@yemi33/minions 0.1.2355 → 0.1.2356

package/dashboard/js/settings.js

@@ -342,17 +342,31 @@ async function openSettings() {
           '<option value="off"' + (autoStashRaw === 'off' ? ' selected' : '') + '>Off — fail on dirty tree</option>' +
         '</select>' +
         '<div style="font-size:var(--text-xs);color:var(--muted);margin-top:2px;line-height:1.4">Live mode only. On = `git stash push --include-untracked` a dirty tree before dispatch instead of failing; the engine never pops the stash (run `git stash pop` manually). Overrides the fleet-wide setting under Worktrees.</div>' +
-      '</div>';
+        '</div>';
+    // W-mrchrfe100067d3a — per-project explicit allowlist of secondary repo
+    // scopes this project's checkout is also allowed to track PRs for (e.g.
+    // minions-opg's checkout has both an `origin` remote → opg-microsoft/minions
+    // and a `yemi33` remote → yemi33/minions for backport work — see
+    // CLAUDE.md "Remotes"). Comma-separated canonical scope strings
+    // (`github:owner/repo` or `ado:org/project/repo`); parsed + validated
+    // server-side by shared.validateAdditionalRepoScopes on save.
+    var additionalScopesSearch = 'additional repo scopes multi-scope dual-remote backport yemi33';
+    var additionalScopesBlock = '<div data-search="' + escHtml(additionalScopesSearch) + '" style="margin-bottom:6px">' +
+        settingsField('Additional repo scopes (secondary remotes)', 'set-additionalRepoScopes-' + p.name,
+          (Array.isArray(p.additionalRepoScopes) ? p.additionalRepoScopes : []).join(', '), '',
+          'Comma-separated canonical scopes this project\'s PRs may ALSO belong to (e.g. "github:yemi33/minions"). Explicit opt-in allowlist only — PRs matching one of these scopes are treated as compatible for auto-review/auto-fix without being flagged pr_scope_mismatch. Leave empty for single-scope projects.') +
+        '</div>';
     return '<div data-settings-project="' + escHtml(p.name) + '" data-search="project ' + escHtml(p.name.toLowerCase()) + '" style="border:1px solid var(--border);border-radius:6px;padding:10px 12px;margin-bottom:12px">' +
-      '<div style="display:flex;align-items:center;justify-content:space-between;margin-bottom:8px">' +
-        '<div style="font-size:var(--text-md);font-weight:600">' + escHtml(p.name) + '</div>' +
-        '<button onclick="MinionsSettings.removeProject(\'' + escHtml(p.name) + '\')" style="font-size:var(--text-xs);padding:2px 8px;background:transparent;color:var(--red);border:1px solid var(--red);border-radius:3px;cursor:pointer">Remove</button>' +
-      '</div>' +
-      pathRow +
-      branchGrid +
-      worktreeModeBlock +
-      autoStashBlock +
-      driftNote +
+        '<div style="display:flex;align-items:center;justify-content:space-between;margin-bottom:8px">' +
+          '<div style="font-size:var(--text-md);font-weight:600">' + escHtml(p.name) + '</div>' +
+          '<button onclick="MinionsSettings.removeProject(\'' + escHtml(p.name) + '\')" style="font-size:var(--text-xs);padding:2px 8px;background:transparent;color:var(--red);border:1px solid var(--red);border-radius:3px;cursor:pointer">Remove</button>' +
+        '</div>' +
+        pathRow +
+        branchGrid +
+        worktreeModeBlock +
+        autoStashBlock +
+        additionalScopesBlock +
+        driftNote +
       '<div style="display:flex;flex-direction:column;gap:6px;margin-top:8px">' +
       settingsToggle('Discover from PRs', 'set-ws-prs-' + p.name, p.workSources.pullRequests.enabled, 'Discovery gate: scan repo for open PRs and surface them as review tasks. Independent of ADO/GitHub polling — does not affect already-tracked PRs.') +
       settingsToggle('Discover from Work Items', 'set-ws-wi-' + p.name, p.workSources.workItems.enabled, 'Auto-discover work from ADO/GitHub work items') +
@@ -1257,12 +1271,18 @@ async function saveSettings() {
       const autoStashInput = document.getElementById('set-liveCheckoutAutoStash-' + p.name);
       const autoStashRaw = autoStashInput ? autoStashInput.value : '';
       const autoStashValue = autoStashRaw === 'on' ? true : autoStashRaw === 'off' ? false : null;
+      // W-mrchrfe100067d3a — parse the comma-separated scope list back into an
+      // array; empty string → null (clears the override server-side).
+      const additionalScopesInput = document.getElementById('set-additionalRepoScopes-' + p.name);
+      const additionalScopesRaw = additionalScopesInput ? additionalScopesInput.value : '';
+      const additionalRepoScopes = additionalScopesRaw.split(',').map(function(s) { return s.trim(); }).filter(Boolean);
       return {
         name: p.name,
         mainBranch: mainBranchValue || null,
         checkoutMode: checkoutMode,
         liveValidation: liveValidation,
         liveCheckoutAutoStash: autoStashValue,
+        additionalRepoScopes: additionalRepoScopes.length > 0 ? additionalRepoScopes : null,
         workSources: {
           pullRequests: { enabled: document.getElementById('set-ws-prs-' + p.name)?.checked ?? true },
           workItems: { enabled: document.getElementById('set-ws-wi-' + p.name)?.checked ?? true }

