@yemi33/minions 0.1.2304 → 0.1.2306

package/engine/live-checkout.js

@@ -132,6 +132,121 @@ function _isPartialCloneBlobError(message = '') {
   );
 }
 
+// W-mqva907q — auto-clean safe untracked build artifacts before a live-checkout
+// dirty bail. A `git status --porcelain` line for a stray `__pycache__/` (or
+// other regenerable cache) should NOT block dispatch the way a real edit does.
+// These patterns describe untracked-only paths that are always safe to delete
+// because the build/test toolchain regenerates them. Matching is intentionally
+// implemented with plain string checks (no glob dep — Minions ships zero runtime
+// deps). dist/ and build/ are deliberately EXCLUDED: they can hold real,
+// non-regenerable output, so auto-deleting them would be unsafe.
+const LIVE_CHECKOUT_AUTO_CLEAN_PATTERNS = Object.freeze([
+  '**/__pycache__/',
+  '**/*.pyc',
+  '**/*.pyo',
+  '**/.pytest_cache/',
+  '**/node_modules/.cache/',
+  '**/*.egg-info/',
+  '.tox/',
+]);
+
+// Returns true when a single untracked path (relative, git-porcelain form) is a
+// known regenerable build artifact safe to delete. Normalizes separators and a
+// trailing slash, and conservatively unquotes git's C-style quoting for paths
+// with special chars. Directory artifacts match on their final path segment so
+// nested copies (e.g. a/b/__pycache__/) are covered like the `**/` globs above.
+function _isAutoCleanableArtifact(rawPath) {
+  if (!rawPath || typeof rawPath !== 'string') return false;
+  let p = rawPath.trim();
+  if (p.length >= 2 && p.startsWith('"') && p.endsWith('"')) {
+    try { p = JSON.parse(p); } catch { /* keep raw on parse failure */ }
+  }
+  p = p.replace(/\\/g, '/').replace(/\/+$/, '');
+  if (!p) return false;
+  if (p.endsWith('.pyc') || p.endsWith('.pyo')) return true;
+  if (p.endsWith('.egg-info')) return true;
+  if (p === 'node_modules/.cache' || p.endsWith('/node_modules/.cache')) return true;
+  const seg = p.split('/').pop();
+  if (seg === '__pycache__' || seg === '.pytest_cache' || seg === '.tox') return true;
+  return false;
+}
+
+// Classifies the porcelain dirty lines for auto-clean. Returns the list of
+// untracked artifact paths ONLY when EVERY dirty entry is an untracked (`?? `)
+// line matching a safe artifact pattern; returns null otherwise (a tracked
+// modification, a staged/deleted change, or any untracked path that is NOT a
+// known artifact). Null means "do not auto-clean — fail dirty as before", which
+// enforces the all-or-nothing contract: partial dirt is never silently cleaned.
+function _collectAutoCleanablePaths(dirtyFiles) {
+  const cleanable = [];
+  for (const line of dirtyFiles) {
+    if (!line.startsWith('?? ')) return null;
+    const p = line.slice(3);
+    if (!_isAutoCleanableArtifact(p)) return null;
+    cleanable.push(p);
+  }
+  return cleanable.length > 0 ? cleanable : null;
+}
+
+// issue #608 — detects a branch name that the ENGINE created for a live-mode
+// dispatch (never the operator's own branch). Matches ONLY the literal
+// `work/<wi-id>` convention produced by `shared.deriveWorkItemBranchName` —
+// deliberately narrow so an operator's own `user/...`/`feature/...` branch is
+// never mistaken for agent litter. Used by the orphaned-agent-branch self-heal
+// below (prepareLiveCheckout) to recognize a stray branch left behind by an
+// earlier dispatch whose dispatch-end restore did not complete.
+function _looksLikeAgentBranch(name) {
+  return typeof name === 'string' && /^work\//.test(name.trim());
+}
+
+// issue #608 — pull the current local branch name out of the `## <branch>...`
+// header line that `git status --porcelain=v1 -b` already returns, so the
+// orphaned-agent-branch self-heal below needs ZERO extra git calls on the
+// common (non-stray) dirty path — preserving the existing "no extra git calls
+// when the tree isn't all-artifact-cleanable" contract asserted by
+// test/unit/prepare-live-checkout.test.js. Returns '' for a detached HEAD
+// (`## HEAD (no branch)`) or an unparsable header.
+function _extractBranchFromPorcelainHeader(branchInfo) {
+  if (!branchInfo || typeof branchInfo !== 'string') return '';
+  const body = branchInfo.replace(/^##\s*/, '');
+  const firstToken = body.split(' ')[0] || '';
+  const localBranch = firstToken.split('...')[0];
+  return (!localBranch || localBranch === 'HEAD') ? '' : localBranch;
+}
+
+// issue #608 — commit whatever is staged/unstaged onto the CURRENT branch
+// with bounded retry+backoff, specifically to survive a transient
+// `.git/index.lock` collision against a sibling git process (the root cause
+// of the 2026-06-30 incident: two live-checkout dispatches raced `git add -A`
+// / `git commit` against the same working tree, the commit lost the lock race
+// once, and the prior code gave up on the first failure with no retry). Only
+// RETRIES when the failure looks like transient lock contention; any other
+// failure (e.g. "nothing to commit") returns immediately so callers fall
+// through to their existing best-effort handling. Never throws — callers get
+// `{ ok:false, error }` on exhaustion.
+async function _commitAgentWipWithRetry(git, baseOpts, message, options = {}) {
+  const attempts = Number.isFinite(options.attempts) ? options.attempts : 3;
+  const baseDelayMs = Number.isFinite(options.baseDelayMs) ? options.baseDelayMs : 300;
+  const sleep = typeof options.sleep === 'function'
+    ? options.sleep
+    : (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+  let lastErr = null;
+  for (let attempt = 1; attempt <= attempts; attempt++) {
+    try {
+      await git(['add', '-A'], baseOpts);
+      await git(['commit', '--no-verify', '-m', message], baseOpts);
+      return { ok: true, attempts: attempt };
+    } catch (e) {
+      lastErr = e;
+      const msg = String((e && e.message) || '');
+      const transientLock = /index\.lock/i.test(msg) || /another git process/i.test(msg);
+      if (!transientLock || attempt === attempts) break;
+      await sleep(baseDelayMs * attempt);
+    }
+  }
+  return { ok: false, error: lastErr, attempts };
+}
+
 // W-mqvejug6000eeb20 — production default for resolving the live-checkout
 // auto-reset decision when the caller (engine.js spawnAgent) does not pass an
 // explicit `autoReset` boolean. engine.js is intentionally not threading the
@@ -178,8 +293,10 @@ async function prepareLiveCheckout(opts = {}) {
                 // defers to `_resolveAutoReset`.
     _git,       // private injection for testing — defaults to shared.shellSafeGit
     _exists,    // private injection for testing — defaults to fs.existsSync
+    _rm,        // private injection for testing — defaults to fs.rmSync (recursive, force)
     _resolveAutoReset, // private injection for testing — defaults to config-based resolver
     _writeInboxNote,   // private injection for testing — defaults to dispatch.writeInboxAlert
+    _sleep,            // private injection for testing — defaults to a real setTimeout-based sleep
   } = opts;
 
