@yemi33/minions 0.1.2201 → 0.1.2202

package/engine/consolidation.js

@@ -16,6 +16,55 @@ const { getInboxFiles, getNotes, INBOX_DIR, ENGINE_DIR,
   NOTES_PATH, KNOWLEDGE_DIR, ARCHIVE_DIR } = queries;
 const { wrapUntrusted, buildSource } = require('./untrusted-fence');
 
+// notes.md size cap. Consolidation appends to notes.md every cycle; without a
+// cap it grows unbounded.
+const NOTES_MAX_BYTES = 50000;
+
+// DATA-LOSS GUARD: cap notes.md size WITHOUT silently discarding the pruned
+// content. The previous behavior sliced notes.md at a section boundary and
+// wrote the shorter string back with no backup — so once notes.md crossed the
+// cap, every consolidation cycle permanently dropped the oldest human/agent
+// broadcast notes. This trims to the cap AND appends every dropped section to
+// an overflow archive (notes/archive/notes-overflow.md), so consolidated notes
+// are always recoverable (consistent with how inbox notes are archived, not
+// deleted). Both consolidation paths (LLM + regex fallback) route through it.
+// Returns the trimmed notes string. Callers must already hold the notes.md lock.
+function _capNotesPreservingOverflow(newContent) {
+  if (newContent.length <= NOTES_MAX_BYTES) return newContent;
+  let kept = newContent;
+  let dropped = '';
+  const lastBoundary = newContent.lastIndexOf('\n---\n\n### ', NOTES_MAX_BYTES);
+  if (lastBoundary > 0) {
+    kept = newContent.slice(0, lastBoundary);
+    dropped = newContent.slice(lastBoundary);
+    log('info', `Capped notes.md at section boundary (pos ${lastBoundary}); overflow archived`);
+  } else {
+    // No section boundary before the cap — fall back to keeping header + the
+    // most recent sections, archiving the middle.
+    const sections = newContent.split('\n---\n\n### ');
+    if (sections.length > 10) {
+      kept = sections[0] + '\n---\n\n### ' + sections.slice(-8).join('\n---\n\n### ');
+      const middle = sections.slice(1, -8);
+      if (middle.length) dropped = '\n---\n\n### ' + middle.join('\n---\n\n### ');
+      log('info', `Capped notes.md: ${middle.length} old section(s) archived to overflow`);
+    }
+  }
+  if (dropped.trim()) {
+    try {
+      const overflowPath = path.join(ARCHIVE_DIR, 'notes-overflow.md');
+      shared.mutateTextFileLocked(overflowPath, prev =>
+        (prev || '# notes.md overflow — auto-archived when notes.md exceeded its size cap\n')
+        + '\n' + dropped.trim() + '\n', { defaultValue: '' });
+    } catch (e) {
+      // If the archive write fails, DON'T trim — returning the full content
+      // keeps notes.md oversized but loses nothing. Loud warn so it's visible.
+      log('warn', `notes.md overflow archive failed; leaving notes.md uncapped to avoid loss: ${e.message}`);
+      return newContent;
+    }
+  }
+  return kept;
+}
+
 // Per-agent memory files live under knowledge/agents/<agent>.md and are
 // injected into individual agent prompts (in addition to the broadcast
 // notes.md). See knowledge/agents/README.md for the convention.
@@ -900,28 +949,9 @@ function consolidateWithLLM(items, existingNotes, files, config) {
       // Wrap read-modify-write in file lock to prevent race with concurrent consolidation or manual edits
       shared.withFileLock(NOTES_PATH + '.lock', () => {
         const current = getNotes() || '';
-        let newContent = current + entry;
-
-        if (newContent.length > 50000) {
-          // Truncate on section boundary — scan backward for last \n# before byte limit
-          // Never cut mid-section to preserve readability
-          const limit = 50000;
-          const lastSectionBoundary = newContent.lastIndexOf('\n---\n\n### ', limit);
-          if (lastSectionBoundary > 0) {
-            newContent = newContent.slice(0, lastSectionBoundary);
-            log('info', `Pruned notes.md at section boundary (pos ${lastSectionBoundary}) to stay under ${limit} bytes`);
-          } else {
-            // Fallback: use the old section-count approach
-            const sections = newContent.split('\n---\n\n### ');
-            if (sections.length > 10) {
-              const header = sections[0];
-              const recent = sections.slice(-8);
-              newContent = header + '\n---\n\n### ' + recent.join('\n---\n\n### ');
-              log('info', `Pruned notes.md: removed ${sections.length - 9} old sections`);
-            }
-          }
-        }
-
+        // DATA-LOSS GUARD: cap size but archive the overflow instead of
+        // silently discarding it (see _capNotesPreservingOverflow).
+        const newContent = _capNotesPreservingOverflow(current + entry);
         safeWrite(NOTES_PATH, newContent);
       });
       classifyToKnowledgeBase(items, config);
@@ -1040,17 +1070,8 @@ function consolidateWithRegex(items, files, config) {
   // Wrap read-modify-write in file lock to prevent race with concurrent consolidation or manual edits
   shared.withFileLock(NOTES_PATH + '.lock', () => {
     const current = getNotes() || '';
-    let newContent = current + entry;
-    if (newContent.length > 50000) {
-      const limit = 50000;
-      const lastBoundary = newContent.lastIndexOf('\n---\n\n### ', limit);
-      if (lastBoundary > 0) {
-        newContent = newContent.slice(0, lastBoundary);
-      } else {
-        const sections = newContent.split('\n---\n\n### ');
-        if (sections.length > 10) { newContent = sections[0] + '\n---\n\n### ' + sections.slice(-8).join('\n---\n\n### '); }
-      }
-    }
+    // DATA-LOSS GUARD: cap size but archive the overflow (see LLM path).
+    const newContent = _capNotesPreservingOverflow(current + entry);
     safeWrite(NOTES_PATH, newContent);
   });
   classifyToKnowledgeBase(items, config);
@@ -1222,4 +1243,6 @@ module.exports = {
   consolidateWithLLM,
   consolidateWithRegex,
   archiveInboxFiles,
+  _capNotesPreservingOverflow,
+  NOTES_MAX_BYTES,
 };

