-driven opens (no explicit user action this dispatch) log at warn
+  // so a leak shows up as a warn cluster in the dashboard log filter.
+  const HEURISTIC_REASONS = new Set(['cli-restart-no-beacon', 'dashboard-self-open']);
+  let level = HEURISTIC_REASONS.has(reason) ? 'warn' : 'info';
+  if (reason === 'unknown') level = 'warn';
+  const callerStack = (new Error()).stack.split('\n').slice(2, 5).map(s => s.trim()).join(' | ');
+  const baseMeta = {
+    event: 'browser-open',
+    url,
+    reason,
+    callerHint,
+    callerStack,
+    pid: process.pid,
+    platform: process.platform,
+  };
+
+  // Kill-switch: log SUPPRESSED at debug level and skip execSync. Centralizing
+  // the check here means every caller (existing + future) is observable, and
+  // outer guards (e.g. ralph's W-mqb9y83o000le41e leak fixes) become belt-and-
+  // suspenders without breaking the log audit trail.
+  if (process.env.MINIONS_NO_AUTO_OPEN) {
+    log('debug', `[browser-open] SUPPRESSED reason=${reason} url=${url} (MINIONS_NO_AUTO_OPEN=1)`, {
+      ...baseMeta,
+      suppressed: true,
+    });
+    _bumpBrowserOpenMetric(reason, { suppressed: true });
+    return { ok: false, suppressed: true };
+  }
+
+  log(level, `[browser-open] reason=${reason} url=${url}`, baseMeta);
+  _bumpBrowserOpenMetric(reason);
+
   const { execSync } = require('child_process');
   try {
     if (process.platform === 'win32') execSync(`start "" "${url}"`, { stdio: 'ignore', windowsHide: true });
     else if (process.platform === 'darwin') execSync(`open "${url}"`, { stdio: 'ignore' });
     else execSync(`xdg-open "${url}"`, { stdio: 'ignore' });
+    log(level, `[browser-open] ok reason=${reason}`, { ...baseMeta, ok: true });
     return { ok: true };
   } catch (e) {
-    return { ok: false, error: e && e.message ? e.message : String(e) };
+    const errMsg = e && e.message ? e.message : String(e);
+    log(level, `[browser-open] failed reason=${reason} error=${errMsg}`, { ...baseMeta, ok: false, error: errMsg });
+    return { ok: false, error: errMsg };
   }
 }
 
+// Bump per-reason counter under metrics._engine.browserOpens. Best-effort —
+// metrics.json writes must never throw out of openUrlInBrowser. Schema:
+//   _engine.browserOpens.<reason> = { count, suppressedCount, lastAt }
+function _bumpBrowserOpenMetric(reason, { suppressed = false } = {}) {
+  try {
+    mutateMetrics((metrics) => {
+      if (!metrics._engine || typeof metrics._engine !== 'object') metrics._engine = {};
+      if (!metrics._engine.browserOpens || typeof metrics._engine.browserOpens !== 'object') {
+        metrics._engine.browserOpens = {};
+      }
+      const slot = metrics._engine.browserOpens[reason] || { count: 0, suppressedCount: 0, lastAt: null };
+      if (suppressed) slot.suppressedCount = (slot.suppressedCount || 0) + 1;
+      else slot.count = (slot.count || 0) + 1;
+      slot.lastAt = new Date().toISOString();
+      metrics._engine.browserOpens[reason] = slot;
+      return metrics;
+    });
+  } catch { /* metric best-effort — never throw out of openUrlInBrowser */ }
+}
+
 function _flushLogBuffer() {
   if (_logBuffer.length === 0) return;
   const drained = _logBuffer.splice(0);
@@ -2369,9 +2450,31 @@ const ENGINE_DEFAULTS = {
   autoFixConflicts: true, // auto-dispatch fix agents when a PR has merge conflicts
   autoFixBuilds: true, // auto-dispatch fix agents when a PR build fails
   autoReviewPrs: true, // auto-dispatch review agents for newly opened agent PRs
+  // P-a1f3c2d4 — hard-stop polling kill-switch / master override. When true,
+  // section 2.6 (pollPrStatus) and 2.7 (pollPrHumanComments) skip both
+  // providers regardless of adoPollEnabled / ghPollEnabled, and
+  // discoverFromPrs treats pollEnabled as false for every project so the
+  // downstream auto-dispatch gates (autoFixBuilds / autoFixConflicts /
+  // autoReviewPrs / autoFixReviewFeedback / autoFixHumanComments) all
+  // become inert. Default false so a fresh install behaves identically to
+  // before this knob existed. Flip via Dashboard → Settings → Polling, or
+  // set `engine.pollingPaused: true` in config.json. Reconciliation still
+  // runs (it's a recovery sweep, not a convenience poll) — see section 2.7.
