@yemi33/minions 0.1.2284 → 0.1.2286

package/dashboard.js

@@ -8022,77 +8022,103 @@ const server = http.createServer(async (req, res) => {
     } catch (e) { return jsonReply(res, 400, { error: e.message }); }
   }
 
+  // Shared by pause + reject (and any future PRD-stop handler): stop a PRD's
+  // materialized work. Kills any active dispatch for the PRD's items, transitions
+  // every non-completed WI sourced from the PRD to `targetStatus`, AND cancels the
+  // still-running plan-to-prd regeneration WI for the PRD's source plan so it can't
+  // silently rebuild the PRD we just paused/rejected. Returns the count of WIs
+  // transitioned. Lockless reads → cleanDispatchEntries (atomic kill + remove) →
+  // mutateWorkItems, mirroring the original pause flow. (RC3 — reject had no
+  // cleanup; pause never stopped regeneration.)
+  function stopPlanMaterializedWork(prdFile, prdSourcePlan, opts) {
+    const targetStatus = opts.targetStatus;
+    const wiPaths = [path.join(MINIONS_DIR, 'work-items.json')];
+    for (const proj of PROJECTS) wiPaths.push(shared.projectWorkItemsPath(proj));
+
+    // Step 1: find dispatched item ids (read-only, no lock).
+    const dispatchedItemIds = new Set();
+    for (const wiPath of wiPaths) {
+      try {
+        for (const w of safeJsonArr(wiPath)) {
+          if (w.sourcePlan !== prdFile) continue;
+          if (w.completedAt || DONE_STATUSES.has(w.status)) continue;
+          if (w.status === WI_STATUS.DISPATCHED && w.id) dispatchedItemIds.add(w.id);
+        }
+      } catch { /* file may not exist */ }
+    }
+
+    // Step 2: kill active dispatches via the canonical primitive (resolves PIDs from
+    // the pid sidecar, kills outside the dispatch lock, removes via mutateDispatch).
+    if (dispatchedItemIds.size > 0) {
+      cleanDispatchEntries((d) => {
+        const itemId = d.meta?.item?.id;
+        if (itemId && dispatchedItemIds.has(itemId)) return true;
+        if (d.meta?.dispatchKey && [...dispatchedItemIds].some(id => d.meta.dispatchKey.includes(id))) return true;
+        return false;
+      });
+    }
+
+    // Step 3: transition WIs per path (each lock held briefly, no nesting).
+    let affected = 0;
+    for (const wiPath of wiPaths) {
+      try {
+        mutateWorkItems(wiPath, items => {
+          for (const w of items) {
+            if (w.sourcePlan !== prdFile) continue;
+            if (w.completedAt || DONE_STATUSES.has(w.status)) continue;
+            if (w.status !== targetStatus) affected++;
+            w.status = targetStatus;
+            if (opts.stampField) w[opts.stampField] = opts.stampValue;
+            delete w._resumedAt;
+            delete w.dispatched_at;
+            delete w.dispatched_to;
+            delete w.failReason;
+            delete w.failedAt;
+          }
+        });
+      } catch (e) { console.error('stopPlanMaterializedWork work items:', e.message); }
+    }
+
+    // Step 4: cancel the still-running plan-to-prd regeneration WI for this source
+    // plan — otherwise a pending/dispatched plan-to-prd run rebuilds the PRD we just
+    // stopped. (delete handles the DONE plan-to-prd WI separately to revert to draft.)
+    if (prdSourcePlan) {
+      try {
+        const centralPath = path.join(MINIONS_DIR, 'work-items.json');
+        mutateWorkItems(centralPath, items => {
+          for (const w of items) {
+            if (w.type === WORK_TYPE.PLAN_TO_PRD && w.planFile === prdSourcePlan &&
+                !DONE_STATUSES.has(w.status) && w.status !== WI_STATUS.CANCELLED) {
+              w.status = WI_STATUS.CANCELLED;
+              w._cancelledBy = opts.stampValue || 'prd-stopped';
+            }
+          }
+        });
+      } catch (e) { console.error('stopPlanMaterializedWork plan-to-prd:', e.message); }
+    }
+    return affected;
+  }
+
   async function handlePlansPause(req, res) {
     try {
       const body = await readBody(req);
       if (!body.file) return jsonReply(res, 400, { error: 'file required' });
       if (!body.file.endsWith('.json')) return jsonReply(res, 400, { error: 'expected a PRD JSON filename (got `' + body.file + '`). Pass prd/<plan>.json, not the source plans/<plan>.md.' });
       const planPath = resolvePlanPath(body.file);
-      mutateJsonFileLocked(planPath, (plan) => {
+      let prdSourcePlan = null;
+      const updated = mutateJsonFileLocked(planPath, (plan) => {
         if (!plan || Array.isArray(plan) || typeof plan !== 'object') plan = {};
         plan.status = 'paused';
         plan.pausedAt = new Date().toISOString();
         return plan;
       }, { defaultValue: {} });
+      prdSourcePlan = updated?.source_plan || null;
 