package/dashboard.js

@@ -11184,6 +11184,11 @@ What would you like to discuss or change? When you're happy, say "approve" and I
           // tri-state dropdown. Undefined means "use fleet default"
           // (engine.liveCheckoutAutoStash); only an explicit boolean overrides.
           liveCheckoutAutoStash: (typeof p.liveCheckoutAutoStash === 'boolean') ? p.liveCheckoutAutoStash : undefined,
+          // W-mrchrfe100067d3a — surface the per-project secondary-repo
+          // allowlist so the Settings → Projects UI can pre-fill / edit it.
+          // Empty array when unset (never null) so the UI can render a
+          // simple add/remove list without an extra null-check.
+          additionalRepoScopes: shared.getProjectAdditionalPrScopes(p),
           workSources: {
             pullRequests: { enabled: p.workSources?.pullRequests?.enabled !== false, cooldownMinutes: p.workSources?.pullRequests?.cooldownMinutes ?? 30 },
             workItems: { enabled: p.workSources?.workItems?.enabled !== false, cooldownMinutes: p.workSources?.workItems?.cooldownMinutes ?? 0 }
@@ -11668,6 +11673,24 @@ What would you like to discuss or change? When you're happy, say "approve" and I
               proj.liveCheckoutAutoStash = !!rawStash;
             }
           }
+          // W-mrchrfe100067d3a — per-project explicit allowlist of secondary
+          // repo scopes (e.g. minions-opg's checkout also legitimately opens
+          // PRs against yemi33/minions for backport work — see CLAUDE.md
+          // "Remotes"). Empty array / null / '' clears the override (falls
+          // back to single-scope matching); any other value flows through
+          // shared.validateAdditionalRepoScopes, which throws HTTP 400 on a
+          // non-array or malformed scope string (errors propagate to the
+          // outer catch below via e.statusCode/e.message).
+          if (Object.prototype.hasOwnProperty.call(update, 'additionalRepoScopes')) {
+            const rawScopes = update.additionalRepoScopes;
+            if (rawScopes === '' || rawScopes === null || (Array.isArray(rawScopes) && rawScopes.length === 0)) {
+              delete proj.additionalRepoScopes;
+            } else {
+              const validatedScopes = shared.validateAdditionalRepoScopes(rawScopes);
+              if (validatedScopes === undefined) delete proj.additionalRepoScopes;
+              else proj.additionalRepoScopes = validatedScopes;
+            }
+          }
         }
       }
 
@@ -14707,7 +14730,7 @@ What would you like to discuss or change? When you're happy, say "approve" and I
 
     // Settings
     { method: 'GET', path: '/api/settings', desc: 'Return current engine + claude + routing config', handler: handleSettingsRead },
-    { method: 'POST', path: '/api/settings', desc: 'Update engine + claude + agent + projects config', params: 'engine?, claude?, agents?, projects? (per-project: checkoutMode, liveValidation, mainBranch, workSources)', handler: handleSettingsUpdate },
+    { method: 'POST', path: '/api/settings', desc: 'Update engine + claude + agent + projects config', params: 'engine?, claude?, agents?, projects? (per-project: checkoutMode, liveValidation, mainBranch, workSources, additionalRepoScopes)', handler: handleSettingsUpdate },
     { method: 'POST', path: '/api/settings/routing', desc: 'Update routing.md', params: 'content', handler: handleSettingsRouting },
     { method: 'POST', path: '/api/settings/reset', desc: 'Reset engine + claude + agent settings to defaults', handler: handleSettingsReset },
 

package/engine/db/migrations/016-pr-mirror-hash.js

@@ -0,0 +1,31 @@
+// engine/db/migrations/016-pr-mirror-hash.js
+//
+// Fix for opg-microsoft/minions#759: pull-requests-store.js tracked its
+// JSON-mirror "last known hash" per scope in an in-memory-only Map
+// (`_lastMirrorHashByScope`). That state resets to empty on every engine
+// restart, so the very first touch of a scope after a restart has no way to
+// tell "SQL and JSON already agree" from "JSON just changed out from under
+// us" — it falls back to a lastHash==null heuristic that only partially
+// covers the case. Combined with a restart landing mid-flight of another
+// process's mirror write, a stale JSON snapshot could get treated as
+// canonical and used to rebuild (blindly DELETE + reinsert) the SQL table
+// for that scope, permanently dropping any rows not present in the stale
+// file.
+//
+// This table makes the mirror-hash durable across restarts: it is now the
+// single, persisted cross-process source of truth for "what mirror state
+// did the store last agree with", instead of a per-process cache that goes
+// blank on every restart.
+module.exports = {
+  version: 16,
+  description: 'pr_mirror_hashes — persist pull-requests.json mirror-hash across restarts (#759)',
+  up(db) {
+    db.exec(`
+      CREATE TABLE pr_mirror_hashes (
+        scope       TEXT PRIMARY KEY,
+        hash        TEXT NOT NULL,
+        updated_at  INTEGER NOT NULL
+      );
+    `);
+  },
+};

package/engine/lifecycle.js

@@ -1122,6 +1122,13 @@ function syncPrsFromOutput(output, agentId, meta, config, opts = {}) {
         const projScope = shared.getProjectPrScope(p);
         if (projScope && projScope === urlScope) return p;
       }
+      // W-mrchrfe100067d3a — a PR scoped to one of a project's allowlisted
+      // additionalRepoScopes (e.g. a backport PR opened against
+      // yemi33/minions from the minions-opg checkout) belongs to that
+      // project too, even though it isn't the project's primary scope.
+      for (const p of projects) {
+        if (shared.getProjectAdditionalPrScopes(p).includes(urlScope)) return p;
+      }
     }
     const evidenceText = `${outputText}\n${evidenceUrl}`;
     for (const p of projects) {
@@ -6611,16 +6618,25 @@ function pruneScopeMismatchDuplicatePrs(config) {
   const projects = shared.getProjects(config) || [];
   if (projects.length === 0) return { pruned: 0, relocated: 0, scanned: 0 };
 
