@yemi33/minions 0.1.2186 → 0.1.2188

package/README.md

@@ -334,7 +334,7 @@ For GitHub repos, install and authenticate the [GitHub CLI](https://cli.github.c
 
 ### Azure DevOps Users
 
-For the best experience with ADO repos, install the [Azure CLI](https://learn.microsoft.com/en-us/cli/azure/install-azure-cli) with the Azure DevOps extension. Agents should use the `az` CLI first for Azure DevOps operations such as PR creation, PR lookup, comments, reviewers, work items, and pipelines. Use the Azure DevOps MCP fallback only when `az` is unavailable in the environment or insufficient for a specific action.
+For the best experience with ADO repos, install the [Azure CLI](https://learn.microsoft.com/en-us/cli/azure/install-azure-cli) with the Azure DevOps extension. Agents should use the `az` CLI first for Azure DevOps operations such as PR creation, PR lookup, comments, reviewers, work items, and pipelines. If `az` is unavailable or insufficient for a specific action (e.g. PR comment threads on an older extension), agents fall back to the Azure DevOps REST API (`_apis/git/...`) directly, using a token from `az account get-access-token` — no MCP server required.
 
 ```bash
 # Install Azure CLI
@@ -348,8 +348,6 @@ az login
 az devops configure --defaults organization=https://dev.azure.com/YOUR_ORG project=YOUR_PROJECT
 ```
 
-Optionally add the [Azure DevOps MCP server](https://github.com/microsoft/azure-devops-mcp) to your Claude Code settings (`~/.claude.json`) as a fallback. Agents inherit it on next spawn — no sync step needed.
-
 ## Work Items
 
 All work items use the shared `playbooks/work-item.md` template, which provides consistent branch naming, worktree workflow, PR creation steps, and status tracking.
@@ -676,7 +674,7 @@ To move to a new machine: `npm install -g @yemi33/minions && minions init --forc
     watches.js           watch-actions.js
     # Repo-host integrations
     github.js            issues.js
-    ado.js               ado-token.js          ado-mcp-wrapper.js
+    ado.js               ado-token.js
     ado-status.js        check-status.js
     # Runtime state (generated, gitignored)
     control.json         <- running/paused/stopped