-      // Propagate pause to materialized work items across all projects:
-      // kill any active agent process and reset non-completed items to paused.
-      // Pattern: lockless reads → cleanDispatchEntries (atomic kill + remove) → mutateWorkItems.
-      const wiPaths = [path.join(MINIONS_DIR, 'work-items.json')];
-      for (const proj of PROJECTS) {
-        wiPaths.push(shared.projectWorkItemsPath(proj));
-      }
-      const dispatchPath = path.join(MINIONS_DIR, 'engine', 'dispatch.json');
-
-      // Step 1: Read work items (read-only, no lock) to find plan items that are dispatched.
-      const dispatchedItemIds = new Set();
-      for (const wiPath of wiPaths) {
-        try {
-          const items = safeJsonArr(wiPath);
-          for (const w of items) {
-            if (w.sourcePlan !== body.file) continue;
-            if (w.completedAt || DONE_STATUSES.has(w.status)) continue;
-            if (w.status === WI_STATUS.DISPATCHED && w.id) dispatchedItemIds.add(w.id);
-          }
-        } catch { /* file may not exist */ }
-      }
-
-      // Step 2: Route PID resolution + kill + dispatch removal through the canonical primitive.
-      // cleanDispatchEntries resolves PIDs from engine/tmp/dispatch-<id>-*/pid-<id>.pid
-      // (see shared.findDispatchPidFile), kills outside the dispatch lock, and removes the
-      // entries via mutateDispatch (SQL + JSON mirror in one atomic write).
-      // The defunct per-agent status sidecar reads/writes that used to live here are gone
-      // (engine/queries.js documents that file no longer exists).
-      if (dispatchedItemIds.size > 0) {
-        const matchFn = (d) => {
-          const itemId = d.meta?.item?.id;
-          if (itemId && dispatchedItemIds.has(itemId)) return true;
-          if (d.meta?.dispatchKey && [...dispatchedItemIds].some(id => d.meta.dispatchKey.includes(id))) return true;
-          return false;
-        };
-        cleanDispatchEntries(matchFn);
-      }
-
-      // Step 3: Mutate work-items.json per path — pause items (each lock held briefly, no nesting).
-      let reset = 0;
-      for (const wiPath of wiPaths) {
-        try {
-          mutateWorkItems(wiPath, items => {
-            for (const w of items) {
-              if (w.sourcePlan !== body.file) continue;
-              if (w.completedAt || DONE_STATUSES.has(w.status)) continue;
-              if (w.status !== WI_STATUS.PAUSED) reset++;
-              w.status = WI_STATUS.PAUSED;
-              w._pausedBy = 'prd-pause';
-              delete w._resumedAt;
-              delete w.dispatched_at;
-              delete w.dispatched_to;
-              delete w.failReason;
-              delete w.failedAt;
-            }
-          });
-        } catch (e) { console.error('reset work items:', e.message); }
-      }
+      // Propagate pause to materialized work items across all projects + cancel the
+      // plan-to-prd regeneration WI so a paused PRD can't be silently rebuilt.
+      const reset = stopPlanMaterializedWork(body.file, prdSourcePlan, {
+        targetStatus: WI_STATUS.PAUSED, stampField: '_pausedBy', stampValue: 'prd-pause',
+      });
 
       invalidateStatusCache();
       invalidatePlansCache();
@@ -8149,8 +8175,17 @@ const server = http.createServer(async (req, res) => {
         return data;
       }, { defaultValue: {} });
 