-  // Map project name -> canonical scope so we can find which project IS the
-  // correctly-scoped owner for a given mismatch record.
+  // Map project name -> canonical scope(s) so we can find which project IS
+  // the correctly-scoped owner for a given mismatch record. Includes
+  // additionalRepoScopes (W-mrchrfe100067d3a) so a stale `_invalidProjectScope`
+  // stamp left over from before a project opted into a secondary scope (or
+  // any record from another host that hasn't been re-normalized yet) maps
+  // back to the project that now allowlists it, instead of relocating to a
+  // nonexistent project or getting stuck unresolved.
   const scopeByProject = new Map();
   const projectByScope = new Map();
   for (const p of projects) {
     if (!p || !p.name) continue;
     const sc = shared.getProjectPrScope(p);
-    if (!sc) continue;
-    scopeByProject.set(p.name, sc);
-    projectByScope.set(sc, p);
+    if (sc) {
+      scopeByProject.set(p.name, sc);
+      if (!projectByScope.has(sc)) projectByScope.set(sc, p);
+    }
+    for (const additionalScope of shared.getProjectAdditionalPrScopes(p)) {
+      if (!projectByScope.has(additionalScope)) projectByScope.set(additionalScope, p);
+    }
   }
 
   // Index all PRs by canonical id across all projects (post-_scope decoration).

package/engine/pipeline.js

@@ -8,7 +8,7 @@ const fs = require('fs');
 const path = require('path');
 const shared = require('./shared');
 const queries = require('./queries');
-const { safeJson, safeJsonObj, safeJsonArr, safeJsonNoRestore, safeWrite, safeRead, safeReadDir, uid, log, ts, dateStamp, mutateJsonFileLocked, mutateWorkItems, mutatePipelineRuns, slugify, formatTranscriptEntry, WI_STATUS, WORK_TYPE, PLAN_STATUS, PR_STATUS, PIPELINE_STATUS, STAGE_TYPE, MEETING_STATUS, READ_ONLY_ROOT_TASK_TYPES, ENGINE_DEFAULTS, MINIONS_DIR } = shared;
+const { safeJson, safeJsonObj, safeJsonArr, safeJsonNoRestore, safeWrite, safeRead, safeReadDir, uid, log, ts, dateStamp, mutateJsonFileLocked, mutateWorkItems, mutatePipelineRuns, slugify, formatTranscriptEntry, WI_STATUS, WORK_TYPE, PLAN_STATUS, PR_STATUS, PIPELINE_STATUS, STAGE_TYPE, MEETING_STATUS, READ_ONLY_ROOT_TASK_TYPES, ENGINE_DEFAULTS, MINIONS_DIR, isPrdArchived } = shared;
 const routing = require('./routing');
 const http = require('http');
 const { shouldRunNow } = require('./scheduler');
@@ -537,8 +537,26 @@ function _canonicalPlanName(planFile) {
   return String(planFile || '').replace(/^(.*-\d{4}-\d{2}-\d{2})-\d+(\.md)$/i, '$1$2');
 }
 
+// PRD top-level statuses that indicate a genuine, materialized plan-to-prd
+// conversion (mirrors PLAN_STATUS — a PRD's status field is drawn from the
+// same enum as a plan's). 'archived' is intentionally NOT in PLAN_STATUS (it's
+// an in-place-archive-only status stamped by dashboard.js's _archivePrdPostProcess,
+// not a plan lifecycle state) but is a real status a converted-then-archived PRD
+// can carry — checked separately below via isPrdArchived so an already-archived
+// conversion isn't mistaken for a stub and re-triggered.
+const _VALID_EXISTING_PRD_STATUSES = new Set(Object.values(PLAN_STATUS));
+
 // Check if a PRD already exists for a given plan file (plan already converted).
 // Matches by canonical name so a collision-bumped plan still finds its PRD.
+//
+// A matching `source_plan` alone is not proof of a successful conversion — a
+// crashed/interrupted plan-to-prd write, or a fragment-looking LLM response
+// (the same garbage-content failure mode fixed for plan stages in PR #750),
+// can leave a stub PRD JSON with `source_plan` set but no recognized `status`
+// and no `missing_features`. Treating that stub as "already converted" would
+// permanently skip re-running plan-to-prd for a plan that never actually got
+// a usable PRD. Require both a recognized top-level status AND an array
+// `missing_features` field before counting the PRD as an existing conversion.
 function _findExistingPrdForPlan(planFile, prdDir) {
   if (!fs.existsSync(prdDir)) return null;
   const prdFiles = safeReadDir(prdDir).filter(f => f.endsWith('.json'));
@@ -547,7 +565,12 @@ function _findExistingPrdForPlan(planFile, prdDir) {
     // safeJsonNoRestore: PRDs are terminal artifacts — never restore archived
     // PRDs from a stale .backup sidecar (W-mouptdh1000h9f39).
     const prd = safeJsonNoRestore(path.join(prdDir, pf));
-    if (prd?.source_plan && _canonicalPlanName(path.basename(String(prd.source_plan))) === planKey) return pf;
+    if (!prd?.source_plan || _canonicalPlanName(path.basename(String(prd.source_plan))) !== planKey) continue;
+    if (!(_VALID_EXISTING_PRD_STATUSES.has(prd.status) || isPrdArchived(prd)) || !Array.isArray(prd.missing_features)) {
+      log('warn', `Pipeline plan-to-prd: found PRD "${pf}" for plan "${planFile}" but it lacks a valid status/missing_features (garbage/incomplete conversion) — treating plan-to-prd as not yet done`);
+      continue;
+    }
+    return pf;
   }
   return null;
 }