package/dashboard.js

@@ -8130,25 +8130,69 @@ What would you like to discuss or change? When you're happy, say "approve" and I
     let _docAbort = null;
     let _docStreamEnded = false;
     let _docHeartbeatTimer = null;
+    // W-mpetru71000re5de — per-stream backpressure clock + approximate queued
+    // bytes, mirroring writeCcEvent so a runtime error frame can't be swallowed
+    // forever behind a stuck consumer (the "spins endlessly" failure mode).
+    // _docBpStartedAt timestamps the first write that returned false (reset on
+    // 'drain'); _docQueuedBytes accumulates bytes pushed past res.writable's
+    // highWaterMark. The heartbeat tick force-closes the stream once the clock
+    // exceeds SSE_STUCK_KILL_MS, which fires req.on('close') → abort + cleanup
+    // so the client's reader gets `done` and renders a real error instead of
+    // spinning. Doc-chat has no reconnect-replay, so we only shed intermediate
+    // frames (chunk/tool/progress/heartbeat) — terminal `done` and `error`
+    // frames are NEVER shed so the final answer / typed error always lands.
+    let _docBpStartedAt = null;
+    let _docQueuedBytes = 0;
+    try {
+      res.on('drain', () => { _docBpStartedAt = null; _docQueuedBytes = 0; });
+    } catch { /* listener registration is best-effort */ }
     const writeDocEvent = (payload) => {
-      // TODO(W-mpetru71000re5de): doc-chat SSE has the same unbounded-queue
-      // failure mode as CC's writeCcEvent — res.write() returning false from
-      // backpressure silently queues bytes in Node's WritableState.buffered[].
-      // Out of scope for this fix (task is scoped to CC only). When this is
-      // addressed, mirror the SSE_MAX_QUEUE_BYTES shed + SSE_STUCK_KILL_MS
-      // heartbeat force-close pattern from the writeCcEvent closure
-      // (dashboard.js, search for SSE_MAX_QUEUE_BYTES).
+      const type = payload && payload.type;
+      const isTerminal = type === 'done' || type === 'error';
+      const _logFail = (reason) => {
+        try {
+          shared.log('warn', `[doc-sse-fail] ${JSON.stringify({ doc: docKey || 'unknown', type, reason, destroyed: !!res.destroyed, writableEnded: !!res.writableEnded, streamEnded: _docStreamEnded })}`);
+        } catch { /* telemetry is best-effort */ }
+      };
+      if (res.destroyed || res.writableEnded) {
+        _logFail(res.destroyed ? 'res-destroyed' : 'res-writable-ended');
+        return false;
+      }
+      let wire;
       try {
-        const type = payload && payload.type;
-        // W-mpmwxni2000c25c7-d — mirror the writeCcEvent change so doc-chat
-        // also emits `event: error` for terminal errors. Same back-compat:
-        // the JSON still carries `type: 'error'` for data-line parsers.
+        // W-mpmwxni2000c25c7-d — terminal error frames go out as `event: error`
+        // so SSE consumers using addEventListener('error', …) can target them.
+        // The JSON payload still carries `type: 'error'` for the data-line
+        // parser in modal-qa.js.
         const eventLine = (type === 'error') ? 'event: error\n' : '';
-        res.write(eventLine + 'data: ' + JSON.stringify(payload) + '\n\n');
-        return true;
+        wire = eventLine + 'data: ' + JSON.stringify(payload) + '\n\n';
       } catch {
+        _logFail('json-serialize-failed');
         return false;
       }
+      // Shed intermediate frames once the queue exceeds the cap, but ALWAYS
+      // attempt terminal frames — the `done` frame carries the full final
+      // answer and the `error` frame is the whole point of this fix.
+      if (!isTerminal && _docQueuedBytes > SSE_MAX_QUEUE_BYTES) {
+        try {
+          shared.log('warn', `[doc-sse-shed] doc=${docKey || 'unknown'} type=${type} queuedBytes=${_docQueuedBytes} wireBytes=${wire.length}`);
+        } catch { /* telemetry is best-effort */ }
+        return true;
+      }
+      let writeOk;
+      try { writeOk = res.write(wire); }
+      catch { _logFail('res-write-threw'); return false; }
+      if (writeOk === false) {
+        // Backpressure — the write is still queued. Start (or extend) the
+        // backpressure clock so the heartbeat tick can force-close a stuck
+        // stream, and accumulate approximate queued bytes for the shed gate.
+        if (_docBpStartedAt == null) _docBpStartedAt = Date.now();
+        _docQueuedBytes += wire.length;
+        try {
+          shared.log('warn', `[doc-sse-backpressure] doc=${docKey || 'unknown'} type=${type} bytes=${wire.length} queuedBytes=${_docQueuedBytes} bpMs=${Date.now() - _docBpStartedAt}`);
+        } catch { /* telemetry is best-effort */ }
+      }
+      return true;
     };
     const stopDocHeartbeat = () => {
       if (_docHeartbeatTimer) {
@@ -8196,6 +8240,20 @@ What would you like to discuss or change? When you're happy, say "approve" and I
           stopDocHeartbeat();
           return;
         }
+        // W-mpetru71000re5de — force-close streams stuck on backpressure.
+        // res.destroy() fires req.on('close'), which runs the teardown path
+        // below (stop heartbeat → drop the in-flight guard → abort the LLM),
+        // so a runtime that finished (or errored) but whose frame can't reach
+        // a wedged consumer no longer leaves the client spinning forever.
+        if (_docBpStartedAt && Date.now() - _docBpStartedAt > SSE_STUCK_KILL_MS) {
+          const stuckMs = Date.now() - _docBpStartedAt;
+          try {
+            shared.log('warn', `[doc-sse-stuck-close] doc=${docKey || 'unknown'} stuckMs=${stuckMs} queuedBytes=${_docQueuedBytes}`);
+          } catch { /* telemetry is best-effort */ }
+          stopDocHeartbeat();
+          try { res.destroy(); } catch { /* swallow — req.on('close') will still fire */ }
+          return;
+        }
         if (!writeDocEvent({ type: 'heartbeat' })) stopDocHeartbeat();
       }, CC_STREAM_HEARTBEAT_MS);
 
