@yemi33/minions 0.1.2319 → 0.1.2321

package/dashboard.js

@@ -13767,11 +13767,16 @@ What would you like to discuss or change? When you're happy, say "approve" and I
         // routes the changes through an isolated worktree (so nothing is ever
         // committed in the operator's live main). See engine/create-pr-worktree.js.
         const checkoutMode = shared.resolveCheckoutMode(project);
+        // Resolve the project's actual main/base branch instead of trusting
+        // whatever `git rev-parse --abbrev-ref HEAD` returned as a safe base —
+        // the live checkout may be sitting on a stale/topic branch whose
+        // unrelated commits would otherwise leak into the new PR (W-mr3jbpru).
+        const mainBranch = shared.resolveMainBranch(project.localPath, project.mainBranch);
         const followups = hasChanges
-          ? prAction.buildCreatePrFollowups({ project: projectName, branch, contextOnly: !!body?.contextOnly, checkoutMode })
+          ? prAction.buildCreatePrFollowups({ project: projectName, branch, contextOnly: !!body?.contextOnly, checkoutMode, mainBranch })
           : [];
         recordCcTurnIfPresent(req, { kind: 'pr-action', id: '', title: `offer create-pr (${projectName})`, project: projectName, followups });
-        return jsonReply(res, 200, { ok: true, hasChanges, branch, changedFileCount, checkoutMode, followups }, req);
+        return jsonReply(res, 200, { ok: true, hasChanges, branch, changedFileCount, checkoutMode, mainBranch, followups }, req);
       } catch (e) {
         return jsonReply(res, e.statusCode || 400, { error: e.message }, req);
       }

package/docs/live-checkout-mode.md

@@ -136,6 +136,21 @@ Live-mode agents run **in-place** in the operator's checkout, so when a dispatch
 
 The core invariant holds end-to-end through restore: **the engine only ever switches branches — it never `git reset`s, `git clean`s, or `git stash`es the operator's tree, and never passes `--force`.** The one addition — the self-healing auto-commit — only ever runs `git add`/`git commit` on the engine's *own* agent branch, never on operator refs, and never discards.
 
+## Create-PR chip safety (CC-initiated, separate from the dispatch path)
+
+The Command Center **"Create PR"** chip (`dashboard.js` → `POST /api/pr-action/offer-create-pr` → `engine/pr-action.js#buildCreatePrFollowups`) is a **separate, ad-hoc path** that opens a PR for a local edit Command Center just made in a live-checkout project. It does **not** go through `prepareLiveCheckout`, so the dirty-tree / orphaned-branch / mid-operation defenses above (Guarantees 2 & 5, dispatch-start self-heal) do **not** apply to it. This path needs its own equivalent safety contract, because it shares the same failure mode: the live checkout may be sitting on a stale/topic branch left over from a previous run, a manually-checked-out branch, or any other non-main state.
+
+**The bug it fixes (W-mr3jbpru).** The old live-mode chip message keyed its branch instruction off `git rev-parse --abbrev-ref HEAD` (the *current* branch) and only told the agent to branch off cleanly **if** that current branch already happened to be the project's main branch. If the checkout was on any other branch, the message told the agent to commit the new changes **directly onto that branch** — silently carrying all of that branch's unrelated commits into the new PR. There was no engine-side verification that the current branch was clean or at parity with main; it was trusted blindly. A user hit exactly this: a Create-PR chip PR ended up built on top of a leftover topic branch and carried unrelated diffs.
+
+**The contract now (unconditional, current-branch never trusted as base).**
+
+1. The handler resolves the project's **actual** main/base branch with `shared.resolveMainBranch(project.localPath, project.mainBranch)` — it does **not** trust `git rev-parse --abbrev-ref HEAD` as a safe base — and threads it to `buildCreatePrFollowups({ …, mainBranch })`.
+2. The CC-facing message is **unconditional**: regardless of what is currently checked out, it instructs the agent to build the PR on a **fresh branch off the up-to-date `origin/<mainBranch>` tip**, via `git stash push --include-untracked` → `git fetch origin <mainBranch>` → `git checkout -B <new-well-named-branch> origin/<mainBranch>` → `git stash pop` → commit → push → open the PR against `<mainBranch>` → link via `/api/pull-requests/link` → **switch the working tree back to the original branch** it started on (the same restore step the old message had). The old `if <current-branch> is the project's default/main branch` conditional is gone entirely.
+3. If `git stash pop` reports a merge conflict (the stashed diff doesn't cleanly apply onto the fresh main tip), the message instructs the agent to **stop and surface the conflict** to the user rather than force-resolving it silently.
+4. The message **names the resolved main branch explicitly** (e.g. `origin/android`) instead of leaving "the project main branch" vague, so the always-branch-off-resolved-main rule is stated unambiguously.
+
+This mirrors, in CC-instruction form, what `prepareLiveCheckout` enforces engine-side for the dispatch path: never reuse whatever branch the live checkout happened to be on as the base for new work. The **worktree-mode** branch of `buildCreatePrFollowups` is unaffected — that path already routes the changes through an isolated worktree (`engine/create-pr-worktree.js`) so nothing is ever committed on the operator's `main`.
+
 ## Operator workflow
 
