@yemi33/minions 0.1.2249 → 0.1.2250

package/dashboard/js/render-prs.js

@@ -59,9 +59,13 @@ async function fetchPullRequestsFromDisk(projects) {
   return out;
 }
 
+// Terminal statuses — follow-up WIs in these states are historical, not active.
+var _WI_TERMINAL = new Set(['done', 'cancelled', 'failed', 'decomposed', 'in-pr', 'implemented', 'complete']);
+
 function _countPrFollowups(pr) {
-  // PR follow-up chip (W-mpej3cox00099466) — counts WIs whose
-  // meta.pr_followup.parent_pr_url or parent_pr_id matches this PR.
+  // PR follow-up chip (W-mpej3cox00099466) — counts ACTIVE (non-terminal) WIs
+  // whose meta.pr_followup.parent_pr_url or parent_pr_id matches this PR.
+  // Terminal WIs (done/cancelled/failed) are excluded to avoid stale noise.
   if (!pr) return 0;
   var wis = (window._lastWorkItems) || [];
   if (!wis.length) return 0;
@@ -69,7 +73,9 @@ function _countPrFollowups(pr) {
   var prId = pr.id || '';
   var n = 0;
   for (var i = 0; i < wis.length; i++) {
-    var f = wis[i] && wis[i].meta && wis[i].meta.pr_followup;
+    var wi = wis[i];
+    if (!wi || _WI_TERMINAL.has(wi.status)) continue;
+    var f = wi.meta && wi.meta.pr_followup;
     if (!f) continue;
     if (prUrl && f.parent_pr_url === prUrl) { n++; continue; }
     if (prId && f.parent_pr_id === prId) { n++; }
@@ -114,7 +120,7 @@ function prRow(pr) {
     : '';
   var followupCount = _countPrFollowups(pr);
   var followupChip = followupCount > 0
-    ? ' <span class="pr-badge draft" style="font-size:var(--text-xs)" title="' + followupCount + ' follow-up work item(s) dispatched from comments on this PR">+' + followupCount + ' follow-up' + (followupCount === 1 ? '' : 's') + '</span>'
+    ? ' <span class="pr-badge draft" style="font-size:var(--text-xs)" title="' + followupCount + ' active follow-up work item(s) in progress from comments on this PR">+' + followupCount + ' follow-up' + (followupCount === 1 ? '' : 's') + '</span>'
     : '';
   // Issue #2969 — paused-cause chip(s). Prefer the API-enriched _pausedCauses
   // field; fall back to deriving from _noOpFixes for the /state/ disk-fetch

package/engine/ado-git-auth.js

@@ -210,7 +210,8 @@ function isAdoAuthFailure(err) {
 
 function _redactBearer(s) {
   if (typeof s !== 'string') return s;
-  return s.replace(/Authorization:\s*Bearer\s+[A-Za-z0-9._\-]+/gi, 'Authorization: Bearer [REDACTED]');
+  // W-mqrb8okm — include +/= so base64-padded ADO tokens are fully redacted
+  return s.replace(/Authorization:\s*Bearer\s+[A-Za-z0-9+/=._\-]+/gi, 'Authorization: Bearer [REDACTED]');
 }
 
 function _redactErrorInPlace(err) {

package/engine/ado.js

@@ -1207,22 +1207,28 @@ async function forEachActivePr(config, token, callback) {
   //   3. The repo-host filter is explicit (repoHost === 'ado') so a future
   //      central poll that loops over both forks doesn't accidentally treat
   //      github PRs as ADO records.
-  //   4. Already-configured PRs are skipped (isPrCompatibleWithProject against
-  //      any configured ADO project) so we never double-poll PRs that the
-  //      project loop above already handled.
+  //   4. Already-configured PRs are skipped only when they are actually present
+  //      in that project's per-project file, so the project loop will really see
+  //      them. Blindly skipping all project-compatible IDs caused a permanent
+  //      orphan when the record lived in the central file (#328).
   const centralPath = path.join(shared.MINIONS_DIR, 'pull-requests.json');
   const centralPrs = shared.safeJsonArr(centralPath);
   const configuredAdoProjects = projects.filter(p => !isGitHubProject(p) && p.adoOrg && p.adoProject);
-  const isConfiguredAdoCanonical = (canonicalId) => {
-    if (!canonicalId) return false;
-    return configuredAdoProjects.some(p => shared.isPrCompatibleWithProject(p, { id: canonicalId }, ''));
-  };
 