   // ── Required-arg guards. Throw rather than return {ok:false} so a
@@ -206,6 +323,8 @@ async function prepareLiveCheckout(opts = {}) {
 
   const git = (typeof _git === 'function') ? _git : shared.shellSafeGit;
   const exists = (typeof _exists === 'function') ? _exists : fs.existsSync;
+  const rm = (typeof _rm === 'function') ? _rm : ((absPath) => fs.rmSync(absPath, { recursive: true, force: true }));
+  const logFn = (typeof log === 'function') ? log : () => {};
   // W-mqvejug6000eeb20 — default maxBuffer (50 MB) so a large `git status
   // --porcelain` never overflows execFile's 1 MB ceiling. A caller-supplied
   // gitOpts.maxBuffer still wins (spread after the default).
@@ -230,91 +349,160 @@ async function prepareLiveCheckout(opts = {}) {
   // before the dirtyFiles check so callers receive it as `branchInfo`.
   if (!skipDirtyCheck) {
     const statusRaw = await git(['status', '--porcelain=v1', '-b'], baseOpts);
-    const statusStr = typeof statusRaw === 'string' ? statusRaw : '';
-    const statusLines = statusStr
-      .split(/\r?\n/)
-      .map((line) => line.replace(/\s+$/, ''))
-      .filter((line) => line.length > 0);
-    const branchInfo = statusLines.find((line) => line.startsWith('## ')) || '';
-    const dirtyFiles = statusLines.filter((line) => !line.startsWith('## '));
+    const parsePorcelain = (raw) => {
+      const lines = (typeof raw === 'string' ? raw : '')
+        .split(/\r?\n/)
+        .map((line) => line.replace(/\s+$/, ''))
+        .filter((line) => line.length > 0);
+      return {
+        branchInfo: lines.find((line) => line.startsWith('## ')) || '',
+        dirtyFiles: lines.filter((line) => !line.startsWith('## ')),
+      };
+    };
+    let { branchInfo, dirtyFiles } = parsePorcelain(statusRaw);
     if (dirtyFiles.length > 0) {
-      // W-mqvejug6000eeb20 — opt-in auto-reset. Default behavior is to bail with
-      // reason:'dirty' (spawnAgent translates to non-retryable LIVE_CHECKOUT_DIRTY
-      // and alerts the operator). When auto-reset is enabled — either the caller
-      // passed an explicit `autoReset` boolean, or the config-based resolver says
-      // so — we DISCARD the dirty state via `git fetch origin` + `git reset --hard
-      // origin/<branch>` and continue. This is destructive (the operator's
-      // uncommitted work is gone), which is why it is strictly opt-in.
-      let wantAutoReset = false;
-      if (typeof autoReset === 'boolean') {
-        wantAutoReset = autoReset;
-      } else {
-        const resolver = (typeof _resolveAutoReset === 'function') ? _resolveAutoReset : _defaultResolveAutoReset;
-        try { wantAutoReset = !!resolver(localPath); } catch { wantAutoReset = false; }
+      // W-mqva907q — auto-clean safe untracked build artifacts BEFORE bailing. This
+      // runs unconditionally (no config flag — deleting regenerable caches is always
+      // safe) and BEFORE the spawnAgent auto-stash path. Only fires when EVERY dirty
+      // entry is an untracked artifact (all-or-nothing); a single tracked edit or
+      // non-artifact untracked file means zero cleaning and the original dirty bail.
+      const cleanablePaths = _collectAutoCleanablePaths(dirtyFiles);
+      if (cleanablePaths) {
+        for (const rel of cleanablePaths) {
+          const abs = path.isAbsolute(rel) ? rel : path.join(localPath, rel);
+          rm(abs);
+        }
+        logFn(`[live-checkout] auto-cleaned ${cleanablePaths.length} artifact path(s) before dirty check: ${cleanablePaths.join(', ')}`, 'debug');
+        // Re-run the dirty check. If cleaning fully resolved the tree we fall
+        // through and proceed; if anything remains (e.g. a race re-created a file)
+        // we still bail dirty with the post-clean snapshot.
+        const reRaw = await git(['status', '--porcelain=v1', '-b'], baseOpts);
+        ({ branchInfo, dirtyFiles } = parsePorcelain(reRaw));
       }
-
-      if (!wantAutoReset) {
-        return { ok: false, reason: 'dirty', dirtyFiles, branchInfo };
+      // issue #608 — orphaned-agent-branch self-heal. If the tree is STILL dirty