@@ -8256,12 +8314,14 @@ What would you like to discuss or change? When you're happy, say "approve" and I
           llm.trackEngineError('doc-chat', errCode);
           const isHardFailure = !partial && !(finalize && finalize.edited);
           if (isHardFailure) {
-            const errPayload = {
+            // Route through writeDocEvent so the terminal error frame inherits
+            // the destroyed/ended guards and is never shed under backpressure.
+            writeDocEvent({
+              type: 'error',
               message: ccError.typedMessage || ccError.errorMessage || 'Document chat failed',
               code: errCode,
               retriable: ccError.retriable !== false,
-            };
-            try { res.write(`event: error\ndata: ${JSON.stringify(errPayload)}\n\n`); } catch {}
+            });
           }
         }
         const { answer: finalAnswer, ...donePayload } = payload;

package/docs/distribution.md

@@ -60,7 +60,7 @@ These files are excluded from published packages:
 Controlled by the `files` field in `package.json`:
 - `bin/minions.js` — CLI entry point
 - `engine.js`, `dashboard.js`, `dashboard/` (fragments), `minions.js` — core scripts
-- `engine/spawn-agent.js`, `engine/ado-mcp-wrapper.js` — engine helpers
+- `engine/spawn-agent.js` — engine helper
 - `agents/*/charter.md` — agent role definitions
 - `playbooks/*.md` — task templates
 - `config.template.json` — starter config

package/docs/onboarding.md

@@ -15,7 +15,7 @@ You only need to clone if you intend to modify Minions itself. End users normall
 ```bash
 git clone https://github.com/yemi33/minions.git ~/minions-dev
 cd ~/minions-dev
-npm install     # installs dev tooling (Playwright) + the lone runtime dep (@azure-devops/mcp); engine is otherwise built on Node built-ins
+npm install     # installs dev tooling (Playwright, ESLint) only; the engine itself has zero runtime deps (Node built-ins)
 ```
 
 You should now have:

package/docs/worktree-lifecycle.md

@@ -142,6 +142,24 @@ EPERM/EBUSY stragglers that the dispatch-end GC couldn't reap and sweeps
 the `git worktree list` registry for OUT-of-root entries the in-root
 scanner is blind to.
 
+### Ownership marker — out-of-root GC only touches engine worktrees (W-mqecdoot)
+
+A project repo's `git worktree list` includes EVERY worktree registered
+against it — including ones a developer created by hand
+(`git worktree add /tmp/my-work <branch>`) for their own work. The
+out-of-root sweep used to evict any such entry that wasn't pinned to a
+live dispatch / pool / managed-spawn, **deleting human worktrees
+mid-edit**. The fix: the engine stamps a `.minions-worktree` ownership
+marker (`shared.WORKTREE_OWNER_MARKER`) into every worktree it creates
+(`shared.writeWorktreeOwnerMarker`, called right after `git worktree add`
+in `engine.js#runWorktreeAdd`). `pruneOrphanWorktreesFromGitRegistry`
+now requires `shared.hasWorktreeOwnerMarker(path)` before evicting an
+out-of-root worktree — **no marker → foreign → kept and never
+escalated** (fail-open: leak a dir rather than nuke unpushed work). The
+trailing `git worktree prune --expire=now` (drops registry entries whose
+dirs are already gone) still runs regardless of ownership. The marker is
+gitignored so it never shows up in any worktree's `git status`.
+
 ## Holder identification + opt-in auto-reap (W-mq6f2fe0000557fa)
 
 Orphan-sweep escalations also run `shared.findProcessesWithCwdInside(wt)`

package/engine/playbook.js

@@ -40,7 +40,7 @@ function getPrCreateInstructions(project) {
       `- Use --head to specify your feature branch name\n` +
       `- Include a meaningful --title and body file describing the changes`;
   }
-  // Default: Azure DevOps — prefer `az` CLI first, ADO MCP only as fallback
+  // Default: Azure DevOps — prefer `az` CLI first, ADO REST API as fallback
   const adoOrg = project?.adoOrg || '';
   const adoProject = project?.adoProject || '';
   const repoName = project?.repoName || '';
@@ -50,7 +50,7 @@ function getPrCreateInstructions(project) {
     `- Then: \`az repos pr create --repository "${repoName}" --source-branch <your-branch> --target-branch ${mainBranch} --title "PR title" --description @<body-file.md>\`\n` +
     `- Use \`@<file>\` syntax for \`--description\` so Markdown, quotes, and newlines pass safely\n` +
     `- Always set --target-branch to \`${mainBranch}\` (the main branch)\n\n` +
-    `If \`az\` is unavailable or insufficient for this operation, fall back to \`mcp__azure-ado__repo_create_pull_request\` with repositoryId \`${repoId}\`. Do not use \`gh\` for Azure DevOps repositories.`;
+    `If \`az\` is unavailable, fall back to the ADO REST API: get a token with \`az account get-access-token --resource 499b84ac-1321-427f-aa17-267ca6975798 --query accessToken -o tsv\` and \`POST .../_apis/git/repositories/${repoId}/pullrequests?api-version=7.1\` (Bearer auth). Do not use \`gh\` for Azure DevOps repositories.`;
 }
 