+      // RC3: reject used to flip only the PRD status — its materialized work items
+      // kept dispatching and any active agent kept running, and a pending plan-to-prd
+      // run could rebuild the PRD. Reject is terminal, so cancel the materialized WIs,
+      // kill active dispatches, and cancel the plan-to-prd regeneration WI.
+      const cancelled = stopPlanMaterializedWork(body.file, plan?.source_plan || null, {
+        targetStatus: WI_STATUS.CANCELLED, stampField: '_cancelledBy', stampValue: 'prd-rejected',
+      });
+
+      invalidateStatusCache();
       invalidatePlansCache();
-      return jsonReply(res, 200, { ok: true, status: 'rejected' });
+      return jsonReply(res, 200, { ok: true, status: 'rejected', cancelledWorkItems: cancelled });
     } catch (e) { return jsonReply(res, 400, { error: e.message }); }
   }
 

package/engine/lifecycle.js

@@ -767,10 +767,17 @@ function syncPrdItemStatus(itemId, status, sourcePlan) {
       // safeJsonNoRestore so an archived PRD's .backup sidecar can't resurrect
       // the active PRD just because a done WI still references it.
       const plan = safeJsonNoRestore(fpath);
+      // Frozen PRDs (paused/rejected/awaiting-approval/completed) must not have
+      // their item statuses mutated by a late-arriving WI status update — that
+      // would silently flip a paused/rejected PRD's items and feed the
+      // materializer. Mirrors the guard reconcilePrdStatuses already has.
+      if (_PRD_FROZEN_STATUSES.has(plan?.status)) continue;
       const feature = plan?.missing_features?.find(f => f.id === itemId);
       if (!feature || feature.status === status) continue;
       let updated = false;
       mutateJsonFileLocked(fpath, (fresh) => {
+        // Re-check under the lock — status may have frozen between peek and lock.
+        if (_PRD_FROZEN_STATUSES.has(fresh?.status)) return fresh;
         const f = fresh?.missing_features?.find(x => x.id === itemId);
         if (f && f.status !== status) {
           f.status = status;

package/engine/shared.js

@@ -1328,7 +1328,12 @@ function forEachPidFile(callback) {
 function neutralizeJsonBackupSidecar(filePath, inertData = { status: 'archived' }) {
   const backupPath = filePath + '.backup';
   try {
-    fs.unlinkSync(backupPath);
+    // Retry the unlink — on Windows a transient EPERM/EBUSY (AV scanner, lagging
+    // OS handle, indexer) otherwise leaves the .backup sidecar in place, and the
+    // next by-name safeJson() resurrects the just-deleted PRD from it. _retryFsOp
+    // rethrows non-retryable codes (e.g. ENOENT) immediately, so the absent path
+    // below still fires for an already-missing sidecar.
+    _retryFsOp(() => fs.unlinkSync(backupPath), `neutralize backup ${path.basename(backupPath)}`);
     return { ok: true, action: 'removed', backupPath };
   } catch (unlinkErr) {
     if (unlinkErr.code === 'ENOENT') return { ok: true, action: 'absent', backupPath };