+  pollingPaused: false, // hard-stop kill-switch / master override (see comment above)
   autoReReviewPrs: true, // auto-dispatch review agents after a PR fix is pushed
   autoFixReviewFeedback: true, // auto-dispatch fix agents for minions review changes-requested verdicts
   autoFixHumanComments: true, // auto-dispatch fix agents for actionable human PR comments
+  // P-b2e5d8c7 — hard-stop auto-fix kill-switch / master override. When true,
+  // discoverFromPrs treats every auto-fix gate (autoFixBuilds /
+  // autoFixConflicts / autoFixReviewFeedback / autoFixHumanComments) as false
+  // for every project, so no fix agent is auto-dispatched against any PR.
+  // Review polling, review dispatch (autoReviewPrs / autoReReviewPrs), and
+  // reconciliation are intentionally NOT gated — operators can pause the
+  // fix-storm during an incident while still seeing fresh PR status and
+  // review verdicts. Default false so a fresh install behaves identically
+  // to before this knob existed. Flip via Dashboard → Settings → Auto-fix
+  // & Review Loop, or set `engine.autoFixPaused: true` in config.json.
+  autoFixPaused: false, // hard-stop kill-switch / master override (see comment above)
   autoConsolidateMemory: false, // opt-in: periodically spawn engine/kb-sweep-runner.js from the tick loop (4h cadence). Inbox→notes consolidation already runs every tick via consolidateInbox; this flag only controls the KB sweep.
   prNoOpFixPauseAttempts: 2, // pause one PR automation cause after repeated no-op fixes for unchanged evidence
   quarantineAutoRecoveryMax: 2, // #2996 follow-up: cap on auto-flipping WORKTREE_DIRTY/WORKTREE_DIVERGENT failures back to pending (the quarantine is self-healing so the next dispatch starts clean; the cap prevents infinite loops if quarantine itself keeps failing).
@@ -2468,6 +2571,39 @@ const ENGINE_DEFAULTS = {
   maxBuildFixRetries: 3,
   adoPollEnabled: true, // poll ADO PR status, comments, and reconciliation on each tick cycle
   ghPollEnabled: true, // poll GitHub PR status, comments, and reconciliation on each tick cycle
+  // P-c4d8e1a3 — granular per-poller flags for the 6 PR-poll axes + rebase
+  // processor. Each one defaults true and silently inherits a `false` from
+  // its legacy bundle macro (adoPollEnabled / ghPollEnabled) for backward
+  // compat, so existing config.json knobs keep working. New behavior:
+  // setting `adoPollEnabled: false` (or `ghPollEnabled: false`) alone now
+  // also silences the matching reconcile sweep — operators who want the
+  // recovery sweep back must explicitly set `adoPrReconcileEnabled: true`
+  // (or `ghPrReconcileEnabled: true`). processPendingRebasesEnabled has no
+  // legacy counterpart; the rebase processor was previously ungated. See
+  // shared.resolvePollFlag for the resolution order and the per-axis
+  // surfaces in engine.js section 2.6 / 2.7.
