@yemi33/minions 0.1.2362 → 0.1.2364

package/dashboard/js/command-center.js

@@ -1286,6 +1286,9 @@ async function _ccDoSend(message, skipUserMsg, forceTabId, intentMetadata) {
         updateStreamDiv();
       } else if (evt.type === 'heartbeat') {
         return;
+      } else if (evt.type === 'status') {
+        streamStatusNote = evt.message || '';
+        updateStreamDiv();
       } else if (evt.type === 'tool') {
         ccSegmentsApplyTool(segments, { name: evt.name, input: evt.input || {}, id: evt.id || null });
         if (activeTab) activeTab._segments = segments;

package/dashboard.js

@@ -2644,15 +2644,14 @@ function _getMtimes() {
   return result;
 }
 
-// Reset the per-source caches whose TTL would otherwise serve stale data
-// across rebuilds. Skill files (`queries._skillsCache` 30s) and MCP servers
-// (`_mcpServersCache` 5min) are the two with TTLs longer than our poll
-// cadence, and both back slices the user sees on screen. Called on every
-// mtime-detected rebuild so the rebuild always reads fresh disk state.
+// Reset per-source caches whose TTL would otherwise survive an mtime-triggered
+// status rebuild and serve stale data.
 function _invalidateInnerCachesForRebuild() {
   try { queries.invalidateSkillsCache(); } catch { /* optional */ }
   _mcpServersCache = null;
   _mcpServersCacheTs = 0;
+  _diskVersionCache = null;
+  _diskVersionCacheTs = 0;
 }
 
 function _mtimesChanged(prev, curr) {
@@ -3706,6 +3705,7 @@ function _ensureCcLiveStream(tabId) {
     tabId,
     text: '',
     tools: [],
+    statusMessage: '',
     donePayload: null,
     writer: null,
     endResponse: null,
@@ -6341,6 +6341,11 @@ const server = http.createServer(async (req, res) => {
       if (!wiPath) {
         const prdFile = body.prdFile;
         if (!prdFile) return jsonReply(res, 404, { error: 'work item not found in any source' });
+        // W-mrdykt9m0006e459 — prdFile is unauthenticated client input; reject
+        // traversal/absolute paths and anything that resolves outside PRD_DIR
+        // before it ever reaches a filesystem read.
+        try { shared.sanitizePath(prdFile, PRD_DIR); }
+        catch { return jsonReply(res, 400, { error: 'invalid prdFile path' }); }
 