+      // and HEAD is sitting on a DIFFERENT engine-created branch than the one
+      // THIS dispatch is about to use, the dirt is provably leftover from an
+      // earlier dispatch whose dispatch-end restore never completed (e.g. an
+      // `.git/index.lock` race against a sibling dispatch — see
+      // restoreLiveCheckoutAtDispatchEnd). Left alone, the ORIGINAL-REF CAPTURE
+      // below (Step 3) would adopt that stray branch as `originalRef`, and every
+      // future dispatch would inherit it in turn — the tree never stops
+      // orbiting agent branches and every dispatch fails LIVE_CHECKOUT_DIRTY
+      // forever (321 incidents / 12 days). Since the branch was created BY the
+      // engine (matched narrowly via `_looksLikeAgentBranch` — the literal
+      // `work/<id>` convention from shared.deriveWorkItemBranchName, never the
+      // operator's own branch), committing the leftover WIP there is exactly as
+      // safe as the existing dispatch-end self-heal: additive, fully
+      // recoverable from that branch's own history, and never touches the
+      // operator's real branch. Unconditional (not opt-in) because it is
+      // non-destructive, unlike the auto-reset path below. After committing,
+      // switch back to `mainRef` — the one ref that is always a real,
+      // non-agent baseline — so the tree stops drifting onto agent branches.
+      if (dirtyFiles.length > 0) {
+        const strayBranch = _extractBranchFromPorcelainHeader(branchInfo);
+        if (strayBranch && strayBranch !== branchName && _looksLikeAgentBranch(strayBranch)) {
+          const commitRes = await _commitAgentWipWithRetry(
+            git, baseOpts,
+            `minions: auto-save orphaned WIP from ${strayBranch} (dispatch ${dispatchId || '(unknown)'})`,
+            { sleep: _sleep },
+          );
+          if (commitRes.ok) {
+            logFn(`[live-checkout] self-healed orphaned agent branch '${strayBranch}' — committed WIP` +
+              (commitRes.attempts > 1 ? ` after ${commitRes.attempts} attempts` : '') +
+              `, switching back to '${mainRef}'`, 'info');
+            try {
+              await git(['checkout', mainRef], baseOpts);
+            } catch (backErr) {
+              logFn(`[live-checkout] could not switch back to '${mainRef}' after self-healing '${strayBranch}': ${backErr && backErr.message}`, 'warn');
+            }
+            // Re-run the dirty check. Either the tree is now clean (self-heal
+            // succeeded end-to-end) or something new appeared (rare) — either
+            // way the normal auto-reset / dirty-bail logic below sees fresh state.
+            const healRaw = await git(['status', '--porcelain=v1', '-b'], baseOpts);
+            ({ branchInfo, dirtyFiles } = parsePorcelain(healRaw));
+          } else {
+            logFn(`[live-checkout] could not self-heal orphaned agent branch '${strayBranch}' (commit failed): ${commitRes.error && commitRes.error.message}`, 'warn');
+          }
+        }
       }
+      if (dirtyFiles.length > 0) {
+        // W-mqvejug6000eeb20 — opt-in auto-reset. Default behavior is to bail with
+        // reason:'dirty' (spawnAgent translates to non-retryable LIVE_CHECKOUT_DIRTY
+        // and alerts the operator). When auto-reset is enabled — either the caller
+        // passed an explicit `autoReset` boolean, or the config-based resolver says
+        // so — we DISCARD the dirty state via `git fetch origin` + `git reset --hard
+        // origin/<branch>` and continue. This is destructive (the operator’s
+        // uncommitted work is gone), which is why it is strictly opt-in.
+        let wantAutoReset = false;
+        if (typeof autoReset === 'boolean') {
+          wantAutoReset = autoReset;
+        } else {
+          const resolver = (typeof _resolveAutoReset === 'function') ? _resolveAutoReset : _defaultResolveAutoReset;
+          try { wantAutoReset = !!resolver(localPath); } catch { wantAutoReset = false; }
+        }
+        if (!wantAutoReset) {
+          return { ok: false, reason: 'dirty', dirtyFiles, branchInfo };
+        }
 