package/engine/pull-requests-store.js

@@ -64,7 +64,33 @@ function _readJsonArrayFallback(scope) {
 
 // Content-hash fingerprint per scope: same-length swaps (timestamps,
 // reviewStatus enums) collide on (mtime, size) but never on SHA-1.
-const _lastMirrorHashByScope = new Map();
+//
+// W-mrcg7j9k000ja233 (#759): this used to be an in-memory-only Map, which
+// resets to empty on every process restart. Persist it in SQL instead
+// (`pr_mirror_hashes`) so a restart can't blank out the "does JSON already
+// agree with SQL" trust state — that reset, combined with a restart landing
+// mid-flight of another process's mirror write, is exactly what let a stale
+// JSON snapshot get treated as canonical and silently wipe SQL rows for a
+// scope (see _resyncScopeIfJsonDiverged / _hydrateScopeFromJson below).
+function _getLastMirrorHash(db, scope) {
+  try {
+    const row = db.prepare('SELECT hash FROM pr_mirror_hashes WHERE scope = ?').get(scope);
+    return row ? row.hash : null;
+  } catch { return null; }
+}
+
+function _setLastMirrorHash(db, scope, hash) {
+  try {
+    db.prepare(`
+      INSERT INTO pr_mirror_hashes (scope, hash, updated_at) VALUES (?, ?, ?)
+      ON CONFLICT(scope) DO UPDATE SET hash = excluded.hash, updated_at = excluded.updated_at
+    `).run(scope, hash, Date.now());
+  } catch { /* best-effort — a missed persisted-hash write just means the next resync re-checks */ }
+}
+
+function _forgetLastMirrorHash(db, scope) {
+  try { db.prepare('DELETE FROM pr_mirror_hashes WHERE scope = ?').run(scope); } catch { /* best-effort */ }
+}
 
 const crypto = require('crypto');
 
@@ -78,7 +104,24 @@ function _fileContentHash(filePath) {
 
 function _hydrateScopeFromJson(db, scope) {
   const jsonItems = _readJsonArrayFallback(scope);
+  const beforeCount = db.prepare('SELECT COUNT(*) AS n FROM pull_requests WHERE scope = ?').get(scope).n;
+  const beforeIds = db.prepare('SELECT id FROM pull_requests WHERE scope = ?').all(scope).map(r => r.id);
   db.prepare('DELETE FROM pull_requests WHERE scope = ?').run(scope);
+  // #759 — this DELETE used to be completely silent. Log every hydrate at
+  // warn level with before/after counts + the ids that are about to be
+  // dropped, so a JSON<->SQL resync that removes rows the operator didn't
+  // expect leaves a trace in engine-stdio.log instead of vanishing without
+  // explanation.
+  try {
+    const afterIds = new Set(jsonItems.filter(pr => pr && pr.id).map(pr => String(pr.id)));
+    const droppedIds = beforeIds.filter(id => !afterIds.has(id));
+    // eslint-disable-next-line no-console
+    console.warn(
+      `[pull-requests-store] _hydrateScopeFromJson(scope=${scope}): rebuilding SQL from JSON mirror — `
+      + `before=${beforeCount} row(s), after=${jsonItems.length} row(s)`
+      + (droppedIds.length ? `, dropping id(s): ${droppedIds.join(', ')}` : ''),
+    );
+  } catch { /* logging must never block the resync */ }
   if (jsonItems.length === 0) return;
   const now = Date.now();
   const ins = db.prepare(`
@@ -107,18 +150,18 @@ function _hydrateScopeFromJson(db, scope) {
 function _resyncScopeIfJsonDiverged(db, scope) {
   const jsonPath = _filePathForScope(scope);
   const currentHash = _fileContentHash(jsonPath);
-  const lastHash = _lastMirrorHashByScope.get(scope);
+  const lastHash = _getLastMirrorHash(db, scope);
   if (currentHash == null) return;
   if (lastHash != null && currentHash === lastHash) return;
   if (lastHash == null) {
     const sqlHas = db.prepare('SELECT 1 FROM pull_requests WHERE scope = ? LIMIT 1').get(scope);
     if (sqlHas) {
-      _lastMirrorHashByScope.set(scope, currentHash);
+      _setLastMirrorHash(db, scope, currentHash);
       return;
     }
   }
   _hydrateScopeFromJson(db, scope);
-  _lastMirrorHashByScope.set(scope, currentHash);
+  _setLastMirrorHash(db, scope, currentHash);
 }
 
 function readPullRequestsForScope(scope) {
@@ -253,7 +296,7 @@ function _applyPullRequestsDiff(db, diff) {
   return true;
 }
 
