@yemi33/minions 0.1.2240 → 0.1.2242

package/bin/minions.js

@@ -1358,6 +1358,15 @@ ${fs.existsSync(path.join(PKG_ROOT, '.git')) ? `
   // Clear stale beacons AFTER the kill so the old dashboard's last writes
   // can't repopulate the file in the gap between clear and shutdown.
   _clearDashboardBrowserState(MINIONS_HOME);
+  // Respawn-race guard: the watchdog (or a surviving supervisor) can spawn a
+  // fresh engine/dashboard during the kill→spawn window — those become ORPHANS
+  // the new stack never reaps, and orphan engines keep dispatching agents +
+  // spawning copilot (the root of the recurring multi-engine / MCP-auth storms).
+  // stop-intent is STILL set here, so any respawn has already stood down or is
+  // about to; reap once more so the stack we spawn below is the ONLY one. Scoped
+  // by command-line to engine/dashboard/supervisor — never touches agent/copilot
+  // children, preserving the re-attach invariant.
+  killMinionsProcesses(['engine.js', 'dashboard.js', 'supervisor.js']);
   // Clear stop-intent so the freshly-spawned supervisor resumes guarding.
   clearStopIntent();
   spawnFullStackAndVerify({ rest, forceOpen, dashWasUp, restartStartMs });

package/dashboard.js

@@ -14178,6 +14178,14 @@ if (require.main === module) {
   // engine reads, port binding) is captured rather than dying silently.
   _installCrashHandlers();
 
+  // Every copilot the dashboard spawns — Command Center, doc-chat, and the CC
+  // worker pool (`copilot --acp`) — inherits this process's COPILOT_HOME. Point
+  // it at the seeded, MCP-filtered home so those `direct:true` copilot calls
+  // load the filtered config instead of the operator's full `~/.copilot` stack
+  // (which would pop a Microsoft auth window per call). Mirrors the engine's
+  // boot-time set. See shared.ensureAgentCopilotHome. Fail-open.
+  try { process.env.COPILOT_HOME = shared.ensureAgentCopilotHome(MINIONS_DIR, CONFIG?.engine); } catch {}
+
   // Pre-warm the per-project git-status cache before accepting requests so
   // the first /api/status after restart already returns gitState='ok' with a
   // real branch instead of the ~8s pending gap that hides the projects-bar

package/engine/shared.js

@@ -5666,6 +5666,64 @@ function resolveAgentCopilotHome(minionsDir) {
   return path.join(base, '.minions-agent-copilot-home');
 }
 