-      if (typeof log === 'function') {
-        log(`live-checkout auto-reset: discarding ${dirtyFiles.length} dirty path(s) on '${branchName}' via fetch + reset --hard origin/${branchName}`);
-      }
-      let resetOk = true;
-      try {
-        await git(['fetch', 'origin'], baseOpts);
-        await git(['reset', '--hard', `origin/${branchName}`], baseOpts);
-      } catch (e) {
-        resetOk = false;
         if (typeof log === 'function') {
-          log(`live-checkout auto-reset FAILED (fetch/reset): ${e && e.message ? e.message : e}`);
+          log(`live-checkout auto-reset: discarding ${dirtyFiles.length} dirty path(s) on '${branchName}' via fetch + reset --hard origin/${branchName}`);
         }
-      }
-
-      // Re-run the porcelain preflight once. If the tree is now clean we proceed;
-      // otherwise (reset failed, or something is still dirty) we fall back to the
-      // safe dirty refusal so we never dispatch onto an unexpected tree.
-      let stillDirty = dirtyFiles;
-      if (resetOk) {
+        let resetOk = true;
         try {
-          const recheckRaw = await git(['status', '--porcelain=v1', '-b'], baseOpts);
-          const recheckStr = typeof recheckRaw === 'string' ? recheckRaw : '';
-          stillDirty = recheckStr
-            .split(/\r?\n/)
-            .map((line) => line.replace(/\s+$/, ''))
-            .filter((line) => line.length > 0 && !line.startsWith('## '));
+          await git(['fetch', 'origin'], baseOpts);
+          await git(['reset', '--hard', `origin/${branchName}`], baseOpts);
         } catch (e) {
           resetOk = false;
           if (typeof log === 'function') {
-            log(`live-checkout auto-reset re-check FAILED: ${e && e.message ? e.message : e}`);
+            log(`live-checkout auto-reset FAILED (fetch/reset): ${e && e.message ? e.message : e}`);
           }
         }
-      }
 