 function getPrCommentInstructions(project) {
@@ -72,12 +72,12 @@ function getPrCommentInstructions(project) {
       "```\n" +
       `Then run: \`gh pr comment <number> --body-file <body-file.md> --repo ${org}/${repo}\`. Without the marker, the engine cannot tell your post from a real human comment and will queue redundant fix-dispatches.`;
   }
-  // Azure DevOps — prefer `az` CLI first, ADO MCP only as fallback
+  // Azure DevOps — prefer `az` CLI first, ADO REST API as fallback
   const repoName = project?.repoName || '';
   return `For Azure DevOps, use the \`az\` CLI first to post a comment on the PR:\n` +
     `- Write the Markdown comment to a temporary file, then run: \`az repos pr comment create --pull-request-id <number> --content @<body-file.md>\` (substitute your project's repo \`${repoName}\` if not using \`az devops configure\` defaults)\n` +
     `- Use \`@<file>\` syntax for \`--content\` so Markdown, quotes, and newlines pass safely\n\n` +
-    `If \`az repos pr comment\` is unavailable or insufficient (e.g. older az-devops extension, thread/status semantics needed), fall back to \`mcp__azure-ado__repo_create_pull_request_thread\` with repositoryId \`${repoId}\`. Do not use \`gh\` for Azure DevOps repositories.`;
+    `If \`az repos pr comment\` is unavailable or insufficient (e.g. older az-devops extension, thread/status semantics needed), fall back to the ADO REST API: get a token with \`az account get-access-token --resource 499b84ac-1321-427f-aa17-267ca6975798 --query accessToken -o tsv\` and \`POST .../_apis/git/repositories/${repoId}/pullrequests/<number>/threads?api-version=7.1\` with body \`{"comments":[{"content":"..."}],"status":"active"}\` (Bearer auth). Do not use \`gh\` for Azure DevOps repositories.`;
 }
 
 function getPrFetchInstructions(project) {
@@ -95,13 +95,13 @@ function getPrFetchInstructions(project) {
       `- Or use \`gh pr checkout <number> --repo ${org}/${repo}\` to fetch and checkout in one step\n` +
       `- The base branch is \`${mainBranch}\``;
   }
-  // Azure DevOps — prefer `az` CLI first, ADO MCP only as fallback
+  // Azure DevOps — prefer `az` CLI first, ADO REST API as fallback
   const mainBranch = project?.localPath ? shared.resolveMainBranch(project.localPath, project.mainBranch) : (project?.mainBranch || 'main');
   return `For Azure DevOps, use the \`az\` CLI first to fetch PR status:\n` +
     `- \`az repos pr show --id <number>\` returns PR state, mergeStatus, source/target branches, vote summary, and policy/build evaluations\n` +
     `- For the local branch: \`git fetch origin <branch-name>\` then inspect via \`git show\`/\`git diff\` (do NOT checkout in your main working tree)\n` +
     `- The base branch is \`${mainBranch}\`\n\n` +
-    `If \`az\` is unavailable or insufficient, fall back to \`mcp__azure-ado__repo_get_pull_request_by_id\`. Do not use \`gh\` for Azure DevOps repositories.`;
+    `If \`az\` is unavailable, fall back to the ADO REST API: get a token with \`az account get-access-token --resource 499b84ac-1321-427f-aa17-267ca6975798 --query accessToken -o tsv\` and \`GET .../_apis/git/repositories/<repoId>/pullrequests/<number>?api-version=7.1\` (Bearer auth). Do not use \`gh\` for Azure DevOps repositories.`;
 }
 