-function applyPullRequestsMutation(scope, mutator) {
+function applyPullRequestsMutation(scope, mutator, options = {}) {
   const { getDb, withTransaction } = require('./db');
   const db = getDb();
 
@@ -270,6 +313,23 @@ function applyPullRequestsMutation(scope, mutator) {
       : (Array.isArray(next) ? next : before);
     const diff = _computePullRequestsDiff(scope, beforeSnapshot, after);
     const wrote = _applyPullRequestsDiff(db, diff);
+    // W-mrcg7j9k000ja233 (#759) — mirror the JSON sidecar INSIDE this same
+    // SQL write transaction, BEFORE it commits, instead of after (as the
+    // caller in shared.js used to do post-return). This mirrors the fix
+    // already applied to work-items-store.js (W-mr9vcxvy000cdb4e): SQLite
+    // only allows one writer transaction at a time, so mirroring here
+    // guarantees the on-disk JSON file reflects this commit by the time it
+    // becomes visible to any other reader/writer. Without this ordering, a
+    // sibling process (dashboard vs. engine — separate Node processes, each
+    // with its own resync state) could observe the freshly committed SQL
+    // rows before the mirror file caught up, decide its own cached hash no
+    // longer matched the (still-stale) JSON file, and call
+    // _hydrateScopeFromJson — which DELETEs + reinserts the whole scope
+    // from that stale file, silently dropping the row this transaction just
+    // committed.
+    if (wrote) {
+      try { _mirrorJsonFromSql(scope, options.mirrorPath); } catch { /* best-effort — mirror failure must not block the SQL write */ }
+    }
     return { wrote, result: after };
   });
 }
@@ -293,7 +353,7 @@ function _mirrorJsonFromSql(scope, filePath) {
     const target = filePath || _filePathForScope(scope);
     shared.safeWrite(target, items);
     const h = _fileContentHash(target);
-    if (h != null) _lastMirrorHashByScope.set(scope, h);
+    if (h != null) _setLastMirrorHash(db, scope, h);
   } catch {
     // Mirror failures are non-fatal — SQL has already committed.
   }
@@ -312,7 +372,8 @@ function _mirrorJsonFromSql(scope, filePath) {
 function dropScope(scope) {
   try {
     const { getDb } = require('./db');
-    const result = getDb().prepare('DELETE FROM pull_requests WHERE scope = ?').run(scope);
+    const db = getDb();
+    const result = db.prepare('DELETE FROM pull_requests WHERE scope = ?').run(scope);
     // Mirror the work-items-store.js fix (W-mr96m3hm000fd5d7): don't blindly
     // forget the mirror-hash. _resyncScopeIfJsonDiverged treats "no recorded
     // hash" + "zero SQL rows" as a first-install hydrate and rebuilds SQL from
@@ -323,8 +384,8 @@ function dropScope(scope) {
     // actually gone, e.g. dataMode: 'purge'/'archive').
     const jsonPath = _filePathForScope(scope);
     const currentHash = _fileContentHash(jsonPath);
-    if (currentHash == null) _lastMirrorHashByScope.delete(scope);
-    else _lastMirrorHashByScope.set(scope, currentHash);
+    if (currentHash == null) _forgetLastMirrorHash(db, scope);
+    else _setLastMirrorHash(db, scope, currentHash);
     if (result && result.changes > 0) {
       try { require('./db-events').emitStateEvent('pull_requests'); } catch { /* optional */ }
     }

package/engine/queries.js

@@ -883,13 +883,16 @@ function _prFreshnessMs(pr) {
 function _pickPrDedupeWinner(group, projects) {
   if (group.length === 1) return { winner: group[0], dropped: [] };
 
-  // Map each project name -> its canonical scope, so we can detect when a
-  // record's _scope matches the PR url-derived scope (preference #2 below).
-  const projectScopeByName = new Map();
+  // Map each project name -> its set of canonical scopes (primary +
+  // additionalRepoScopes, W-mrchrfe100067d3a), so we can detect when a
+  // record's _scope matches the PR url-derived scope (preference #2 below)
+  // even when the match is via an allowlisted secondary scope rather than
+  // the project's primary repo.
+  const projectScopesByName = new Map();
   for (const p of projects || []) {
     if (!p || !p.name) continue;
-    const sc = shared.getProjectPrScope(p);
-    if (sc) projectScopeByName.set(p.name, sc);
+    const scopes = shared.getProjectAllPrScopes(p);
+    if (scopes.length > 0) projectScopesByName.set(p.name, scopes);
   }
 
   // Resolve the PR's "correct" scope from its URL (independent of _scope).
@@ -907,8 +910,8 @@ function _pickPrDedupeWinner(group, projects) {
   //  bit 0: freshness rank (broken into a separate tiebreak after)
   function scoreOf(pr) {
     const scopeOk = !pr._invalidProjectScope ? 1 : 0;
-    const projectScope = projectScopeByName.get(pr._scope) || '';
-    const matchesUrl = urlScope && projectScope && projectScope === urlScope ? 1 : 0;
+    const projectScopes = projectScopesByName.get(pr._scope) || [];
+    const matchesUrl = urlScope && projectScopes.includes(urlScope) ? 1 : 0;
     return (scopeOk << 1) | matchesUrl;
   }
 

package/engine/shared.js

@@ -7227,6 +7227,74 @@ function getPrScopeInfo(prRef, url = '') {
   return canonical ? { ...canonical, source: 'id' } : null;
 }
 