+  adoPrStatusPollEnabled: true,
+  adoPrCommentsPollEnabled: true,
+  adoPrReconcileEnabled: true,
+  ghPrStatusPollEnabled: true,
+  ghPrCommentsPollEnabled: true,
+  ghPrReconcileEnabled: true,
+  processPendingRebasesEnabled: true,
+  // P-d6f0a2b5 — granular work-discovery flags. Each one gates a single
+  // discovery phase inside `engine.discoverWork()`. Default true so the
+  // out-of-box tick behaviour is unchanged; flip OFF via
+  // `config.engine.<flag>` to silence a single discovery source without
+  // touching the per-project `project.workSources.*.enabled` toggles
+  // (those keep composing independently inside the matching discoverFrom*
+  // helper — a `false` at either level skips the call). Wired inline as
+  // `config.engine?.<flag> !== false` at each call site —
+  // shared.resolvePollFlag is intentionally NOT used here because no
+  // legacy macro bundle ever covered these phases.
+  prDiscoveryEnabled: true,             // discoverFromPrs (per-project PR-driven fix/review/test discovery)
+  workItemsDiscoveryEnabled: true,      // discoverFromWorkItems (per-project work-items.json scan)
+  centralWorkDiscoveryEnabled: true,    // discoverCentralWorkItems (top-level work-items.json scan)
+  scheduledWorkDiscoveryEnabled: true,  // discoverScheduledWork (cron-style scheduled tasks + meetings)
+  planMaterializationEnabled: true,     // reconcilePrdStatuses + materializePlansAsWorkItems pair
   prPollStatusEvery: 72,   // poll PR build/review/merge status every N ticks for both ADO and GitHub (~12 min at default 10s tick)
   prPollCommentsEvery: 72, // poll PR human comments every N ticks for both ADO and GitHub (~12 min at default 10s tick)
   // W-mpxpckey000laa4f: lifted inline tick-counter literals to named constants
@@ -2478,6 +2614,11 @@ const ENGINE_DEFAULTS = {
   cleanupEvery: 60,                  // runCleanup + MCP sync every N ticks (~10 min at default 10s tick)
   planCompletionScanEvery: 60,       // periodic PRD completion sweep (~10 min at default 10s tick) — catches plans completed while engine was down
   watchPollEvery: 18,                // checkWatches every N ticks (~3 min at default 10s tick)
+  // P-b2c3d4e5: cadence for MEMORY_BASELINE log line + diagnostics-memory.json
+  // sidecar write driven from engine.js tickInner. Defaults to 6 ticks ≈ 60s
+  // at the default 10s tickInterval. Set to 0 (or any non-positive integer)
+  // to disable both the log emission and sidecar write cleanly (operator opt-out).
+  memoryBaselineEveryTicks: 6,
   stalledDispatchSweepEvery: 120,    // stalled-dispatch retry sweep (~20 min at default 10s tick) — only fires when all agents idle
   // W-mp5trwh60008386d: per-PR 404 must repeat across N consecutive successful base-repo probes
   // before flipping a PR to `abandoned`. A single 404 on `repos/{slug}/pulls/{n}` can be a transient
@@ -2522,6 +2663,26 @@ const ENGINE_DEFAULTS = {
   agentBusyReassignMs: 600000, // 10min — reassign work item to another agent if preferred agent is busy beyond this threshold
   ccEffort: null, // effort level for CC/doc-chat (null, 'low', 'medium', 'high')
   enablePreDispatchEval: true, // P-d2a9f6e5: cheap LLM gate before queueing — on by default. See engine/pre-dispatch-eval.js (Ripley §3 recommendation, 2026-05-11 architecture review). Validates from acceptance_criteria when present, falls back to description when criteria are absent but description is rich (≥80 chars). Fail-open on any validator error.
+  // W-mq9acoo800177bcb — bounded-concurrency for the pre-dispatch validator. The
+  // discoverWork loop in engine.js used to run validateAcceptanceCriteria
+  // sequentially, costing ~25-30s per item × N items per tick (an 11-item
+  // approved PRD took ~5 min to queue). This caps the parallel LLM calls per
+  // tick — 6 is a balance between LLM-provider concurrency tolerance and not
+  // starving the rest of the tick budget. Clamped to [1, 20] in
+  // dashboard.js#handleSettingsUpdate; engine.js#resolvePreDispatchEvalConcurrency
+  // applies the same clamp at read time so a hand-edited config can't bypass it.