         // Look up PRD item to create a new work item on-demand.
         // safeJsonNoRestore — PRDs are terminal artifacts; a stale .backup
@@ -10048,6 +10053,14 @@ What would you like to discuss or change? When you're happy, say "approve" and I
     if (!hasImages && shared.resolveCcUseWorkerPool(engineConfig)) {
       return _invokeCcStreamViaPool({ prompt, liveState, toolUses, model, effort, engineConfig, systemPrompt, tabId });
     }
+    const setStatus = (message) => {
+      liveState.statusMessage = message;
+      if (liveState.writer) liveState.writer({ type: 'status', message });
+    };
+    if (hasImages) {
+      _touchCcLiveStream(liveState);
+      setStatus('Looking at the image...');
+    }
     const { callLLMStreaming } = require('./engine/llm');
     return callLLMStreaming(prompt, systemPrompt, {
       timeout: CC_CALL_TIMEOUT_MS, label: 'command-center', model, maxTurns,
@@ -10056,11 +10069,17 @@ What would you like to discuss or change? When you're happy, say "approve" and I
       engineConfig, images,
       onChunk: (text, segmentId) => {
         _touchCcLiveStream(liveState);
+        if (liveState.statusMessage) {
+          setStatus('');
+        }
         liveState.text = text;
         if (liveState.writer) liveState.writer({ type: 'chunk', text, segmentId });
       },
       onToolUse: (name, input, id) => {
         _touchCcLiveStream(liveState);
+        if (liveState.statusMessage) {
+          setStatus('');
+        }
         // Claude (direct) now threads a tool_use id; with an id the chip starts
         // 'pending' and can be flipped to completed/failed by onToolUpdate.
         const entry = { name, input: input || {}, id: id || null, status: id ? 'pending' : null };
@@ -10515,6 +10534,7 @@ What would you like to discuss or change? When you're happy, say "approve" and I
             writeCcEvent({ type: 'tool-update', id: tool.id, status: tool.status });
           }
         }
+        if (live.statusMessage) writeCcEvent({ type: 'status', message: live.statusMessage });
         if (live.text) writeCcEvent({ type: 'chunk', text: live.text });
         if (live.donePayload) {
           writeCcEvent(live.donePayload);
@@ -11276,6 +11296,15 @@ What would you like to discuss or change? When you're happy, say "approve" and I
         } catch { /* unknown/free-text runtime */ }
         return modelStr;
       }
+      const _isClear = (v) => v === '' || v === null;
+      let _registeredCliNames = null;
+      const _validCli = (name) => {
+        if (_registeredCliNames == null) {
+          try { _registeredCliNames = _engineRuntimes.listRuntimes(); }
+          catch { _registeredCliNames = []; }
+        }
+        return _registeredCliNames.length === 0 || _registeredCliNames.includes(String(name));
+      };
       if (body.engine) {
         const e = body.engine;
         const D = shared.ENGINE_DEFAULTS;
@@ -11385,15 +11414,6 @@ What would you like to discuss or change? When you're happy, say "approve" and I
         // chooses)" option submits '' and we must persist that as "unset".
         // Validate `defaultCli` and `ccCli` against the runtime registry so a
         // typo in the dashboard can't pin the fleet to a non-existent runtime.
-        const _isClear = (v) => v === '' || v === null;
-        let _registeredCliNames = null;
-        const _validCli = (name) => {
-          if (_registeredCliNames == null) {
-            try { _registeredCliNames = require('./engine/runtimes').listRuntimes(); }
-            catch { _registeredCliNames = []; }
-          }
-          return _registeredCliNames.length === 0 || _registeredCliNames.includes(String(name));
-        };
         if (e.defaultCli !== undefined) {
           if (_isClear(e.defaultCli)) _deleteEngineConfig('defaultCli');
           else if (_validCli(e.defaultCli)) _setEngineConfig('defaultCli', String(e.defaultCli));
@@ -11589,8 +11609,9 @@ What would you like to discuss or change? When you're happy, say "approve" and I
           // CLI values pin the agent to a specific runtime. `0` is a valid
           // maxBudgetUsd (read-only / dry-run agents).
           if (updates.cli !== undefined) {
-            if (updates.cli === '' || updates.cli === null) delete config.agents[id].cli;
-            else config.agents[id].cli = String(updates.cli);
+            if (_isClear(updates.cli)) delete config.agents[id].cli;
+            else if (_validCli(updates.cli)) config.agents[id].cli = String(updates.cli);
+            else _clamped.push(`agents.${id}.cli: "${updates.cli}" not registered (kept previous value)`);
           }
           if (updates.model !== undefined) {
             if (updates.model === '' || updates.model === null) delete config.agents[id].model;
@@ -14113,8 +14134,14 @@ What would you like to discuss or change? When you're happy, say "approve" and I
         path.join(MINIONS_DIR, 'pull-requests.json'),
       ];
       let found = false;
+      // Issue #803: tombstone EVERY scope that has a copy of this PR id, not
+      // just the first one found. When enrollPrFromCanonicalId (issue #802)
+      // has left a stray cross-scope duplicate (e.g. a legit per-project row
+      // plus a stray central-scope copy), stopping at the first match leaves
+      // the other scope's copy fully untouched — queries.js#getPullRequests
+      // then de-dupes by picking that untouched duplicate as the "winner"
+      // and silently resurrects the "deleted" PR on the next read.
       for (const prPath of prPaths) {
-        if (found) break;
         // Issue #384: use a tombstone (userDeleted:true) instead of splice so
         // the next poller cycle cannot re-add the PR. The entry stays in the
         // file but is filtered from API responses and skipped by pollers.
@@ -14895,7 +14922,8 @@ What would you like to discuss or change? When you're happy, say "approve" and I
   // dashboard route serves dashboard/slim.html instead of the full SPA.
   // Checked at request time so /api/features/toggle flips behavior with
   // no restart; flag-off means zero behavior change for the catch-all.
-  if (pathname === '/' && features.isFeatureOn('slim-ux', CONFIG)) {
+  const fullDashboardRequested = new URL(req.url, 'http://localhost').searchParams.get('fullDashboard') === '1';
+  if (pathname === '/' && !fullDashboardRequested && features.isFeatureOn('slim-ux', CONFIG)) {
     return serveSlimUx(req, res);
   }
 