+// W-mrchrfe100067d3a — validate + normalize `project.additionalRepoScopes`,
+// an explicit per-project opt-in allowlist of secondary canonical PR scopes
+// (e.g. `["github:yemi33/minions"]` for the minions-opg project's live
+// checkout, which legitimately carries a second git remote for backport
+// work — see CLAUDE.md "Remotes"). Deliberately NOT a wildcard: a scope must
+// be an exact `host:owner/repo` (or ADO `host:org/project/repo`) match to be
+// treated as compatible, so a typo'd or malicious PR URL can't slip into
+// auto-management just because *some* additional scope is configured.
+// Returns a deduped, normalized (lowercase, trimmed) array of scope strings;
+// malformed / empty entries are silently dropped (read-side leniency — write
+// paths should validate with validateAdditionalRepoScopes instead).
+function getProjectAdditionalPrScopes(project) {
+  const raw = project?.additionalRepoScopes;
+  if (!Array.isArray(raw) || raw.length === 0) return [];
+  const out = [];
+  const seen = new Set();
+  for (const entry of raw) {
+    const scope = _normalizeScopeString(entry);
+    if (scope && !seen.has(scope)) {
+      seen.add(scope);
+      out.push(scope);
+    }
+  }
+  return out;
+}
+
+// Normalizes+validates a single scope string of the shape `github:owner/repo`
+// or `ado:org/project/repo`. Returns '' for anything malformed.
+function _normalizeScopeString(value) {
+  const match = String(value || '').trim().match(/^(github|ado):(.+)$/i);
+  if (!match) return '';
+  const host = match[1].toLowerCase();
+  const parts = match[2].split('/').map(normalizePrScopeSegment).filter(Boolean);
+  const expectedParts = host === 'github' ? 2 : 3;
+  if (parts.length !== expectedParts) return '';
+  return `${host}:${parts.join('/')}`;
+}
+
+// Validates a project-settings-update payload for `additionalRepoScopes`.
+// Mirrors the validateCheckoutMode/validateLiveValidation contract: returns
+// undefined when the caller should clear the field (empty/null/[] input);
+// otherwise returns the normalized array, or throws HTTP 400 on malformed
+// input (non-array, non-string entries, or entries that don't match the
+// canonical `host:owner/repo[/repo]` scope grammar).
+function validateAdditionalRepoScopes(value) {
+  if (value === undefined || value === null) return undefined;
+  if (!Array.isArray(value)) {
+    throw _httpError(400, `Invalid additionalRepoScopes: must be an array of scope strings (got ${typeof value}).`);
+  }
+  if (value.length === 0) return undefined;
+  const out = [];
+  const seen = new Set();
+  for (const entry of value) {
+    if (typeof entry !== 'string' || !entry.trim()) {
+      throw _httpError(400, `Invalid additionalRepoScopes entry: "${entry}" — must be a non-empty string.`);
+    }
+    const scope = _normalizeScopeString(entry);
+    if (!scope) {
+      throw _httpError(400, `Invalid additionalRepoScopes entry: "${entry}" — expected "github:owner/repo" or "ado:org/project/repo".`);
+    }
+    if (!seen.has(scope)) {
+      seen.add(scope);
+      out.push(scope);
+    }
+  }
+  return out.length > 0 ? out : undefined;
+}
+
 function getPrProjectScopeMismatch(project, prRef, url = '') {
   const projectScope = getProjectPrScope(project);
   if (!projectScope) return null;
@@ -7240,6 +7308,11 @@ function getPrProjectScopeMismatch(project, prRef, url = '') {
     const refParts = refRest.split('/');
     if (projectParts[0] === refParts[0] && projectParts[1] === refParts[1]) return null;
   }
+  // W-mrchrfe100067d3a — explicit opt-in allowlist: a PR scoped to one of
+  // this project's configured additionalRepoScopes is NOT a mismatch. This
+  // is intentionally an exact-match allowlist (not "any scope compatible")
+  // so an unrelated/typo'd repo URL still gets flagged.
+  if (getProjectAdditionalPrScopes(project).includes(refScope)) return null;
   return { reason: 'pr_scope_mismatch', projectScope, prScope: refScope };
 }
 
@@ -7247,6 +7320,85 @@ function isPrCompatibleWithProject(project, prRef, url = '') {
   return !getPrProjectScopeMismatch(project, prRef, url);
 }
 