 function getPrVoteInstructions(project) {
@@ -123,11 +123,11 @@ function getPrVoteInstructions(project) {
       "```\n" +
       `Then run: \`gh pr review <number> --comment --body-file <verdict.md> --repo ${org}/${repo}\`. Do NOT use \`--approve\` or \`--request-changes\` flags — they will fail.`;
   }
-  // Azure DevOps — prefer `az` CLI first, ADO MCP only as fallback
+  // Azure DevOps — prefer `az` CLI first, ADO REST API as fallback
   return `For Azure DevOps, use the \`az\` CLI first to set your reviewer vote:\n` +
     `- \`az repos pr set-vote --id <number> --vote {approve | approve-with-suggestions | reject | reset | wait-for-author}\`\n` +
     `- Pair the vote with \`az repos pr comment create --pull-request-id <number> --content @<verdict.md>\` so the verdict body is recorded as a thread comment\n\n` +
-    `If \`az\` is unavailable or insufficient, fall back to \`mcp__azure-ado__repo_update_pull_request_reviewers\` with repositoryId \`${repoId}\` (vote integers: 10=approve, 5=approve-with-suggestions, 0=no-vote, -5=wait-for-author, -10=reject). Do not use \`gh\` for Azure DevOps repositories.`;
+    `If \`az\` is unavailable, fall back to the ADO REST API: get a token with \`az account get-access-token --resource 499b84ac-1321-427f-aa17-267ca6975798 --query accessToken -o tsv\` and \`PUT .../_apis/git/repositories/${repoId}/pullrequests/<number>/reviewers/<reviewerId>?api-version=7.1\` with body \`{"vote":10}\` (10=approve, 5=approve-with-suggestions, 0=no-vote, -5=wait-for-author, -10=reject; Bearer auth). Do not use \`gh\` for Azure DevOps repositories.`;
 }
 
 function getRepoHostLabel(project) {
@@ -139,7 +139,7 @@ function getRepoHostLabel(project) {
 function getRepoHostToolRule(project) {
   const host = getRepoHost(project);
   if (host === 'github') return 'Use GitHub MCP tools or `gh` CLI for PR operations';
-  return 'For Azure DevOps, use the `az` CLI first for PR operations (e.g. `az repos pr create`, `az repos pr show`, `az repos pr comment`, `az repos pr set-vote`); use ADO MCP tools (`mcp__azure-ado__*`) only as a fallback when `az` is unavailable or insufficient. Do not use `gh` for Azure DevOps repositories.';
+  return 'For Azure DevOps, use the `az` CLI for PR operations (e.g. `az repos pr create`, `az repos pr show`, `az repos pr comment`, `az repos pr set-vote`); if `az` is unavailable or insufficient, fall back to the ADO REST API (`_apis/git/...`) with a token from `az account get-access-token --resource 499b84ac-1321-427f-aa17-267ca6975798`. Do not use `gh` for Azure DevOps repositories.';
 }
 
 // ─── Task Context Resolution ────────────────────────────────────────────────

package/engine/shared.js

@@ -7790,6 +7790,49 @@ function removeWorktree(wtPath, gitRoot, worktreeRoot, opts = {}) {
   }
 }
 
+// W-mqecdoot — engine worktree ownership marker. The out-of-root worktree GC
+// (worktree-gc.pruneOrphanWorktreesFromGitRegistry) reaps worktrees registered
+// in a project's git that live OUTSIDE the configured worktreeRoot. Without a
+// positive ownership signal it cannot tell an engine-created orphan from a
+// worktree a human developer created by hand (`git worktree add /tmp/foo …`)
+// for their own work — and was deleting the latter mid-edit. We stamp this
+// marker into every worktree the engine creates so the GC can require proof of
+// ownership before removal; a worktree with NO marker is treated as foreign
+// and left untouched (fail-open: leak a dir rather than nuke someone's work).
+const WORKTREE_OWNER_MARKER = '.minions-worktree';
+
+// Best-effort stamp dropped right after a successful `git worktree add`. Never
+// throws — a missing marker only costs us the ability to auto-GC that dir.
+function writeWorktreeOwnerMarker(worktreePath, info = {}) {
+  if (!worktreePath) return false;
+  try {
+    const target = path.join(path.resolve(worktreePath), WORKTREE_OWNER_MARKER);
+    const payload = {
+      engine: true,
+      createdAt: new Date().toISOString(),
+      pid: process.pid,
+      ...info,
+    };
+    fs.writeFileSync(target, JSON.stringify(payload, null, 2) + '\n');
+    return true;
+  } catch (e) {
+    log('debug', `writeWorktreeOwnerMarker: could not stamp ${worktreePath}: ${e.message}`);
+    return false;
+  }
+}
+
+// True only when the worktree carries the engine ownership marker. Fail-closed
+// (returns false) on any read error so an unreadable dir is treated as foreign
+// and kept, never blindly removed.
+function hasWorktreeOwnerMarker(worktreePath) {
+  if (!worktreePath) return false;
+  try {
+    return fs.existsSync(path.join(path.resolve(worktreePath), WORKTREE_OWNER_MARKER));
+  } catch {
+    return false;
+  }
+}
+
 function slugify(text, maxLen = 50) {
   return text.toLowerCase().replace(/[^a-z0-9]+/g, '-').replace(/^-|-$/g, '').slice(0, maxLen);
 }
@@ -8195,6 +8238,9 @@ module.exports = {
   listProcessReachable,
   removeWorktree,
   isWorktreePathLive,
+  WORKTREE_OWNER_MARKER,
+  writeWorktreeOwnerMarker,
+  hasWorktreeOwnerMarker,
   _normalizeWorktreePath, // exported for testing
   _writeWorktreeSkipLiveInboxNote, // exported for testing
   _retryFsOp, // exported for testing (W-mq5o6bvy000x7191)