+  preDispatchEvalConcurrency: 6,
+  // W-mq9acoo800177bcb — short-circuit the validator for items materialized
+  // from an approved/active PRD. plan-to-prd already LLM-vets every item that
+  // lands in a PRD, so re-validating each item per discovery tick is the
+  // dominant cost of the workflow that triggered this optimization (user-
+  // observed: 2 PRDs / 11 items → ~5 min queueing). Items keep the
+  // `_preDispatchEvalSkipped: 'prd-sourced'` marker on their dispatch entry for
+  // observability. The bypass fires only when item.meta.item.sourcePlan is set
+  // AND the parent PRD's status is approved/active; rejected/paused/revision-
+  // requested/completed PRDs still flow through the normal validator path so a
+  // stale PRD reopen can't smuggle in unvetted items.
+  preDispatchEvalSkipPrdSourced: true,
   completionNonceRequired: false, // P-d2a8f6c1 (agent trust boundary F8): when true, a missing `nonce` field in the completion JSON hard-fails the dispatch with failure_class:'completion-nonce-mismatch'. Default false for one release so older agents/runtime caches that haven't picked up the prompt change degrade with a warning instead of breaking. Mismatched nonces hard-fail regardless of this flag. See docs/completion-reports.md → "Trust boundary".
   autoApplyReviewVote: false, // W-mpea9fyb0010febf / P-f7splitgate: gates POSITIVE auto-actions only — when true, the engine mirrors live platform vote state into local pull-requests.json reviewStatus (so platform-side approves auto-promote local status). When false (default), the verdict is recorded in pull-requests.json reviewStatus from the agent's completion only — informational. NEGATIVE-correction (dismissing the engine's own prior REQUEST_CHANGES / resetting its own prior negative ADO vote on a verdict flip to APPROVE) is correctness and runs UNCONDITIONALLY regardless of this flag.
 
@@ -2541,6 +2702,20 @@ const ENGINE_DEFAULTS = {
   copilotSuppressAgentsMd: true,     // Copilot --no-custom-instructions: stop AGENTS.md auto-load from fighting Minions playbook prompts
   copilotStreamMode: 'on',           // Copilot --stream <on|off>: 'on' streams assistant.message_delta events live; 'off' batches them
   copilotReasoningSummaries: false,  // Copilot --enable-reasoning-summaries (Anthropic-family models only)
+  // P-mcp-storm — Copilot loads `~/.copilot/mcp-config.json` (the operator's
+  // user-scope MCP servers) UNCONDITIONALLY on every process start: it is NOT
+  // gated by `--add-dir`, cwd, or `hermeticHarness` (proven empirically — a
+  // copilot spawned from a neutral dir with no `--add-dir ~/.copilot` still
+  // connects every server). So every spawned Copilot agent boots the operator's
+  // full interactive MCP stack; on Windows each `type:local`/`stdio` server
+  // (e.g. playwright, maestro) launches its own visible console window and
+  // playwright opens browser tabs. The only lever Copilot exposes is
+  // `--disable-mcp-server <name>` (repeatable). This list names the servers the
+  // engine disables for autonomous agent dispatches. Default [] = inherit ALL
+  // (no behavior change). Per-agent override `agent.copilotAgentDisabledMcpServers`.
+  // Resolved through `shared.resolveCopilotAgentDisabledMcpServers(agent, engine)`.
+  // NOTE: `hermeticHarness` does NOT suppress these (it only strips `--add-dir`).