 ### Enabling live mode (dashboard)
@@ -253,6 +268,7 @@ Live-checkout mode is deliberately small. These are NOT supported and will not b
 | `engine.js` — worktree-pool / orphan-GC short-circuits | `worktreePath===null` no-ops in live mode (P-a3f9b206). |
 | `engine/cleanup.js` — `runPeriodicWorktreeSweep` live filter | Excludes live-checkout projects from the registry-derived periodic worktree GC so the operator's primary checkout never enters the GC decision surface (PL-live-checkout-reliability-hardening). |
 | `engine/create-pr-worktree.js` — `prepareCreatePrWorktree` step-4 restore | `reset --hard HEAD` (not the index-leaking `checkout -- .`) + retried untracked removal + `liveTreeDirty` surfaced + `shared.removeWorktree` teardown (PL-live-checkout-reliability-hardening). |
+| `engine/pr-action.js` — `buildCreatePrFollowups({ …, mainBranch })` live-mode message | CC "Create PR" chip instruction. In live mode the PR is ALWAYS built on a fresh branch off `origin/<mainBranch>` (stash → fetch → `checkout -B` → pop → commit → push → PR → restore), never reusing the current branch as the base; stop-on-stash-pop-conflict. `dashboard.js` `POST /api/pr-action/offer-create-pr` resolves `mainBranch` via `shared.resolveMainBranch` and threads it in (W-mr3jbpru). |
 | `dashboard/js/settings.js` — checkoutMode dropdown + chip + `set-liveCheckoutAutoReset` fleet toggle | Operator-facing UI; the fleet-wide auto-reset toggle persists to `engine.liveCheckoutAutoReset` (per-project UI deferred — config.json only) (P-a3f9b207; auto-reset toggle W-mqvejug6000eeb20). |
 | `test/unit/{resolve-spawn-paths-live-mode,prepare-live-checkout,spawn-agent-live-mode-wiring,live-checkout-auto-stash}.test.js` | Wiring and contract tests (P-a3f9b208; auto-stash helpers W-mqtvnnj1000357fa). |
 | `engine/shared.js` — `FAILURE_CLASS.LIVE_CHECKOUT_DIRTY` | Non-retryable refusal class. |