+/**
+ * Derive a scratch/temp base dir on the same volume agent work already lives on
+ * — the configured worktree location (engine.worktreeRoot, default
+ * `../worktrees`). Agents (copilot/node/git + JVM-based MCP servers) write heavy
+ * temp under %TEMP% / $TMPDIR; when that resolves to a full system drive (e.g.
+ * C:), operations thrash or fail and routinely overrun the CLI's per-command
+ * timeout, surfacing to the operator as "Operation cancelled". Anchoring agent
+ * temp next to the worktrees keeps scratch on the operator's work volume with NO
+ * config knob and NO hardcoded path — it simply follows wherever worktrees
+ * already go (a location the operator already placed off the system drive).
+ *
+ * Returns an absolute dir path, or null when no anchor can be resolved — callers
+ * MUST treat null as "leave the inherited TEMP untouched" (fail-open).
+ */
+function resolveAgentTempBaseDir(project, engine, minionsDir) {
+  let projectRoot;
+  try { projectRoot = resolveProjectRootDir(project && project.localPath, minionsDir); }
+  catch { return null; }
+  const wtRel = (engine && engine.worktreeRoot) || ENGINE_DEFAULTS.worktreeRoot;
+  let anchor;
+  try { anchor = path.resolve(projectRoot, wtRel); } catch { return null; }
+  return path.join(anchor, '.agent-temp');
+}
+
+// Seed the agent COPILOT_HOME's mcp-config (copy of `~/.copilot/mcp-config.json`
+// MINUS `engine.copilotAgentDisabledMcpServers`) and return the home path. This
+// is the single source of truth for "what MCP servers may a minions-spawned
+// copilot load." It is applied to EVERY copilot spawn path — agent dispatches
+// (engine), internal `llm.callLLM` calls (engine), and CC / doc-chat / the CC
+// worker pool (dashboard) — by setting `process.env.COPILOT_HOME` at the boot of
+// both processes, so every copilot CHILD inherits the filtered config. copilot
+// SPAWNS every server in its config and authenticates it (`--disable-mcp-server`
+// only hides tools), so any auth-requiring server pops a Microsoft window per
+// spawn — filtering the config is the only effective control. Idempotent: writes
+// only when the content changes (safe under concurrent callers). The operator's
+// real `~/.copilot` (interactive copilot) is never touched. Fail-open.
+function ensureAgentCopilotHome(minionsDir, engine) {
+  const home = resolveAgentCopilotHome(minionsDir);
+  try {
+    fs.mkdirSync(home, { recursive: true });
+    const disabled = new Set(resolveCopilotAgentDisabledMcpServers(null, engine));
+    let servers = {};
+    try {
+      const userCfgPath = path.join(os.homedir(), '.copilot', 'mcp-config.json');
+      const userCfg = JSON.parse(fs.readFileSync(userCfgPath, 'utf8').replace(/^/, ''));
+      for (const [name, def] of Object.entries(userCfg.mcpServers || {})) {
+        if (!disabled.has(name)) servers[name] = def;
+      }
+    } catch { servers = {}; /* no/unreadable user config → no MCPs */ }
+    const desired = JSON.stringify({ mcpServers: servers }, null, 2);
+    const cfgFile = path.join(home, 'mcp-config.json');
+    let current = null;
+    try { current = fs.readFileSync(cfgFile, 'utf8'); } catch {}
+    if (current !== desired) fs.writeFileSync(cfgFile, desired);
+  } catch { /* fail-open: leave whatever home/config exists */ }
+  return home;
+}
+
 // ── Spawn cwd vs worktree placement (W-mp73x32w000l143d) ──────────────────────
 // Work types that don't need a git worktree — they read repo state but don't
 // produce code changes. Centralized here so engine.js spawnAgent and any
@@ -8961,6 +9019,8 @@ module.exports = {
   assertWorktreeOutsideProject,
   resolveProjectRootDir,
   resolveAgentCopilotHome,
+  resolveAgentTempBaseDir,
+  ensureAgentCopilotHome,
   resolveSpawnPaths,
   validateWorkItemWorkdir,
   applyWorkdir,

package/engine.js

@@ -1907,27 +1907,31 @@ async function recoverPartialWorktree(rootDir, worktreePath, branchName, gitOpts
 // real ~/.copilot is untouched. Best-effort/fail-open: any failure leaves the
 // inherited COPILOT_HOME so a hiccup never blocks a dispatch.
 function _applyAgentCopilotHome(childEnv) {
+  // Re-seed (picks up Settings changes to the disabled list) + stamp the env.
+  // process.env.COPILOT_HOME is also set at engine boot (see below) so the
+  // child would inherit it anyway; this is belt-and-suspenders + keeps the
+  // seed fresh per dispatch. See shared.ensureAgentCopilotHome.
+  try { childEnv.COPILOT_HOME = shared.ensureAgentCopilotHome(MINIONS_DIR, getConfig()?.engine); }
+  catch { /* leave inherited COPILOT_HOME untouched */ }
+}
+
+// Point a spawned agent's TEMP/TMP/TMPDIR at a scratch dir on the worktree
+// volume instead of the (often full) system drive — see
+// shared.resolveAgentTempBaseDir. copilot/node/git + JVM-based MCP servers write
+// heavy temp there; on a full C: that thrashes and overruns the CLI's per-command
+// timeout ("Operation cancelled"). Best-effort + fail-open: any resolution/mkdir
+// failure leaves the inherited TEMP in place. Sets all three vars to cover
+// Windows (TEMP/TMP) and POSIX (TMPDIR).
+function _applyAgentTempEnv(childEnv, project) {
   try {
-    const home = shared.resolveAgentCopilotHome(MINIONS_DIR);
-    fs.mkdirSync(home, { recursive: true });
-    const disabled = new Set(shared.resolveCopilotAgentDisabledMcpServers(null, getConfig()?.engine));
-    let servers = {};
-    try {
-      const userCfgPath = path.join(os.homedir(), '.copilot', 'mcp-config.json');
-      const userCfg = JSON.parse(fs.readFileSync(userCfgPath, 'utf8').replace(/^/, ''));
-      for (const [name, def] of Object.entries(userCfg.mcpServers || {})) {
-        if (!disabled.has(name)) servers[name] = def;
-      }
-    } catch { servers = {}; /* no/unreadable user config → agents get no MCPs */ }
-    // Write only when the content changes — keeps concurrent spawns from racing
-    // on the shared file (the engine-level list is identical across agents).
-    const desired = JSON.stringify({ mcpServers: servers }, null, 2);
-    const cfgFile = path.join(home, 'mcp-config.json');
-    let current = null;
-    try { current = fs.readFileSync(cfgFile, 'utf8'); } catch {}
-    if (current !== desired) fs.writeFileSync(cfgFile, desired);
-    childEnv.COPILOT_HOME = home;
-  } catch { /* leave inherited COPILOT_HOME untouched */ }
+    const agentTmp = shared.resolveAgentTempBaseDir(project, getConfig()?.engine, MINIONS_DIR);
+    if (agentTmp) {
+      fs.mkdirSync(agentTmp, { recursive: true });
+      childEnv.TEMP = agentTmp;
+      childEnv.TMP = agentTmp;
+      childEnv.TMPDIR = agentTmp;
+    }
+  } catch { /* leave inherited TEMP untouched */ }
 }
 