package/docs/architecture-review-2026-07-09.md

@@ -0,0 +1,94 @@
+# Architecture Review — 2026-07-09
+
+Scope: engine orchestration, SQL/JSON state boundaries, runtime/process recovery,
+worktree lifecycle, pipelines/schedules, dashboard/API settings, and prompt
+assembly. Findings were verified against `origin/main` at `b1b83dd2`.
+
+## Fixed in this change
+
+### High: Codex processes were rejected by orphan recovery
+
+`isProcessCommandLineMatchingAgent` recognized only Claude and Copilot. After an
+engine restart, a live Codex dispatch could therefore be classified as a
+recycled PID and retried while the original process was still running.
+
+The process gate now recognizes all bundled runtime CLIs, including native and
+npm-installed Codex and Claude layouts, without accepting unrelated substring
+matches.
+
+### High: worktree GC lost the project name from real dispatch rows
+
+Worktree GC assumed `dispatch.meta.project` was a string, while production
+dispatches store a project descriptor object. In shared worktree-root layouts,
+the resulting `default` hash could fail to protect another project's active
+worktree from orphan cleanup.
+
+GC now resolves both the current object shape and the legacy string shape.
+
+### Medium: invalid per-agent runtimes bypassed settings validation
+
+Fleet runtime fields were validated against the adapter registry, but
+`agents.<id>.cli` was persisted verbatim. A typo could poison future dispatches
+with a runtime-resolution failure. Per-agent overrides now share the fleet
+validation path and preserve the previous value on invalid input.
+
+### Medium: the no-TTL status cache omitted its own source files
+
+`/api/status` includes config-, install-, and package-derived fields but its
+mtime registry omitted `config.json`, `.install-id`, and `package.json`.
+Out-of-process changes could remain stale indefinitely. These inputs now
+participate in cache invalidation.
+
+### Medium: Slim UX trapped users away from advanced settings
+
+Slim linked to `/?fullDashboard=1`, but root takeover ignored the query string
+and served Slim again. The root dispatcher now honors that explicit classic-UX
+escape hatch.
+
+### Low: prompt validation generated warnings for valid templates
+
+The validator required the literal `## Your Task`, while established playbooks
+also use `## Task Description` and `## Mission`. Those valid aliases now satisfy
+the task-section contract, eliminating recurring false-positive warnings.
+
+### Low: cancelled cron work blocked future schedule fires
+
+The dashboard run-now path already treated cancelled work as terminal, but the
+engine's cron enqueue dedup did not. Both paths now allow a new run after
+cancellation.
+
+## Verified follow-up findings
+
+These require separate focused changes rather than expanding this PR:
+
+1. **Dispatch SQL/JSON empty-state resurrection (high).** A process that has not
+   written SQL can still adopt stale `dispatch.json` when the SQL table is empty.
+   The durable fix is a mirror-generation/hash marker or removal of the legacy
+   fallback, not moving filesystem writes inside a SQLite transaction.
+2. **Pipeline task terminal-state model (high).** Task stages use a boolean
+   completion check and promote failed work items to a completed pipeline stage;
+   cancelled/review-blocked work can wedge indefinitely. Replace the boolean
+   helper with an explicit terminal outcome (`completed`, `failed`,
+   `waiting-human`, non-terminal) and propagate it through parallel stages.
+3. **Settings save spans two independent writes (medium).** Config and routing
+   are saved through separate endpoints, so routing failure can leave a partial
+   configuration update. A combined transactional settings contract should
+   replace the client-side two-step sequence.
+4. **ADO identity lookup duplication (medium).** PR polling resolves the same
+   authenticated user more than once per PR. Cache it once per organization and
+   poll pass to reduce throttling pressure.
+5. **Late descendant process leak window (medium).** Spawn cleanup snapshots
+   descendants at 3 seconds and then every 30 seconds. Children created and
+   reparented inside that window can evade final cleanup. Track descendants more
+   frequently while the runtime is alive.
+6. **Supervisor stale PID reuse (medium).** Startup trusts any live PID in
+   `supervisor.pid`. Validate the command line against this checkout's
+   `engine/supervisor.js` before suppressing startup.
+
+## Healthy areas
+
+- Config/routing references and schedule schemas were valid.
+- Runtime work-item and pull-request mirrors had no stuck dispatched rows,
+  duplicate PR IDs, or unknown PR states.
+- No active dispatch was older than the five-hour wall-clock limit.
+- Cooldown state was small and not exhibiting pending-context bloat.