package/engine.js

@@ -1459,7 +1459,14 @@ async function _quarantineDirtyWorktree(rootDir, worktreePath, branchName, gitOp
   // the rename path would produce, just without the recovery dir.
   let forceRemoved = false;
   let forceRemoveError = null;
-  if (renameError && ENGINE_DEFAULTS.quarantineForceRemoveFallback) {
+  // DATA-LOSS GUARD (W-mq5rwwss): only force-remove when we captured HEAD above.
+  // The backup ref written below (refs/minions/quarantine/...) is the only thing
+  // preserving this worktree's unpushed commits once the tree is destroyed — and
+  // it can only be written if `headSha` was read. If rev-parse HEAD failed (the
+  // corrupted/locked-tree path), force-removing would destroy the sole pointer to
+  // unpushed work. In that case skip the force-remove and fall through to the
+  // env-blocked inbox alert so the operator can recover the tree by hand.
+  if (renameError && ENGINE_DEFAULTS.quarantineForceRemoveFallback && headSha) {
     log('warn', `_quarantineDirtyWorktree: rename failed after ${renameAttempts || ENGINE_DEFAULTS.quarantineRenameRetryAttempts} attempt(s) (${renameError.code || renameError.message}); falling back to git worktree remove --force`);
     try {
       await shared.shellSafeGit(['worktree', 'remove', '--force', worktreePath], { ...gitOpts, cwd: rootDir, timeout: 30000 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yemi33/minions",
-  "version": "0.1.2201",
+  "version": "0.1.2202",
   "description": "Multi-agent AI dev team that runs from ~/.minions/ — five autonomous agents share a single engine, dashboard, and knowledge base",
   "bin": {
     "minions": "bin/minions.js"