@yemi33/minions 0.1.2362 → 0.1.2363

package/dashboard.js

@@ -14113,8 +14113,14 @@ What would you like to discuss or change? When you're happy, say "approve" and I
         path.join(MINIONS_DIR, 'pull-requests.json'),
       ];
       let found = false;
+      // Issue #803: tombstone EVERY scope that has a copy of this PR id, not
+      // just the first one found. When enrollPrFromCanonicalId (issue #802)
+      // has left a stray cross-scope duplicate (e.g. a legit per-project row
+      // plus a stray central-scope copy), stopping at the first match leaves
+      // the other scope's copy fully untouched — queries.js#getPullRequests
+      // then de-dupes by picking that untouched duplicate as the "winner"
+      // and silently resurrects the "deleted" PR on the next read.
       for (const prPath of prPaths) {
-        if (found) break;
         // Issue #384: use a tombstone (userDeleted:true) instead of splice so
         // the next poller cycle cannot re-add the PR. The entry stays in the
         // file but is filtered from API responses and skipped by pollers.

package/engine/lifecycle.js

@@ -1378,7 +1378,20 @@ async function enrollPrFromCanonicalId(canonicalPrId, project, opts = {}) {
     // pr-links stays consistent (#779 pattern).
     if (opts.itemId && Array.isArray(existing.prdItems) && !existing.prdItems.includes(opts.itemId)) {
       try {
-        const targetPath = project ? shared.projectPrPath(project) : path.join(MINIONS_DIR, 'pull-requests.json');
+        // W-mrduef3q000m2172 — derive targetPath from the scope the store
+        // actually returned `existing` under (existing._scope), NOT from the
+        // current call's `project` argument. When the two differ (e.g. the
+        // record lives under 'central' but this enrollment call was made
+        // with a specific project), re-deriving from `project` sends the
+        // upsert to the WRONG scope's file/array. upsertPullRequestRecord's
+        // tombstone guard then finds no matching record in that (wrong)
+        // scope and falls through to insert-as-new, silently clearing any
+        // userDeleted tombstone on the real record. See issue writeup for
+        // the confirmed repro.
+        const store = require('./pull-requests-store');
+        const targetPath = existing._scope
+          ? store._filePathForScope(existing._scope)
+          : (project ? shared.projectPrPath(project) : path.join(MINIONS_DIR, 'pull-requests.json'));
         shared.upsertPullRequestRecord(targetPath, {
           id: normalizedCanonicalId,
           prNumber,

package/engine/queries.js

@@ -995,12 +995,25 @@ function getPullRequests(config) {
   // Then merge non-conflicting fields from the loser into the winner so we
   // never lose prdItems, sourcePlan, itemType, minionsReview, or
   // _automationFixCauses if only the loser carried them.
+  // Issue #803 — defense in depth: if a canonical PR id has a tombstoned
+  // (userDeleted:true) copy in ANY scope, treat the whole id as deleted, not
+  // just that one record. Without this, a delete that (for whatever reason)
+  // only tombstones one scope's copy would still have its untouched
+  // cross-scope duplicate survive grouping below and get picked as the
+  // dedupe "winner", silently resurrecting a PR the user just deleted.
+  const tombstonedIds = new Set();
+  for (const pr of sqlPrs) {
+    if (pr && pr.id && pr.userDeleted === true) tombstonedIds.add(pr.id);
+  }
+
   const groups = [];
   const groupsById = new Map();
   for (const pr of sqlPrs) {
     if (!pr || !pr.id) continue;
-    // Issue #384: skip tombstoned records (user explicitly deleted)
+    // Issue #384/#803: skip tombstoned records (user explicitly deleted), and
+    // skip ANY record sharing an id that has a tombstoned copy elsewhere.
     if (pr.userDeleted === true) continue;
+    if (tombstonedIds.has(pr.id)) continue;
     if (!groupsById.has(pr.id)) {
       const g = [];
       groupsById.set(pr.id, g);

package/engine/shared.js

@@ -7930,6 +7930,23 @@ function upsertPullRequestRecord(prPath, entry, { project = null, itemId = null,
       delete target.userDeletedAt;
       resurrected = true;
     }
+    // W-mrduef3q000m2172 — defense-in-depth: `prs` here is scoped to a single
+    // scope's array (mutatePullRequests routes by prPath). If a caller
+    // resolved the wrong scope for an already-tombstoned canonical id (the
+    // record actually lives in a DIFFERENT scope's file), the above check
+    // never sees it and would otherwise fall through to insert-as-new,
+    // silently clearing the tombstone. Check globally before inserting.
+    if (!target) {
+      try {
+        const store = require('./pull-requests-store');
+        const globalMatch = (store.readAllPullRequests() || [])
+          .find(pr => pr && pr.id === canonicalId && pr.userDeleted === true);
+        if (globalMatch) {
+          skipped = true;
+          return prs;
+        }
+      } catch { /* best-effort global tombstone check — fall through on failure */ }
+    }
     // P-e9f0a2b4 — When findPrRecord returns null but multiple records share the
     // same prNumber (e.g. cross-scope contamination or a project-config change
     // that shifted canonical IDs), collapse the duplicates before inserting.

package/engine.js

@@ -28,13 +28,14 @@ require('./engine/stdio-timestamps').installIfNotInstalled();
 
 const fs = require('fs');
 const path = require('path');
+const os = require('os');
 const crypto = require('crypto');
 const shared = require('./engine/shared');
 const { exec, execAsync, execSilent, runFile, ts, ENGINE_DEFAULTS,
   WI_STATUS, DONE_STATUSES, WORK_TYPE, PLAN_STATUS, PRD_ITEM_STATUS, PRD_MATERIALIZABLE, PR_STATUS, REVIEW_STATUS, DISPATCH_RESULT, AGENT_STATUS,
   FAILURE_CLASS, resolvePollFlag } = shared;
 const { resolveRuntime } = require('./engine/runtimes');
-const { assertStaleHeadOk } = require('./engine/spawn-agent');
+const { assertStaleHeadOk, preApproveWorkspaceMcps, computeAddDirs } = require('./engine/spawn-agent');
 const adoGitAuth = require('./engine/ado-git-auth');
 const queries = require('./engine/queries');
 const dispatchEvents = require('./engine/dispatch-events');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yemi33/minions",
-  "version": "0.1.2362",
+  "version": "0.1.2363",
   "description": "Multi-agent AI dev team that runs from ~/.minions/ — five autonomous agents share a single engine, dashboard, and knowledge base",
   "bin": {
     "minions": "bin/minions.js"