-      if (!resetOk || stillDirty.length > 0) {
-        return { ok: false, reason: 'dirty', dirtyFiles: stillDirty, branchInfo };
-      }
+        // Re-run the porcelain preflight once. If the tree is now clean we proceed;
+        // otherwise (reset failed, or something is still dirty) we fall back to the
+        // safe dirty refusal so we never dispatch onto an unexpected tree.
+        let stillDirty = dirtyFiles;
+        if (resetOk) {
+          try {
+            const recheckRaw = await git(['status', '--porcelain=v1', '-b'], baseOpts);
+            const recheckStr = typeof recheckRaw === 'string' ? recheckRaw : '';
+            stillDirty = recheckStr
+              .split(/\r?\n/)
+              .map((line) => line.replace(/\s+$/, ''))
+              .filter((line) => line.length > 0 && !line.startsWith('## '));
+          } catch (e) {
+            resetOk = false;
+            if (typeof log === 'function') {
+              log(`live-checkout auto-reset re-check FAILED: ${e && e.message ? e.message : e}`);
+            }
+          }
+        }
 
-      // Audit trail: record the discarded paths so the operator can recover from
-      // reflog / understand why their tree changed. Best-effort, never throws.
-      try {
-        const writeNote = (typeof _writeInboxNote === 'function') ? _writeInboxNote : _defaultWriteInboxNote;
-        const slug = `live-checkout-autoreset-${wiId || dispatchId || 'unknown'}`;
-        const body = [
-          `# Live-checkout auto-reset on '${branchName}'`,
-          '',
-          `⚠️ The live-checkout tree at \`${localPath}\` was dirty at dispatch time and`,
-          '`liveCheckoutAutoReset` is enabled, so it was force-reset to',
-          `\`origin/${branchName}\`. **The following uncommitted changes were DISCARDED**`,
-          '(recover from `git reflog` / `git fsck --lost-found` if needed):',
-          '',
-          '```',
-          ...dirtyFiles,
-          '```',
-        ].join('\n');
-        writeNote(slug, body);
-      } catch { /* best-effort audit note */ }
-      // Fall through — tree is now clean, continue with normal preparation.
+        if (!resetOk || stillDirty.length > 0) {
+          return { ok: false, reason: 'dirty', dirtyFiles: stillDirty, branchInfo };
+        }
+
+        // Audit trail: record the discarded paths so the operator can recover from
+        // reflog / understand why their tree changed. Best-effort, never throws.
+        try {
+          const writeNote = (typeof _writeInboxNote === 'function') ? _writeInboxNote : _defaultWriteInboxNote;
+          const slug = `live-checkout-autoreset-${wiId || dispatchId || 'unknown'}`;
+          const body = [
+            `# Live-checkout auto-reset on '${branchName}'`,
+            '',
+            `⚠️ The live-checkout tree at \`${localPath}\` was dirty at dispatch time and`,
+            '`liveCheckoutAutoReset` is enabled, so it was force-reset to',
+            `\`origin/${branchName}\`. **The following uncommitted changes were DISCARDED**`,
+            '(recover from `git reflog` / `git fsck --lost-found` if needed):',
+            '',
+            '```',
+            ...dirtyFiles,
+            '```',
+          ].join('\n');
+          writeNote(slug, body);
+        } catch { /* best-effort audit note */ }
+        // Fall through — tree is now clean, continue with normal preparation.
+      }
     }
   }
 