+  copilotAgentDisabledMcpServers: [],
   ccUseWorkerPool: false,            // Sub-task C of W-mp2w003600196c51 (CC perf): when true AND CC runtime is copilot, _invokeCcStream routes through engine/cc-worker-pool.js (persistent `copilot --acp` per CC tab) instead of spawning a fresh CLI per turn. Off by default — opt-in feature flag. **Structurally copilot-only**: the pool spawns `copilot --acp` (Agent Client Protocol); Claude Code does not implement ACP, so resolveCcUseWorkerPool returns false on non-copilot CC runtimes even with explicit-true (W-mphlriic00095f69 — prevents silent runtime switch). Engine/agent dispatch path stays per-process regardless.
   maxBudgetUsd: undefined,       // fleet USD ceiling for --max-budget-usd (per-agent override: agents.<id>.maxBudgetUsd). Honors 0 via ?? so a literal cap of $0 works
   disableModelDiscovery: false,  // skip runtime.listModels() REST calls fleet-wide (settings UI falls back to free-text)
@@ -2770,6 +2945,31 @@ const ENGINE_DEFAULTS = {
   operatorLogin: null,
 };
 
+// ── P-c4d8e1a3: granular per-poller flag resolution ──────────────────────────
+//
+// Helper for the 6 PR-poll axes + processPendingRebases. Each axis has a
+// granular `*Enabled` flag in ENGINE_DEFAULTS (default true) plus an
+// optional legacy bundle macro (`adoPollEnabled` / `ghPollEnabled`) that
+// silences the matching ADO/GitHub trio when set to false. Resolution
+// order, in priority:
+//
+//   1. granular key explicitly present on engineCfg  → use it
+//   2. legacyMacroKey is set on engineCfg AND === false → false
+//      (legacy users keep working — and now reconcile is silenced too)
+//   3. fall through to ENGINE_DEFAULTS[granularKey]   (default true)
+//
+// legacyMacroKey may be `null` for axes that have no legacy counterpart
+// (today: processPendingRebasesEnabled).
+function resolvePollFlag(engineCfg, granularKey, legacyMacroKey) {
+  if (engineCfg && Object.prototype.hasOwnProperty.call(engineCfg, granularKey)) {
+    return engineCfg[granularKey] !== false;
+  }
+  if (legacyMacroKey && engineCfg && engineCfg[legacyMacroKey] === false) {
+    return false;
+  }
+  return ENGINE_DEFAULTS[granularKey] !== false;
+}
+
 // ─── Runtime Fleet Resolution (P-3b8e5f1d) ──────────────────────────────────
 //
 // Six helpers that are the single source of truth for "which CLI runtime + model
@@ -2921,6 +3121,36 @@ function resolveAgentBareMode(agent, engine) {
   return false;
 }
 
+// P-mcp-storm — Resolve the list of MCP server names to disable for spawned
+// Copilot agents (emitted as `--disable-mcp-server <name>`). Chain: per-agent
+// `agent.copilotAgentDisabledMcpServers` → `engine.copilotAgentDisabledMcpServers`
+// → `[]` (inherit all). Tolerant of either an array OR a comma/whitespace-
+// separated string (Settings UI / `MINIONS_*` env deliver strings). Always
+// returns a deduped array of trimmed, non-empty strings. See ENGINE_DEFAULTS
+// for why this exists (Copilot loads ~/.copilot MCP config unconditionally;
+// `hermeticHarness` does NOT suppress it).
+function _normalizeMcpServerList(v) {
+  if (v == null) return null;
+  const raw = Array.isArray(v) ? v : String(v).split(/[\s,]+/);
+  const out = [];
+  const seen = new Set();
+  for (const item of raw) {
+    const name = String(item == null ? '' : item).trim();
+    if (!name || seen.has(name)) continue;
+    seen.add(name);
+    out.push(name);
+  }
+  return out;
+}
+
+function resolveCopilotAgentDisabledMcpServers(agent, engine) {
+  const a = agent ? _normalizeMcpServerList(agent.copilotAgentDisabledMcpServers) : null;
+  if (a) return a;
+  const e = engine ? _normalizeMcpServerList(engine.copilotAgentDisabledMcpServers) : null;
+  if (e) return e;
+  return [];
+}
+
 // ─── Legacy ccModel → defaultModel Migration ─────────────────────────────────
 //
 // Pre-P-3b8e5f1d, `engine.ccModel` was the single fleet-wide model knob (it
@@ -3704,6 +3934,49 @@ function extractPlanDeclaredProject(planContent) {
   }
   return '';
 }
+
+// P-7a3f1c08: Parse a cross-repo plan's list of target projects.