package/engine/worktree-gc.js

@@ -771,6 +771,14 @@ function pruneOrphanWorktreesFromGitRegistry(opts) {
   const _parseWorktreePorcelain = typeof opts.parseWorktreePorcelain === 'function'
     ? opts.parseWorktreePorcelain
     : shared.parseWorktreePorcelain;
+  // W-mqecdoot — positive ownership gate. An out-of-root worktree is only
+  // engine-managed if it carries the ownership marker we stamp at creation
+  // (shared.writeWorktreeOwnerMarker). Worktrees a human created by hand
+  // (`git worktree add /tmp/foo …`) have no marker and must be left alone —
+  // this sweep was deleting them mid-edit.
+  const _hasOwnerMarker = typeof opts.hasOwnerMarker === 'function'
+    ? opts.hasOwnerMarker
+    : shared.hasWorktreeOwnerMarker;
 
   // Branches of active/pending dispatches (with and without `refs/heads/`
   // normalization). Matched case-insensitively to mirror git's behavior on
@@ -875,6 +883,21 @@ function pruneOrphanWorktreesFromGitRegistry(opts) {
         if (anchored) { projStats.kept++; result.kept++; continue; }
       }
 
+      // W-mqecdoot — ownership gate. Only ever evict a worktree the engine
+      // positively created (carries the ownership marker stamped at
+      // `git worktree add` time). No marker → it's a human's hand-made worktree
+      // (or a pre-marker legacy dir); KEEP it and do NOT escalate. The
+      // `git worktree prune --expire=now` below still drops registry entries
+      // whose dirs are already gone, which is safe regardless of ownership.
+      let owned = false;
+      try { owned = !!_hasOwnerMarker(wtAbs); }
+      catch (_e) { owned = false; }
+      if (!owned) {
+        projStats.kept++; result.kept++;
+        log('debug', `worktree-gc: keeping out-of-root ${wtAbs} — no engine ownership marker (foreign/hand-made worktree)`);
+        continue;
+      }
+
       // Slow-cadence gate for already-escalated stuck paths
       const slowRetryMs = (opts.config?.engine?.worktreeStuckSlowRetryMs)
         ?? shared.ENGINE_DEFAULTS.worktreeStuckSlowRetryMs

package/engine.js

@@ -916,6 +916,10 @@ async function runWorktreeAdd(rootDir, worktreePath, addArgs, gitOpts, worktreeC
         log('warn', `Retrying git worktree add (attempt ${attempt + 1}/${retries + 1}) for ${path.basename(worktreePath)}`);
       }
       await shared.shellSafeGit(['worktree', 'add', worktreePath, ...addArgs], { ...gitOpts, cwd: rootDir });
+      // W-mqecdoot — stamp the engine ownership marker so the out-of-root
+      // worktree GC can distinguish a worktree we created from one a human
+      // developer made by hand. Best-effort; never blocks the spawn.
+      shared.writeWorktreeOwnerMarker(worktreePath, { rootDir });
       return;
     } catch (err) {
       lastErr = err;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yemi33/minions",
-  "version": "0.1.2186",
+  "version": "0.1.2188",
   "description": "Multi-agent AI dev team that runs from ~/.minions/ — five autonomous agents share a single engine, dashboard, and knowledge base",
   "bin": {
     "minions": "bin/minions.js"
@@ -67,9 +67,6 @@
   "engines": {
     "node": ">=22.5"
   },
-  "dependencies": {
-    "@azure-devops/mcp": "2.7.0"
-  },
   "devDependencies": {
     "@playwright/test": "^1.58.2",
     "eslint": "^9.39.4",

package/playbooks/shared-rules.md

@@ -274,5 +274,5 @@ Output is JSON with the same fields. Exit 0 on success, 1 if not found.
 