+// All canonical scopes this project is configured to own: its primary scope
+// plus any additionalRepoScopes. Used by cross-project PR dedupe scoring
+// (queries.js) so a record scoped to a secondary allowlisted repo isn't
+// penalized relative to records in projects whose PRIMARY scope matches.
+function getProjectAllPrScopes(project) {
+  const primary = getProjectPrScope(project);
+  const additional = getProjectAdditionalPrScopes(project);
+  const out = [];
+  if (primary) out.push(primary);
+  for (const s of additional) if (!out.includes(s)) out.push(s);
+  return out;
+}
+
+// W-mrchrfe100067d3a — cache of `localPath -> Map(scope -> remoteName)`
+// derived from `git remote -v`, so repeated dependency-fetch resolution
+// within a tick (or across nearby ticks) doesn't re-shell-out per branch.
+const _gitRemoteScopeCache = new Map();
+const GIT_REMOTE_SCOPE_CACHE_TTL_MS = 5 * 60 * 1000;
+
+// Best-effort parse of a git remote fetch URL into a canonical scope string.
+// Handles the URL shapes git itself produces for `git remote -v` output:
+// SSH (`git@host:owner/repo.git`), HTTPS (`https://host/owner/repo.git`),
+// and the two common ADO host forms (`dev.azure.com/org/project/_git/repo`,
+// `org.visualstudio.com/project/_git/repo`). Returns null when unrecognized.
+function _parseRemoteUrlToScope(url) {
+  const cleaned = String(url || '').trim().replace(/\.git$/i, '');
+  if (!cleaned) return null;
+  let m = cleaned.match(/github\.com[:/]+([^/]+)\/([^/]+)\/?$/i);
+  if (m) return `github:${normalizePrScopeSegment(m[1])}/${normalizePrScopeSegment(m[2])}`;
+  m = cleaned.match(/dev\.azure\.com\/([^/]+)\/([^/]+)\/_git\/([^/]+)\/?$/i);
+  if (m) return `ado:${normalizePrScopeSegment(m[1])}/${normalizePrScopeSegment(m[2])}/${normalizePrScopeSegment(m[3])}`;
+  m = cleaned.match(/([^/@:]+)\.visualstudio\.com\/(?:DefaultCollection\/)?([^/]+)\/_git\/([^/]+)\/?$/i);
+  if (m) return `ado:${normalizePrScopeSegment(m[1])}/${normalizePrScopeSegment(m[2])}/${normalizePrScopeSegment(m[3])}`;
+  return null;
+}
+
+function _listGitRemoteScopes(localPath) {
+  if (!localPath) return new Map();
+  const now = Date.now();
+  const cached = _gitRemoteScopeCache.get(localPath);
+  if (cached && (now - cached.at) < GIT_REMOTE_SCOPE_CACHE_TTL_MS) return cached.remotes;
+  const remotes = new Map();
+  try {
+    const out = shellSafeGitSync(['remote', '-v'], { cwd: localPath, timeout: 10000 });
+    for (const line of String(out || '').split('\n')) {
+      const m = line.match(/^(\S+)\s+(\S+)\s+\(fetch\)/);
+      if (!m) continue;
+      const scope = _parseRemoteUrlToScope(m[2]);
+      if (scope && !remotes.has(scope)) remotes.set(scope, m[1]);
+    }
+  } catch { /* best effort — caller falls back to 'origin' */ }
+  _gitRemoteScopeCache.set(localPath, { at: now, remotes });
+  return remotes;
+}
+
+// W-mrchrfe100067d3a — resolve which git remote name owns a PR's branch when
+// that PR is scoped to one of the project's additionalRepoScopes entries
+// (e.g. a backport PR opened against `yemi33/minions` from the minions-opg
+// checkout, which has both `origin` -> opg-microsoft/minions and `yemi33` ->
+// yemi33/minions configured). For the project's own primary scope, or any
+// scope NOT in additionalRepoScopes, this always returns 'origin' —
+// preserving today's universal default for every project that doesn't opt
+// into multi-scope tracking. Only when the scope is allowlisted AND a local
+// remote's fetch URL actually resolves to that scope do we return the
+// non-origin remote name; otherwise 'origin' remains the safe fallback (the
+// caller's existing fetch-failure handling is unchanged).
+function resolveGitRemoteForPrScope(project, prScopeOrRef, url = '') {
+  if (!project) return 'origin';
+  const scope = (typeof prScopeOrRef === 'string' && /^(github|ado):/i.test(prScopeOrRef))
+    ? prScopeOrRef
+    : (getPrScopeInfo(prScopeOrRef, url)?.scope || '');
+  if (!scope) return 'origin';
+  const projectScope = getProjectPrScope(project);
+  if (scope === projectScope) return 'origin';
+  if (!getProjectAdditionalPrScopes(project).includes(scope)) return 'origin';
+  const remotes = _listGitRemoteScopes(project.localPath);
+  return remotes.get(scope) || 'origin';
+}
+
 /**
  * Check if a parsed ADO PR scope is compatible with a project config,
  * considering that the repo segment in the URL might be either the friendly
@@ -8012,12 +8164,21 @@ function mutatePullRequests(filePath, mutator) {
   if (insideMinionsDir) {
     const store = require('./pull-requests-store');
     const scope = store.scopeForFilePath(filePath);
+    // W-mrcg7j9k000ja233 (#759) — the JSON mirror is now written INSIDE
+    // applyPullRequestsMutation's SQL transaction (before commit), not here
+    // after the fact. Mirroring post-commit left a cross-process window
+    // where a sibling process (dashboard vs. engine — separate Node
+    // processes) could observe the new SQL row before the JSON file caught
+    // up and destructively rehydrate the scope from that stale file,
+    // dropping the just-written row. See
+    // pull-requests-store.js#applyPullRequestsMutation for the full
+    // rationale (mirrors the identical work-items-store.js fix,
+    // W-mr9vcxvy000cdb4e).
     const { wrote, result } = store.applyPullRequestsMutation(scope, (prs) => {
       if (!Array.isArray(prs)) prs = [];
       return mutator(prs) || prs;
-    });
+    }, { mirrorPath: filePath });
     if (wrote) {
-      try { store._mirrorJsonFromSql(scope, filePath); } catch { /* mirror best-effort */ }
       try { require('./db-events').emitStateEvent('pull_requests'); } catch { /* optional */ }
     }
     return result;
@@ -9098,6 +9259,10 @@ module.exports = {
   rewriteInboxRefsAcrossProjects,
   _artifactNoteFileToken, // exported so the one-time note-link backfill shares the token grammar
   getProjectPrScope,
+  getProjectAdditionalPrScopes,
+  getProjectAllPrScopes,
+  validateAdditionalRepoScopes,
+  resolveGitRemoteForPrScope,
   getPrNumber,
   getPrDisplayId,
   getPrScopeInfo,