+// Primary signal: `<!-- minions:targetProjects=a, b, c -->` HTML comment.
+// Fallback (human): `**Projects:** a, b | c` markdown line in the first 80 lines.
+// Both forms accept `,`, `|`, or `;` as separators with surrounding whitespace.
+// Returns string[] of trimmed project names (empty array when nothing parseable).
+function extractPlanTargetProjects(planContent) {
+  if (typeof planContent !== 'string' || !planContent.trim()) return [];
+
+  const split = (raw) => {
+    if (typeof raw !== 'string') return [];
+    return raw
+      .split(/[,|;]/)
+      .map(s => s.trim().replace(/^["'`]+|["'`]+$/g, '').trim())
+      .filter(Boolean);
+  };
+
+  // Primary signal: structured HTML comment marker (case-insensitive on the key).
+  const markerMatch = planContent.match(/<!--\s*minions:targetProjects\s*=\s*([^>]*?)\s*-->/i);
+  if (markerMatch) {
+    const parsed = split(markerMatch[1]);
+    if (parsed.length > 0) return parsed;
+  }
+
+  // Fallback signal: human-readable plural `Projects:` line — distinct from the
+  // singular `Project:` line consumed by extractPlanDeclaredProject. Scan the
+  // first 80 lines, matching the same leading-bullet / bold-markdown tolerance.
+  const lines = planContent.split(/\r?\n/).slice(0, 80);
+  for (const rawLine of lines) {
+    const line = rawLine
+      .replace(/^\s*[-*]\s+/, '')
+      .replace(/\*\*/g, '')
+      .trim();
+    const match = line.match(/^Projects\s*:\s*(.+)$/i);
+    if (!match) continue;
+    let value = match[1].trim();
+    value = value.replace(/\s+#.*$/, '').trim();
+    const parsed = split(value);
+    if (parsed.length > 0) return parsed;
+  }
+
+  return [];
+}
 const DISPATCH_RESULT = { SUCCESS: 'success', ERROR: 'error', TIMEOUT: 'timeout' };
 const PIPELINE_STATUS = {
   PENDING: 'pending', RUNNING: 'running', COMPLETED: 'completed',
@@ -4097,6 +4370,30 @@ function getProjects(config) {
   return [];
 }
 
+// Generic, ambiguous project-name tokens that read poorly as a bare label in
+// the dashboard. For these, projectDisplayName derives a `<parentFolder>/<name>`
+// label from the project's localPath. `src` is the required case. DISPLAY ONLY —
+// the project `name` field is a load-bearing identifier and is never mutated.
+const GENERIC_PROJECT_NAME_TOKENS = new Set(['src', 'source', 'repo']);
+
+// Human-facing label for a project. Returns `project.name` unchanged for normal
+// names. When the name is a generic token (e.g. `src`), derives the parent
+// folder one level up from localPath and returns `<parentBasename>/<name>` —
+// e.g. name `src` at localPath `C:/office/src` → `office/src`. Falls back to the
+// bare name when localPath is missing or the parent can't be derived. Never
+// mutates the project; preserves the original name casing.