 For Azure DevOps repo operations, use the `az` CLI first. Prefer commands such as `az repos pr create`, `az repos pr show`, `az repos pr list`, `az repos pr comment`, `az repos pr reviewer`, `az boards work-item`, and `az pipelines` after setting defaults with `az devops configure`.
 
-Use ADO MCP fallback tools (`mcp__azure-ado__*`) only when `az` is unavailable in the environment or insufficient for a specific operation. Do not choose MCP first just because it exists, and do not use `gh` for Azure DevOps repositories.
+If `az` is unavailable or insufficient for a specific operation (e.g. PR comment threads on an older az-devops extension), fall back to the ADO REST API directly: acquire a token with `az account get-access-token --resource 499b84ac-1321-427f-aa17-267ca6975798 --query accessToken -o tsv` and call the `_apis/git/...` endpoints with Bearer auth. Do not use `gh` for Azure DevOps repositories.
 {{/ado_shared_rules}}

package/engine/ado-mcp-wrapper.js

@@ -1,63 +0,0 @@
-#!/usr/bin/env node
-/**
- * Wrapper for @azure-devops/mcp that fetches an ADO token via the shared
- * az-first provider chain and sets AZURE_DEVOPS_EXT_PAT before launching the
- * MCP server.
- *
- * P-b3f8e1a5: @azure-devops/mcp is pinned in package.json and resolved from
- * local node_modules. We spawn process.execPath against the resolved bin file
- * instead of going through npx/npx.cmd. This (a) eliminates the per-cold-start
- * network fetch that ran with AZURE_DEVOPS_EXT_PAT in env, and (b) avoids the
- * Windows .cmd shim chain that crashes the runtime under spawn.
- */
-const { spawn } = require('child_process');
-const fs = require('fs');
-const path = require('path');
-const { acquireAdoTokenSync } = require('./ado-token');
-
-const PKG_NAME = '@azure-devops/mcp';
-const BIN_NAME = 'mcp-server-azuredevops';
-
-function resolveMcpBin() {
-  const pkgJsonPath = require.resolve(`${PKG_NAME}/package.json`);
-  const pkgJson = JSON.parse(fs.readFileSync(pkgJsonPath, 'utf8'));
-  const binField = pkgJson.bin;
-  const relBin = typeof binField === 'string' ? binField : binField && binField[BIN_NAME];
-  if (!relBin) {
-    throw new Error(`${PKG_NAME} package.json is missing bin entry "${BIN_NAME}"`);
-  }
-  return path.resolve(path.dirname(pkgJsonPath), relBin);
-}
-
-let token;
-try {
-  token = acquireAdoTokenSync().token;
-} catch (e) {
-  process.stderr.write('ado-mcp-wrapper: ADO auth failed: ' + e.message + '\n');
-  process.stderr.write('ado-mcp-wrapper: Run "az login" or refresh azureauth manually, then retry\n');
-  process.exit(1);
-}
-
-let binPath;
-try {
-  binPath = resolveMcpBin();
-} catch (e) {
-  process.stderr.write('ado-mcp-wrapper: failed to resolve ' + PKG_NAME + ': ' + e.message + '\n');
-  process.stderr.write('ado-mcp-wrapper: run "npm install" in the minions checkout to restore the pinned dependency\n');
-  process.exit(1);
-}
-
-const args = process.argv.slice(2);
-const child = spawn(process.execPath, [binPath, ...args], {
-  stdio: 'inherit',
-  env: { ...process.env, AZURE_DEVOPS_EXT_PAT: token, AZURE_DEVOPS_EXT_AZURE_RM_PAT: token },
-  windowsHide: true,
-  shell: false,
-});
-
-child.on('exit', (code) => process.exit(code || 0));
-child.on('error', (err) => {
-  process.stderr.write('ado-mcp-wrapper: ' + err.message + '\n');
-  process.exit(1);
-});
-