   const activeCentral = centralPrs.filter(pr => {
     if (!shared.PR_POLLABLE_STATUSES.has(pr.status)) return false;
     if (String(pr.repoHost || 'ado').toLowerCase() !== 'ado') return false;
     if (!parseCanonicalAdoPrId(pr.id, 'central ADO PR poll')) return false;
-    if (isConfiguredAdoCanonical(pr.id)) return false;
+    // Only defer to the project loop when the PR is ACTUALLY present in that
+    // project's per-project file. Unconditionally skipping all project-compatible
+    // PRs caused a permanent orphan: the project loop never read the central file,
+    // so a PR stored centrally but compatible with a configured project was never
+    // polled (fix for #328).
+    const owningProject = configuredAdoProjects.find(p => shared.isPrCompatibleWithProject(p, { id: pr.id }, ''));
+    if (owningProject) {
+      const projectPrs = shared.safeJsonArr(shared.projectPrPath(owningProject));
+      if (projectPrs.some(p => p.id === pr.id)) return false; // present in per-project file → project loop handles it
+    }
     return true;
   });
 

package/engine/dispatch.js

@@ -602,6 +602,9 @@ function writeFailedAgentReport(item, reason, resultSummary, failureClass) {
     log('warn', 'Cannot write failed agent report without dispatch id');
     return;
   }
+  // W-mqrb8okm — redact bearer tokens before writing to inbox notes
+  const safeReason = reason ? shared.redactSecrets(reason) : reason;
+  const safeSummary = resultSummary ? shared.redactSecrets(resultSummary) : resultSummary;
   const agentId = item.agent || 'engine';
   const itemId = item.meta?.item?.id || '';
   const title = item.meta?.item?.title || item.task || item.id;
@@ -620,9 +623,9 @@ function writeFailedAgentReport(item, reason, resultSummary, failureClass) {
     `**Type:** ${item.type || 'unknown'}`,
     `**Result:** ${DISPATCH_RESULT.ERROR}`,
     failureClass ? `**Failure Class:** ${failureClass}` : '',
-    reason ? `**Reason:** ${reason}` : '',
+    safeReason ? `**Reason:** ${safeReason}` : '',
     '',
-    resultSummary ? `## Summary\n${resultSummary}` : '## Summary\n(no agent summary captured)',
+    safeSummary ? `## Summary\n${safeSummary}` : '## Summary\n(no agent summary captured)',
   ].filter(Boolean).join('\n');
   shared.writeToInbox(agentId, `agent-failure-${item.id}`, content, null, metadata);
 }
@@ -1164,4 +1167,5 @@ module.exports = {
   isCompletedWorkItemForFailure,
   _isPrdSourcedAndVetted,
   NON_MUTATING_DISPATCH_TYPES,
+  writeFailedAgentReport,
 };

package/engine/github.js

@@ -594,7 +594,25 @@ async function forEachActiveGhPr(config, callback) {
   // Also poll manually-linked PRs from central pull-requests.json (extract slug from URL)
   const centralPath = path.join(MINIONS_DIR, 'pull-requests.json');
   const centralPrs = safeJsonArr(centralPath);
-  const activeCentral = centralPrs.filter(pr => PR_POLLABLE_STATUSES.has(pr.status) && pr.url);
+  // Build a slug→project map for configured GitHub projects so we can detect
+  // PRs that are actually owned by the project loop (present in per-project file).
+  const configuredGhProjectsBySlug = new Map(projects.map(p => [getRepoSlug(p), p]));
+  const activeCentral = centralPrs.filter(pr => {
+    if (!PR_POLLABLE_STATUSES.has(pr.status)) return false;
+    if (!pr.url) return false;
+    // Symmetric fix for #328: only defer to the project loop when the PR is
+    // ACTUALLY present in that project's per-project file. If it's absent there,
+    // the project loop will never see it — the central branch must poll it.
+    const ghMatch = pr.url.match(/github\.com\/([^/]+\/[^/]+)\/pull\/\d+/);
+    if (ghMatch) {
+      const owningProject = configuredGhProjectsBySlug.get(ghMatch[1]);
+      if (owningProject) {
+        const projectPrs = safeJsonArr(projectPrPath(owningProject));
+        if (projectPrs.some(p => p.id === pr.id)) return false; // present → project loop handles it
+      }
+    }
+    return true;
+  });
 
