@yemi33/minions 0.1.2190 → 0.1.2191

package/dashboard.js

@@ -1269,6 +1269,12 @@ function _scanProjectLocalHarnessFootgun(project) {
       encoding: 'utf8',
       stdio: ['ignore', 'pipe', 'ignore'],
       timeout: 10000,
+      // W-mqecdoot — MUST set windowsHide. This runs per-project on every
+      // GET /api/harness/diagnostics hit (Tools/Harness page, polled), and a
+      // detached dashboard has no console — so without this each call pops a
+      // visible git.exe console window per project ("infinite git windows").
+      // This was the only git spawn in the codebase missing windowsHide.
+      windowsHide: true,
     });
   } catch { return out; }
   if (!raw) return out;

package/engine/cleanup.js

@@ -637,7 +637,30 @@ async function runCleanup(config, verbose = false) {
       for (const entry of entries) {
         if (!entry.isDirectory()) continue;
         const full = path.resolve(wtRoot, entry.name);
+        // Defensive boundary: only ever delete strictly inside the worktree
+        // root we enumerated. readdirSync never yields `..`, so this is always
+        // true today — but it makes the "never escape wtRoot" invariant
+        // explicit and immune to a future refactor of how `full` is derived.
+        if (full !== wtRoot && !full.startsWith(wtRoot + path.sep)) continue;
         if (registered.has(full)) continue;
+        // W-mqecdoot — ownership gate, parity with the out-of-root worktree GC
+        // (worktree-gc.pruneOrphanWorktreesFromGitRegistry). Only ever reap a
+        // dir the engine positively created (carries the `.minions-worktree`
+        // marker stamped right after `git worktree add`). A dir with NO marker
+        // is a human's hand-made worktree (`git worktree add ../worktrees/mine`)
+        // or some unrelated folder dropped into the worktree root — KEEP it,
+        // never delete. Fail-open: leak a husk rather than nuke someone's
+        // unpushed work. This closes the same data-loss class the marker fixed
+        // for the registry sweep, for this on-disk-dir sweep too. The cost is
+        // that empty leftover husks whose marker was already removed leak
+        // instead of being reaped — an acceptable trade for "absolutely never
+        // delete foreign data".
+        let owned = false;
+        try { owned = !!shared.hasWorktreeOwnerMarker(full); } catch { owned = false; }
+        if (!owned) {
+          log('debug', `Cleanup: keeping orphan worktree dir ${full} — no engine ownership marker (foreign/hand-made worktree)`);
+          continue;
+        }
         let stat; try { stat = fs.statSync(full); } catch { continue; }
         if (stat.mtimeMs >= _twoHoursAgo) continue;
         // W-mq5rwwss000f30a7 — even an "orphan" dir (one git doesn't know

package/engine/operator-identity.js

@@ -27,6 +27,7 @@ function _execImpl(cmd) {
       encoding: 'utf8',
       stdio: ['ignore', 'pipe', 'ignore'],
       timeout: 5000,
+      windowsHide: true,
     })).trim();
   } catch {
     return '';

package/engine/shared.js

@@ -7715,6 +7715,37 @@ function removeWorktree(wtPath, gitRoot, worktreeRoot, opts = {}) {
     log('warn', `removeWorktree: refusing to remove ${wtPath} — not under ${worktreeRoot}`);
     return false;
   }
+  // ── Data-loss hardening (W-mqecdoot) — NEVER recursively delete a real git
+  //    main repository. ──────────────────────────────────────────────────────
+  // The containment check above only proves `resolved` is *under* the
+  // caller-supplied `worktreeRoot`. Several callers derive that root from
+  // `config.engine.worktreeRoot` (default '../worktrees') — e.g. the cleanup
+  // orphan-reaper and projects.removeProject §3 readdir the root and call us on
+  // every child. A misconfigured `worktreeRoot` like '..' (or a project
+  // localPath placed one level too high) makes a sibling REAL repo pass
+  // containment; `git worktree remove --force` then FAILS (it isn't a linked
+  // worktree) and we fall through to fs.rmSync / `rd /s /q`, nuking the repo
+  // and its history. This is the reported incident (.git + repo dir gone). Two
+  // refusals below, both with zero false positives for legitimate linked-
+  // worktree removal:
+  //   1. The target IS the git root we were handed (deleting the repo itself).
+  //   2. The target carries its own `.git` DIRECTORY. A linked worktree's
+  //      `.git` is ALWAYS a FILE (a `gitdir:` pointer); only a main checkout
+  //      has a `.git` directory — so this can never block a real worktree wipe.
+  try {
+    if (gitRoot && resolved === path.resolve(String(gitRoot))) {
+      log('warn', `removeWorktree: refusing to remove ${wtPath} — it is the project git root, not a worktree`);
+      return false;
+    }
+  } catch { /* bad gitRoot — fall through to the .git probe */ }
+  try {
+    const st = fs.lstatSync(path.join(resolved, '.git'));
+    if (st && st.isDirectory()) {
+      log('warn', `removeWorktree: refusing to remove ${wtPath} — it is a real git repo (.git is a directory, not a linked-worktree pointer)`);
+      try { bumpWorktreeGcMetric('refusedRealRepo'); } catch { /* metric optional */ }
+      return false;
+    }
+  } catch { /* no .git, or unreadable — normal worktree husk; continue */ }
   // W-mq5rwwss000f30a7 — never wipe a worktree while an agent is actively
   // dispatched inside it. isWorktreePathLive fails OPEN (returns true) when
   // the dispatches table is unreachable, so we err on the side of leaking

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yemi33/minions",
-  "version": "0.1.2190",
+  "version": "0.1.2191",
   "description": "Multi-agent AI dev team that runs from ~/.minions/ — five autonomous agents share a single engine, dashboard, and knowledge base",
   "bin": {
     "minions": "bin/minions.js"