package/engine.js

@@ -710,6 +710,12 @@ function resolveDependencyBranches(depIds, sourcePlan, project, config) {
           projectName: p.name || null,
           projectRoot: depRoot,
           isCrossRepo: !!currentProjectName && p.name !== currentProjectName,
+          // W-mrchrfe100067d3a — same-project deps whose PR is scoped to one
+          // of `p`'s additionalRepoScopes entries (e.g. a backport PR opened
+          // against yemi33/minions from the minions-opg checkout) live on a
+          // different git remote than 'origin'. Resolved once here so the
+          // fetch/push loop below doesn't hardcode 'origin' for those.
+          remote: shared.resolveGitRemoteForPrScope(p, pr),
         });
       }
     }
@@ -3758,12 +3764,26 @@ async function spawnAgent(dispatchItem, config) {
             depMergeFailed = true;
           }
           const fetchResults = await Promise.allSettled(
-            fetchable.map(({ branch: depBranch }) =>
+            fetchable.map(({ branch: depBranch, remote: depRemote }) => {
               // runAdoGit for ADO projects auto-retries once on auth failure
               // with a refreshed bearer token (handles mid-dispatch expiry).
               // For non-ADO projects it's a thin pass-through to shellSafeGit.
-              adoGitAuth.runAdoGit(project, ['fetch', 'origin', depBranch], { ..._gitOpts, cwd: rootDir }).then(() => depBranch)
-            )
+              // W-mrchrfe100067d3a — depRemote resolves to a non-'origin'
+              // name only when this dep's PR is scoped to one of the
+              // project's allowlisted additionalRepoScopes AND a local git
+              // remote actually maps to it. In that case fetch with an
+              // explicit refspec that writes into refs/remotes/origin/* —
+              // an aliased local ref path — so every downstream merge-base /
+              // merge-tree / merge step that reads `origin/<depBranch>`
+              // (below, and in pruneAncestorDeps / preflightMergeSimulation)
+              // keeps working unchanged, regardless of which real remote the
+              // branch actually lives on.
+              const remote = depRemote || 'origin';
+              const fetchArgs = remote === 'origin'
+                ? ['fetch', 'origin', depBranch]
+                : ['fetch', remote, `+${depBranch}:refs/remotes/origin/${depBranch}`];
+              return adoGitAuth.runAdoGit(project, fetchArgs, { ..._gitOpts, cwd: rootDir }).then(() => depBranch);
+            })
           );
           const hasFetchFailures = fetchResults.some(r => r.status === 'rejected');
           const allPrsForFetch = hasFetchFailures ? shared.getProjects(config).reduce((acc, p) => acc.concat(safeJsonArr(shared.projectPrPath(p))), []) : [];
@@ -3773,6 +3793,7 @@ async function spawnAgent(dispatchItem, config) {
             if (fetchResults[i].status === 'rejected') {
               const failedBranch = fetchable[i].branch;
               const failedPrId = fetchable[i].prId;
+              const failedRemote = fetchable[i].remote || 'origin';
               const errMsg = fetchResults[i].reason?.message || '';
               const pr = allPrsForFetch.find(p => p.id === failedPrId);
               if (pr && (pr.status === PR_STATUS.MERGED || pr.status === PR_STATUS.CLOSED)) {
@@ -3783,10 +3804,15 @@ async function spawnAgent(dispatchItem, config) {
               if (errMsg.includes('couldn\'t find remote ref') || errMsg.includes('not found in upstream')) {
                 try {
                   await shared.shellSafeGit(['rev-parse', '--verify', `refs/heads/${failedBranch}`], { ..._gitOpts, cwd: rootDir });
-                  // Branch exists locally — push it to origin
-                  log('info', `Dependency ${failedBranch} exists locally but not on remote — pushing to origin`);
-                  await shared.shellSafeGit(['push', 'origin', failedBranch], { ..._gitOpts, cwd: rootDir, timeout: 60000 });
-                  log('info', `Successfully pushed local-only dependency branch ${failedBranch} to origin`);
+                  // Branch exists locally — push it to its resolved remote
+                  log('info', `Dependency ${failedBranch} exists locally but not on remote — pushing to ${failedRemote}`);
+                  await shared.shellSafeGit(['push', failedRemote, failedBranch], { ..._gitOpts, cwd: rootDir, timeout: 60000 });
+                  // Keep the refs/remotes/origin/* alias in sync with the
+                  // local branch so downstream `origin/<branch>` reads
+                  // (merge-base/merge-tree/merge) resolve correctly even
+                  // though the push landed on a non-origin remote.
+                  await shared.shellSafeGit(['update-ref', `refs/remotes/origin/${failedBranch}`, `refs/heads/${failedBranch}`], { ..._gitOpts, cwd: rootDir });
+                  log('info', `Successfully pushed local-only dependency branch ${failedBranch} to ${failedRemote}`);
                   recoveredBranches.add(failedBranch);
                   continue;
                 } catch (localErr) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yemi33/minions",
-  "version": "0.1.2355",
+  "version": "0.1.2356",
   "description": "Multi-agent AI dev team that runs from ~/.minions/ — five autonomous agents share a single engine, dashboard, and knowledge base",
   "bin": {
     "minions": "bin/minions.js"