@@ -559,6 +747,7 @@ async function restoreLiveCheckoutAtDispatchEnd(opts = {}) {
     log,
     writeInboxAlert,
     _git, // private injection for testing — defaults to shared.shellSafeGit
+    _sleep, // private injection for testing — defaults to a real setTimeout-based sleep
   } = opts;
 
   const logFn = (typeof log === 'function') ? log : () => {};
@@ -668,16 +857,27 @@ async function restoreLiveCheckoutAtDispatchEnd(opts = {}) {
           onAgentBranch = cur && cur === branchName;
         } catch { /* best-effort */ }
         if (onAgentBranch) {
-          try {
-            await git(['add', '-A'], baseOpts);
-            // --no-verify: skip operator commit hooks that may fail headless.
-            await git(['commit', '--no-verify', '-m', `minions: auto-save agent WIP (dispatch ${did})`], baseOpts);
+          // issue #608 — bounded retry+backoff on the commit. The 2026-06-30
+          // incident was caused by exactly this commit losing a transient
+          // `.git/index.lock` race against a sibling dispatch's git process;
+          // the previous single-attempt code gave up immediately and left the
+          // stage half-committed, which then perpetuated as a stray agent
+          // branch for every subsequent dispatch (see the orphaned-agent-branch
+          // self-heal in prepareLiveCheckout). `--no-verify` skips operator
+          // commit hooks that may fail headless.
+          const commitRes = await _commitAgentWipWithRetry(
+            git, baseOpts,
+            `minions: auto-save agent WIP (dispatch ${did})`,
+            { sleep: _sleep },
+          );
+          if (commitRes.ok) {
             result.autoCommitted = true;
-            logFn('info', `live-checkout: auto-committed agent WIP onto ${branchName} before restore (dispatch ${did})`);
-          } catch (commitErr) {
+            logFn('info', `live-checkout: auto-committed agent WIP onto ${branchName} before restore (dispatch ${did})` +
+              (commitRes.attempts > 1 ? ` after ${commitRes.attempts} attempts` : ''));
+          } else {
             // Leave the tree as-is; the plain checkout below will refuse and the
             // fallback alert fires. Never force, never discard.
-            logFn('warn', `live-checkout: could not auto-save agent WIP onto ${branchName} for ${did}: ${commitErr && commitErr.message}`);
+            logFn('warn', `live-checkout: could not auto-save agent WIP onto ${branchName} for ${did}: ${commitRes.error && commitRes.error.message}`);
           }
         }
       }
@@ -817,4 +1017,15 @@ async function maybeRestoreLiveCheckoutFromRecord(opts = {}) {
   }
 }
 
-module.exports = { prepareLiveCheckout, restoreLiveCheckoutAtDispatchEnd, maybeRestoreLiveCheckoutFromRecord, _isPartialCloneBlobError };
+module.exports = {
+  prepareLiveCheckout,
+  restoreLiveCheckoutAtDispatchEnd,
+  maybeRestoreLiveCheckoutFromRecord,
+  _isPartialCloneBlobError,
+  _isAutoCleanableArtifact,
+  _collectAutoCleanablePaths,
+  _looksLikeAgentBranch,
+  _extractBranchFromPorcelainHeader,
+  _commitAgentWipWithRetry,
+  LIVE_CHECKOUT_AUTO_CLEAN_PATTERNS,
+};

package/engine/playbook.js

@@ -13,7 +13,7 @@ const { wrapUntrusted, buildSource } = require('./untrusted-fence');
 const { MINIONS_BRAND_URL } = require('./comment-format');
 
 const { safeJson, safeRead, getProjects, log, ts, dateStamp, truncateTextBytes, ENGINE_DEFAULTS, WI_STATUS, WORK_TYPE, PR_STATUS, DISPATCH_RESULT, getProjectOrg } = shared;
-const { getConfig, getDispatch, getNotes, getAgentCharter, getPrs, getKnowledgeBaseIndex, AGENTS_DIR } = queries;
+const { getConfig, getDispatch, getNotes, getPrs, getKnowledgeBaseIndex, AGENTS_DIR } = queries;
 
 const MINIONS_DIR = shared.MINIONS_DIR;
 const PLAYBOOKS_DIR = path.join(MINIONS_DIR, 'playbooks');
@@ -1052,7 +1052,7 @@ function _checkPlaybookSections(content, context = '') {
 // Lean system prompt: agent identity + rules only (~2-4KB, never grows)
 function buildSystemPrompt(agentId, config, project) {
   const agent = config.agents[agentId] || tempAgents.get(agentId) || { name: agentId, role: 'Temporary Agent', expertise: [] };
-  const charter = getAgentCharter(agentId); // returns '' for temp agents (no charter file)
+  const charter = safeRead(path.join(AGENTS_DIR, agentId, 'charter.md')); // returns '' for temp agents (no charter file)
   project = project || getProjects(config)[0] || {};
 
   let prompt = '';

package/engine/queries.js

@@ -722,10 +722,6 @@ function getAgentStatus(agentId) {
 // setAgentStatus removed — agent status is derived from dispatch.json.
 // Status.json files no longer exist.
 