   // W-mp5trwh60008386d: probe each unique slug in the central list ONCE before iterating PRs.
   // Without this gate, central PRs would inherit the same per-PR 404 trapdoor that project-local

package/engine/lifecycle.js

@@ -720,7 +720,8 @@ function updateWorkItemStatus(meta, status, reason) {
           delete target._noopReason;
         }
       } else if (status === WI_STATUS.FAILED) {
-        if (reason) target.failReason = reason;
+        // W-mqrb8okm — redact bearer tokens from reason before persisting as failReason
+        if (reason) target.failReason = shared.redactSecrets(reason);
         target.failedAt = ts();
       }
     }

package/engine/shared.js

@@ -403,6 +403,19 @@ function _redactString(s, options = {}) {
     .replace(_JWT_RE, '[REDACTED_JWT]');
 }
 
+// W-mqrb8okm — Redact bearer tokens from git error.message / stdout / stderr
+// in-place. Called from shellSafeGit / shellSafeGitSync catch paths so that ADO
+// -c http.extraHeader=Authorization: Bearer TOKEN args embedded in the
+// "Command failed: git ..." error message are sanitised before the error
+// propagates to callers (who may store it as failReason / inbox notes).
+function _redactGitError(err) {
+  if (!err || typeof err !== 'object') return err;
+  if (err.message) err.message = _redactString(err.message);
+  if (typeof err.stdout === 'string') err.stdout = _redactString(err.stdout);
+  if (typeof err.stderr === 'string') err.stderr = _redactString(err.stderr);
+  return err;
+}
+
 function redactSecrets(value, options = {}) {
   if (value == null) return value;
   if (typeof value === 'string') return _redactString(value, options);
@@ -2342,17 +2355,27 @@ function shellSafeGit(args, opts = {}) {
   // can inject per-invocation `-c key=value` flags (e.g. ADO bearer-token
   // auth header) without rewriting every shellSafeGit call site. Strip the
   // key before delegating so it never reaches Node's execFile options.
-  const { timeout, gitExtraArgs, ...rest } = opts;
+  // W-mqrb8okm — `_execFileAsync` injection point for unit tests; production
+  // callers leave it unset so the module-level promisified execFile is used.
+  const { timeout, gitExtraArgs, _execFileAsync: _execFileOverride, ...rest } = opts;
   const finalArgs = (Array.isArray(gitExtraArgs) && gitExtraArgs.length > 0)
     ? [...gitExtraArgs, ...args]
     : args;
-  return _execFileAsync('git', finalArgs, {
+  const execFn = _execFileOverride || _execFileAsync;
+  return execFn('git', finalArgs, {
     windowsHide: true,
     encoding: 'utf8',
     shell: false,
     ...rest,
     timeout: timeout || 30000,
-  }).then(({ stdout }) => stdout);
+  }).then(({ stdout }) => stdout).catch(err => {
+    // W-mqrb8okm — Redact bearer tokens from git errors before they propagate.
+    // The "Command failed: git ..." message produced by Node's execFile includes
+    // every argv element, so -c http.extraHeader=Authorization: Bearer TOKEN
+    // would end up verbatim in failReason / inbox notes without this guard.
+    _redactGitError(err);
+    throw err;
+  });
 }
 
 // Sync argv-form helper for callers that aren't async (e.g. plan
@@ -2368,14 +2391,19 @@ function shellSafeGitSync(args, opts = {}) {
     ? [...gitExtraArgs, ...args]
     : args;
   const { execFileSync: _execFileSync } = require('child_process');
-  return _execFileSync('git', finalArgs, {
-    windowsHide: true,
-    encoding: 'utf8',
-    shell: false,
-    stdio: 'pipe',
-    ...rest,
-    timeout: timeout || 30000,
-  });
+  try {
+    return _execFileSync('git', finalArgs, {
+      windowsHide: true,
+      encoding: 'utf8',
+      shell: false,
+      stdio: 'pipe',
+      ...rest,
+      timeout: timeout || 30000,
+    });
+  } catch (err) {
+    // W-mqrb8okm — same bearer-token redaction as the async variant.
+    throw _redactGitError(err);
+  }
 }
 
 /**

package/engine.js

@@ -8422,7 +8422,7 @@ function discoverCentralWorkItems(config) {
           item_id: item.id,
           item_name: item.title || item.id,
           item_priority: item.priority || 'medium',
-          item_description: item.description || '',
+          item_description: shared.redactPromptDescription(item.description || ''),
           work_type: workType,
           additional_context: item.prompt ? `## Additional Context\n\n${item.prompt}` : '',
           scope_section: buildProjectContext(dispatchProjects, assignedProject, true, agent.name, agent.role),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yemi33/minions",
-  "version": "0.1.2249",
+  "version": "0.1.2250",
   "description": "Multi-agent AI dev team that runs from ~/.minions/ — five autonomous agents share a single engine, dashboard, and knowledge base",
   "bin": {
     "minions": "bin/minions.js"