package/engine/pr-action.js

@@ -154,14 +154,23 @@ const CREATE_PR_FOLLOWUP = Object.freeze({ kind: 'create-pr', label: 'Create PR'
  *                  changes through an isolated git worktree so nothing is ever
  *                  committed in the operator's live `main`. Defaults to `'live'`
  *                  for back-compat when a caller doesn't resolve it.
+ * `mainBranch`   — the project's resolved main/base branch
+ *                  (`shared.resolveMainBranch(project.localPath, project.mainBranch)`).
+ *                  In `'live'` mode the PR is ALWAYS built on a fresh branch off
+ *                  the up-to-date `origin/<mainBranch>` tip — never off whatever
+ *                  branch the live checkout happened to have checked out — so a
+ *                  stale/topic branch's unrelated commits can't leak into the new
+ *                  PR (W-mr3jbpru: "Create-PR reused stale topic branch as base").
+ *                  Falls back to `'main'` when a caller doesn't resolve it.
  *
  * Each chip: `{ kind:'create-pr', label, project, branch, message }` where
  * `message` is the Command Center turn the chip click should send.
  */
-function buildCreatePrFollowups({ project, branch, contextOnly = false, checkoutMode = 'live' } = {}) {
+function buildCreatePrFollowups({ project, branch, contextOnly = false, checkoutMode = 'live', mainBranch = '' } = {}) {
   const proj = (project && String(project).trim()) || '';
   if (!proj) return [];
   const br = branch && String(branch).trim() ? String(branch).trim() : '';
+  const mainRef = mainBranch && String(mainBranch).trim() ? String(mainBranch).trim() : 'main';
   const linkBody = contextOnly
     ? `{"url":"<new PR url>","project":"${proj}","contextOnly":true}`
     : `{"url":"<new PR url>","project":"${proj}","contextOnly":false}`;
@@ -185,21 +194,30 @@ function buildCreatePrFollowups({ project, branch, contextOnly = false, checkout
       `(6) finally call POST /api/pr-action/cleanup-create-pr-worktree with {"project":"${proj}","worktreePath":"<worktreePath>"} to remove the worktree. ` +
       `Never git-commit/-push in the live checkout. Then show me the PR URL.`;
   } else {
-    // Live-checkout projects: operate in place, but branch off main and restore
-    // the original branch so the PR branch is never left checked out.
-    const branchClause = br
-      ? `(the working tree is on branch ${br}; if ${br} is the project's default/main branch, create a new well-named branch off it and commit there rather than committing to ${br} directly)`
-      : 'on a new well-named branch off the project main branch';
+    // Live-checkout projects: operate in place, but ALWAYS build the PR on a
+    // fresh branch off the up-to-date origin/<mainBranch> tip — never off
+    // whatever branch the live checkout happened to have checked out. Trusting
+    // the current branch let a stale/topic branch's unrelated commits leak into
+    // the new PR (W-mr3jbpru). The stash → fetch → checkout -B → pop sequence
+    // captures the intended changes and re-applies them on a clean base; the
+    // original branch is restored at the end so the PR branch is never left
+    // checked out in the shared operator tree.
     const restoreClause = br
       ? `switch the working tree back to the ORIGINAL branch (${br})`
       : 'switch the working tree back to the original branch it started on';
     message =
       `Create a PR from the local changes you just made in the ${proj} project. ` +
       (br ? `Remember the working tree's current branch (${br}) as the ORIGINAL branch to return to when done. ` : '') +
-      `Steps: (1) in that project's working tree, stage and commit the modified files with a clear conventional-commit message ${branchClause}; ` +
-      `(2) push the branch; (3) open a PR against the project's main branch using the right CLI for the repo host (gh for GitHub, az repos for ADO); ` +
-      `(4) link it to the tracker by calling POST /api/pull-requests/link with ${linkBody} ${trackNote}; ` +
-      `(5) finally, ${restoreClause} — do not leave the new PR branch checked out. ` +
+      `IMPORTANT: do NOT commit onto whatever branch is currently checked out — it may carry unrelated commits. ` +
+      `ALWAYS build the PR on a fresh branch off the up-to-date ${mainRef} tip so no stale/topic branch commits leak into the new PR. ` +
+      `Steps: (1) stash your intended uncommitted changes with \`git stash push --include-untracked\`; ` +
+      `(2) fetch the latest base with \`git fetch origin ${mainRef}\`; ` +
+      `(3) create a fresh well-named branch off the remote main tip with \`git checkout -B <new-well-named-branch> origin/${mainRef}\` (never branch off whatever was previously checked out); ` +
+      `(4) re-apply your changes with \`git stash pop\` — if this reports a merge conflict, STOP and surface the conflict to me rather than force-resolving it silently; ` +
+      `(5) stage and commit the changes with a clear conventional-commit message; ` +
+      `(6) push the new branch; (7) open a PR against ${mainRef} using the right CLI for the repo host (gh for GitHub, az repos for ADO); ` +
+      `(8) link it to the tracker by calling POST /api/pull-requests/link with ${linkBody} ${trackNote}; ` +
+      `(9) finally, ${restoreClause} — do not leave the new PR branch checked out. ` +
       `Then show me the PR URL.`;
   }
   return [{ kind: CREATE_PR_FOLLOWUP.kind, label: CREATE_PR_FOLLOWUP.label, project: proj, branch: br || null, message }];

package/engine/runtimes/copilot.js

@@ -1098,6 +1098,28 @@ function createStreamConsumer(ctx) {
   // form `...prev.next...`. First push is NEVER prefixed (would leave every
   // reply with a leading blank line). Reset by reset() on stream restart.
   let _hadPriorAssistantMessage = false;
+  // `terminalText` accumulates EVERY non-tool assistant.message across the
+  // whole turn, including ones separated by intervening tool calls. That
+  // whole-turn scope is wrong for `ctx.setText(...)` on the `result` event:
+  // the dashboard's `ccSegmentsFinalize`/`_ccSegMergeText` (render-utils.js)
+  // expect the authoritative final text to describe ONLY the *trailing* text
+  // segment (correct for Claude's single last-message `result.result`), and
+  // merge it into just the last segment. Sending the whole-turn text there
+  // duplicated earlier paragraphs (W-mr3rdn9j000u6d5d) because the trailing
+  // segment only ever received the post-tool delta via ctx.pushText, not the
+  // full accumulated turn.
+  //
+  // `trailingText`/`_hadPriorTrailingMessage` mirror `terminalText`/
+  // `_hadPriorAssistantMessage` but are reset to '' / false on every tool
+  // boundary (a real tool call — not `task_complete`), so their scope always
+  // matches the trailing segment the dashboard will merge into.
+  let trailingText = '';
+  let _hadPriorTrailingMessage = false;
+
+  function _resetTrailingSegment() {
+    trailingText = '';
+    _hadPriorTrailingMessage = false;
+  }
 