 async function spawnAgent(dispatchItem, config) {
@@ -3765,6 +3769,9 @@ async function spawnAgent(dispatchItem, config) {
   // MCP-free copilot config so agents never pop a per-spawn Microsoft auth
   // window — see _applyAgentCopilotHome / shared.resolveAgentCopilotHome.
   _applyAgentCopilotHome(childEnv);
+  // Keep agent scratch off a (possibly full) system drive — anchors TEMP/TMP to
+  // the worktree volume. See _applyAgentTempEnv / shared.resolveAgentTempBaseDir.
+  _applyAgentTempEnv(childEnv, project);
 
   if (getRepoHost(project) === 'ado') {
     // Inject cached ADO token so ADO agents skip re-authentication (#998).
@@ -4277,6 +4284,8 @@ async function spawnAgent(dispatchItem, config) {
       childEnv.MINIONS_NO_AUTO_OPEN = '1';
       // Same MCP-free copilot home on steering resume (see the initial spawn site).
       _applyAgentCopilotHome(childEnv);
+      // Same agent-scratch redirect on steering resume.
+      _applyAgentTempEnv(childEnv, project);
       if (getRepoHost(project) === 'ado') {
         // Inject cached ADO token for steering session too (#998)
         try {
@@ -10273,6 +10282,14 @@ module.exports = {
 // ─── Entrypoint ─────────────────────────────────────────────────────────────
 
 if (require.main === module) {
+  // Every copilot this process spawns — agent dispatches AND internal
+  // `llm.callLLM` calls (consolidation, classification, meetings, …) — inherits
+  // this process's COPILOT_HOME, so point it at the seeded, MCP-filtered home.
+  // Without this, those `direct:true` copilot calls load the operator's full
+  // `~/.copilot` stack and pop a Microsoft auth window per call. The dashboard
+  // sets the same at its own boot for CC / doc-chat / the CC worker pool.
+  // See shared.ensureAgentCopilotHome. Fail-open.
+  try { process.env.COPILOT_HOME = shared.ensureAgentCopilotHome(MINIONS_DIR, getConfig()?.engine); } catch {}
   const { handleCommand } = require('./engine/cli');
   const [cmd, ...args] = process.argv.slice(2);
   handleCommand(cmd, args);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yemi33/minions",
-  "version": "0.1.2240",
+  "version": "0.1.2242",
   "description": "Multi-agent AI dev team that runs from ~/.minions/ — five autonomous agents share a single engine, dashboard, and knowledge base",
   "bin": {
     "minions": "bin/minions.js"