-function getAgentCharter(agentId) {
-  return safeRead(path.join(AGENTS_DIR, agentId, 'charter.md'));
-}
-
 function getAgents(config) {
   config = config || getConfig();
   // Fall back to DEFAULT_AGENTS if config has no agents (uninitialized repo)
@@ -2063,13 +2059,21 @@ function getWorkItems(config, opts) {
   });
 
   const cacheMtimes = _snapshotWorkItemsMtimes(config);
+  // Use Date.now() here (not the `now` captured at function entry) so the
+  // 1 s TTL is measured from when the cache was BUILT, not from when the
+  // call started. On a slow or loaded machine the first cold call can take
+  // > 1 s while DB migrations run; if we used the entry-time `now`, the
+  // very next call would see (entry_time_of_call_2 − entry_time_of_call_1)
+  // >= 1 000 ms and miss the cache, defeating the cache entirely.
+  // (W-mr00aooc000i1d6b — queries-work-items-cache CI failure on slow runners)
+  const cacheSetAt = Date.now();
   if (enrich) {
     _workItemsCache = allItems;
-    _workItemsCacheAt = now;
+    _workItemsCacheAt = cacheSetAt;
     _workItemsCacheMtimes = cacheMtimes;
   } else {
     _workItemsLeanCache = allItems;
-    _workItemsLeanCacheAt = now;
+    _workItemsLeanCacheAt = cacheSetAt;
     _workItemsLeanCacheMtimes = cacheMtimes;
   }
   return allItems;
@@ -3320,7 +3324,7 @@ module.exports = {
   _buildNotesByWiMap, // exported for testing
 
   // Agents
-  getAgentStatus, getAgentCharter, getAgents, getAgentDetail,
+  getAgentStatus, getAgents, getAgentDetail,
 
   // Pull requests
   getPrs, getPullRequests,

package/engine/shared.js

@@ -3254,11 +3254,12 @@ const ENGINE_DEFAULTS = {
   // When ON, a dirty/broken live-checkout tree is `git fetch origin` +
   // `git reset --hard origin/<branch>`'d before dispatch instead of failing
   // LIVE_CHECKOUT_DIRTY. Per-project `project.liveCheckoutAutoReset` overrides
-  // this. Default OFF — auto-reset is destructive (it discards the operator's
-  // uncommitted changes), so it is strictly opt-in. Resolution precedence lives
-  // in `resolveLiveCheckoutAutoReset`. Fires ONLY on confirmed dirty-tree
-  // detection, never on mid-operation / blob-fetch / tooling failures.
-  liveCheckoutAutoReset: false,
+  // this. Default ON — discarding uncommitted dirt via reset-to-remote keeps
+  // live-checkout branches from diverging (the old `false` default accumulated
+  // `minions: auto-save agent WIP` commits on every dirty exit). Resolution
+  // precedence lives in `resolveLiveCheckoutAutoReset`. Fires ONLY on confirmed
+  // dirty-tree detection, never on mid-operation / blob-fetch / tooling failures.
+  liveCheckoutAutoReset: true,
   orphanHolderScanTimeoutMs: 5000,          // 5s ceiling for the cross-platform holder scan (PowerShell / /proc walk / lsof)
   ccMaxTurns: 50, // max tool-use turns per CC/doc-chat call before CLI stops (per response, not per session)
   ccWorkerIdleTimeoutMs: 30 * 60 * 1000, // W-mr0qs0vw: idle-reaper window for the persistent `copilot --acp` worker pool (engine/cc-worker-pool.js). After this much inactivity with no in-flight turn the warm ACP process is killed; the next message cold-spawns a fresh session with NO memory of prior turns (CC shows a "context cleared after inactivity" notice). Tradeoff: shorter = less idle memory/process footprint, longer = more context durability across gaps between messages. Wired into the pool via ccWorkerPool.setIdleTimeoutMs() on every reloadConfig(); clamped to [60000, 28800000] (1min–8h) in the settings POST handler.