package/engine.js

@@ -9304,6 +9304,26 @@ let tickCount = 0;
 // In-memory cache of plan filenames confirmed completed — avoids redundant
 // checkPlanCompletion calls.  Cleared automatically on engine restart.
 const completedPlanCache = new Set();
+// Filenames where a live PRD shares a basename with an archived PRD but diverges
+// (different source_plan / introduces new work). We refuse to auto-purge those
+// and warn once instead of every tick. (RC4 — footgun #7 collision protection.)
+const _ghostPurgeCollisionWarned = new Set();
+
+// True when a live PRD that shares a basename with an archived one is merely a
+// stale echo of the archive (a .backup ghost-restore), safe to purge. False when
+// it's a genuinely distinct re-opened PRD that must NOT be silently deleted.
+// Conservative: if either file is unreadable we fall back to the legacy
+// "purge the ghost" behavior so we don't regress resurrection cleanup.
+function _isGhostPrdRestore(live, archived) {
+  if (!live || !archived) return true;
+  const ls = live.source_plan || live.sourcePlan;
+  const as = archived.source_plan || archived.sourcePlan;
+  if (ls && as && ls !== as) return false; // different plan identity → real PRD
+  const archivedIds = new Set((archived.missing_features || []).map(f => f && f.id).filter(Boolean));
+  const hasNewWork = (live.missing_features || []).some(f => f && f.id && !archivedIds.has(f.id));
+  if (hasNewWork) return false; // introduces work the archive never had → real PRD
+  return true; // same identity, no new work → stale echo → ghost
+}
 let lastWatchCheckAt = 0;
 let lastPrStatusPollAt = 0;
 let lastPrCommentsPollAt = 0;
@@ -9722,11 +9742,26 @@ async function tickInner() {
       for (const file of prdFiles) {
         if (completedPlanCache.has(file)) continue;
         if (fs.existsSync(path.join(PRD_DIR, 'archive', file))) {
-          // Orphaned backup restore — plan is already archived. Purge the ghost copy.
-          try { fs.unlinkSync(path.join(PRD_DIR, file)); } catch { }
-          try { fs.unlinkSync(path.join(PRD_DIR, file + '.backup')); } catch { }
-          completedPlanCache.add(file);
-          continue;
+          // A live PRD basename also exists in the archive. Historically this was
+          // unconditionally treated as an orphaned .backup ghost-restore and purged
+          // — but a re-opened plan can legitimately create a NEW live PRD sharing
+          // an archived basename (footgun #7). Identity-check before deleting so we
+          // never silently destroy a real divergent PRD.
+          const liveP = safeJsonNoRestore(path.join(PRD_DIR, file));
+          const archP = safeJsonNoRestore(path.join(PRD_DIR, 'archive', file));
+          if (_isGhostPrdRestore(liveP, archP)) {
+            // Orphaned backup restore — plan is already archived. Purge the ghost copy.
+            try { fs.unlinkSync(path.join(PRD_DIR, file)); } catch { }
+            shared.neutralizeJsonBackupSidecar(path.join(PRD_DIR, file));
+            completedPlanCache.add(file);
+            continue;
+          }
+          // Divergent live PRD — do NOT delete. Warn once and fall through to the
+          // normal completion handling below so it's treated as a real PRD.
+          if (!_ghostPurgeCollisionWarned.has(file)) {
+            log('warn', `PRD ${file} shares a basename with an archived PRD but diverges (different source_plan or new work) — NOT purging; resolve the collision manually`);
+            _ghostPurgeCollisionWarned.add(file);
+          }
         }
         const plan = safeJson(path.join(PRD_DIR, file));
         if (plan && plan.missing_features) {
@@ -10446,6 +10481,7 @@ module.exports = {
   materializeSpecsAsWorkItems, // exported for testing (P-f7-git-log)
   reservePrdFilename, // exported for testing (P-9b7e5d3c)
   sweepStaleArchivedPrdBackups, // exported for testing
+  _isGhostPrdRestore, // exported for testing (RC4 — ghost-purge identity check)
 
   // Shared helpers (used by lifecycle.js and tests)
   reconcileItemsWithPrs, detectDependencyCycles,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yemi33/minions",
-  "version": "0.1.2284",
+  "version": "0.1.2286",
   "description": "Multi-agent AI dev team that runs from ~/.minions/ — five autonomous agents share a single engine, dashboard, and knowledge base",
   "bin": {
     "minions": "bin/minions.js"