+function projectDisplayName(project) {
+  if (!project || typeof project !== 'object') return '';
+  const name = project.name == null ? '' : String(project.name);
+  if (!GENERIC_PROJECT_NAME_TOKENS.has(name.trim().toLowerCase())) return name;
+  const localPath = project.localPath == null ? '' : String(project.localPath);
+  const normalized = localPath.replace(/\\/g, '/').replace(/\/+$/, '');
+  if (!normalized) return name;
+  const parent = path.basename(path.dirname(normalized));
+  if (!parent || parent === '.') return name;
+  return `${parent}/${name}`;
+}
+
 function formatUnknownProjectError(projectName, projects = []) {
   const known = projects.map(p => p.name).filter(Boolean).join(', ') || '(none configured)';
   return `Project "${projectName}" not found. Known projects: ${known}`;
@@ -7504,14 +7801,16 @@ module.exports = {
   KB_READABLE_CATEGORIES,
   classifyInboxItem,
   ENGINE_DEFAULTS,
+  resolvePollFlag, // P-c4d8e1a3 — granular per-poller flag resolution
   resolveAgentCli, resolveCcCli, resolveCcUseWorkerPool, resolveAgentModel, resolveCcModel,
   resolveAgentMaxBudget, resolveAgentBareMode,
+  resolveCopilotAgentDisabledMcpServers,
   applyLegacyCcModelMigration, _resetLegacyCcModelMigrationFlag,
   applyCcWorkerPoolForceOnMigration,
   runtimeConfigWarnings,
   projectWorkSourceWarnings,
   backfillProjectWorkSourceDefaults,
-  WI_STATUS, DONE_STATUSES, PLAN_TERMINAL_STATUSES, WORK_TYPE, WORKTREE_REQUIRING_TYPES, VALID_WORK_TYPES, resolveWorkItemTypeFromPrdItem, PLAN_STATUS, PRD_ITEM_STATUS, PRD_MATERIALIZABLE, PR_STATUS, PR_POLLABLE_STATUSES, PR_PENDING_REASON, BUILD_STATUS, REVIEW_STATUS, FETCH_TIMEOUT_MS, RETRY_DELAY_MS, ADO_TOKEN_REFRESH_MAX_RETRIES, DISPATCH_RESULT, mutateMetrics, mutateWatches, mutateScheduleRuns, mutatePipelineRuns, mutateManagedProcesses, mutateWorktreePool, mutateQaRuns, mutateQaSessions, trackReviewMetric, queuePlanToPrd, extractPlanDeclaredProject,
+  WI_STATUS, DONE_STATUSES, PLAN_TERMINAL_STATUSES, WORK_TYPE, WORKTREE_REQUIRING_TYPES, VALID_WORK_TYPES, resolveWorkItemTypeFromPrdItem, PLAN_STATUS, PRD_ITEM_STATUS, PRD_MATERIALIZABLE, PR_STATUS, PR_POLLABLE_STATUSES, PR_PENDING_REASON, BUILD_STATUS, REVIEW_STATUS, FETCH_TIMEOUT_MS, RETRY_DELAY_MS, ADO_TOKEN_REFRESH_MAX_RETRIES, DISPATCH_RESULT, mutateMetrics, mutateWatches, mutateScheduleRuns, mutatePipelineRuns, mutateManagedProcesses, mutateWorktreePool, mutateQaRuns, mutateQaSessions, trackReviewMetric, queuePlanToPrd, extractPlanDeclaredProject, extractPlanTargetProjects,
   WATCH_STATUS, WATCH_TARGET_TYPE, WATCH_CONDITION, WATCH_ABSOLUTE_CONDITIONS, WATCH_ACTION_TYPE,
   WATCH_STALLED_DEFAULT_TICKS, WATCH_STUCK_STAGE_DEFAULT_TICKS,
   PIPELINE_STATUS, STAGE_TYPE, MEETING_STATUS, AGENT_STATUS,
@@ -7532,6 +7831,7 @@ module.exports = {
   mergeManifestAllowedTools,
   formatManifestRejection,
   getProjects,
+  projectDisplayName,
   formatUnknownProjectError,
   findProjectByName,
   findProjectByNameOrPath,

package/engine/watchdog.js

@@ -146,6 +146,12 @@ async function tick(opts) {
       detached: true,
       stdio: 'ignore',
       windowsHide: true,
+      // W-mqb9y83o — suppress auto-open in the respawned dashboard. The
+      // watchdog has no user-intent signal (it fires on health failure, not
+      // user action), so the post-restart hook MUST NOT pop a browser tab.
+      // The CLI's spawnFullStackAndVerify reads this env var as a hard
+      // kill-switch via MINIONS_NO_AUTO_OPEN=1.
+      env: { ...process.env, MINIONS_NO_AUTO_OPEN: '1' },
     });
     if (child && typeof child.unref === 'function') child.unref();
     logLine(minionsHome, `spawned minions ${action} pid=${child && child.pid} (detached)`);