   function _captureTaskComplete(summary, success = true, { clearBuffer = false } = {}) {
     if (typeof summary !== 'string' || !summary) return;
@@ -1117,7 +1139,7 @@ function createStreamConsumer(ctx) {
       // The result event is the first Copilot event that contains the resumable
       // sessionId. Do not mark the earlier assistant.message as terminal or
       // Minions can resolve before session persistence data is available.
-      const finalText = terminalText || copilotMessageBuffer || taskCompleteSummary;
+      const finalText = trailingText || copilotMessageBuffer || taskCompleteSummary;
       if (finalText) ctx.setText(finalText);
     }
 
@@ -1149,21 +1171,30 @@ function createStreamConsumer(ctx) {
         // the terminal answer. A non-tool assistant.message overrides any
         // streamed deltas (Copilot's authoritative final text for the turn).
         if (content && !hasTools) {
-          // Second-and-later terminating message in a single turn: prefix the
-          // pushed text with `\n\n` so the dashboard merge sees a clean
-          // paragraph boundary instead of welding `<prev>.<next>` together
-          // (W-mq1jwwqo000f20d9 — CC chunk welding fix). The first push must
-          // NOT be prefixed or every reply starts with a blank line. Tool-use
-          // boundaries are skipped — those get rendered as visible chips
-          // client-side and already act as natural separators.
-          const pushed = _hadPriorAssistantMessage ? '\n\n' + content : content;
+          // Second-and-later terminating message within the SAME trailing
+          // segment (no tool boundary since): prefix the pushed text with
+          // `\n\n` so the dashboard merge sees a clean paragraph boundary
+          // instead of welding `<prev>.<next>` together (W-mq1jwwqo000f20d9
+          // — CC chunk welding fix). The first push in a segment must NOT be
+          // prefixed (would leave every reply/segment with a leading blank
+          // line). This is now gated on `_hadPriorTrailingMessage` (reset on
+          // every real tool boundary below), not the whole-turn flag — a
+          // tool boundary already opens a brand-new segment on the dashboard
+          // side (ccSegmentsApplyChunk), so the first post-tool push needs no
+          // extra separator, and `trailingText` must track exactly what was
+          // pushed so ctx.setText(...) on `result` reconciles cleanly
+          // (W-mr3rdn9j000u6d5d).
+          const pushed = _hadPriorTrailingMessage ? '\n\n' + content : content;
           terminalText = _hadPriorAssistantMessage ? terminalText + '\n\n' + content : content;
+          trailingText = _hadPriorTrailingMessage ? trailingText + '\n\n' + content : content;
           ctx.pushText(pushed);
           _hadPriorAssistantMessage = true;
+          _hadPriorTrailingMessage = true;
         }
         copilotMessageBuffer = '';
       }
       if (Array.isArray(data.toolRequests)) {
+        let sawRealTool = false;
         for (const tr of data.toolRequests) {
           if (!tr || !tr.name) continue;
           if (tr.name === 'task_complete') {
@@ -1171,7 +1202,12 @@ function createStreamConsumer(ctx) {
             continue;
           }
           ctx.pushToolUse(tr.name, tr.arguments || {});
+          sawRealTool = true;
         }
+        // A real (non-task_complete) tool call closes the trailing segment —
+        // the NEXT non-tool assistant.message starts a fresh segment on the
+        // dashboard side, so its finalize-time scope must reset here too.
+        if (sawRealTool) _resetTrailingSegment();
       }
       return;
     }
@@ -1188,6 +1224,11 @@ function createStreamConsumer(ctx) {
       if (!ctx.toolUseAlreadySeen(name, input)) {
         ctx.pushToolUse(name, input);
       }
+      // Same trailing-segment boundary reset as the toolRequests branch above
+      // — `tool.execution_start` is the standalone event shape observed in
+      // the primary repro (assistant.message → tool.execution_start →
+      // assistant.message → result).
+      _resetTrailingSegment();
     }
   }
 
@@ -1196,6 +1237,7 @@ function createStreamConsumer(ctx) {
     terminalText = '';
     taskCompleteSummary = '';
     _hadPriorAssistantMessage = false;
+    _resetTrailingSegment();
   }
 
   return { consume, reset };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yemi33/minions",
-  "version": "0.1.2319",
+  "version": "0.1.2321",
   "description": "Multi-agent AI dev team that runs from ~/.minions/ — five autonomous agents share a single engine, dashboard, and knowledge base",
   "bin": {
     "minions": "bin/minions.js"