package/docs/command-center.md

@@ -70,6 +70,8 @@ Any violation rejects the **whole turn** with a typed error envelope (`code: 'in
 
 **Worker-pool interaction (W-mray463s001zcee2).** The opt-in Copilot ACP worker pool (`engine.ccUseWorkerPool: true`, default ON for Copilot CC) is a **separate protocol path** from the table above — `engine/cc-worker-pool.js`'s `session/prompt` call only ever sends a single text content block (`[{ type: 'text', text: prompt }]`) and has no image/attachment content-block support today. This used to mean image turns were silently dropped whenever the pool was active, with a comment incorrectly blaming a Copilot capability gap (`imageInput:false`) that doesn't exist — Copilot's `imageInput` is `true` and fully supports images on the direct spawn path. The fix: `_invokeCcStream` (dashboard.js) now checks for a non-empty `images` array **before** routing through `resolveCcUseWorkerPool` — image-bearing turns bypass the warm pool for that turn only and cold-spawn a one-off CLI process via the working `--attachment` path (same as the non-pooled path always used), while image-less turns keep using the fast warm pool. If `engine/cc-worker-pool.js`'s ACP session protocol is later extended to carry attachments (Option A), this per-turn bypass in `_invokeCcStream` should be revisited/removed.
 
+Because that bypass can spend tens of seconds starting a one-off process before the first model token, the SSE stream shows a user-focused “Looking at the image…” status instead of exposing the cold-start implementation detail or leaving an apparently stalled spinner.
+
 `_resolveImageOpts` (in `engine/llm.js`) is pure and unit-tested: it forwards the `images` list only when `runtime.capabilities.imageInput` is truthy, otherwise returns the typed error so CC/doc-chat surface the envelope instead of a silently-text-only reply. `_spawnProcess` re-applies the same gate (`if (!caps.imageInput) adapterOpts.images = undefined`) as defense in depth. Image **filenames** are run through the untrusted-input fence (`buildSource('cc-image-filename', …)`) before they reach prompt text, since they are user-supplied.
 
 **No new `engine.*` flag.** The limits above are module-level constants in `dashboard.js` (`CC_IMAGE_MAX_COUNT`, `CC_IMAGE_MAX_DECODED_BYTES`, `CC_IMAGE_MIME_ALLOWLIST`), not config keys; `engine/shared.js` `ENGINE_DEFAULTS` was not touched. Per CLAUDE.md Best Practice #9 (Settings parity), no Settings toggle is added because no new `engine.*` flag was introduced. Runtime selection that determines whether images are accepted is the existing `engine.ccCli` / `ccModel` override, which already has a Settings control.

package/engine/lifecycle.js

@@ -1378,7 +1378,20 @@ async function enrollPrFromCanonicalId(canonicalPrId, project, opts = {}) {
     // pr-links stays consistent (#779 pattern).
     if (opts.itemId && Array.isArray(existing.prdItems) && !existing.prdItems.includes(opts.itemId)) {
       try {
-        const targetPath = project ? shared.projectPrPath(project) : path.join(MINIONS_DIR, 'pull-requests.json');
+        // W-mrduef3q000m2172 — derive targetPath from the scope the store
+        // actually returned `existing` under (existing._scope), NOT from the
+        // current call's `project` argument. When the two differ (e.g. the
+        // record lives under 'central' but this enrollment call was made
+        // with a specific project), re-deriving from `project` sends the
+        // upsert to the WRONG scope's file/array. upsertPullRequestRecord's
+        // tombstone guard then finds no matching record in that (wrong)
+        // scope and falls through to insert-as-new, silently clearing any
+        // userDeleted tombstone on the real record. See issue writeup for
+        // the confirmed repro.
+        const store = require('./pull-requests-store');
+        const targetPath = existing._scope
+          ? store._filePathForScope(existing._scope)
+          : (project ? shared.projectPrPath(project) : path.join(MINIONS_DIR, 'pull-requests.json'));
         shared.upsertPullRequestRecord(targetPath, {
           id: normalizedCanonicalId,
           prNumber,
@@ -6861,6 +6874,15 @@ function collapseAllDuplicatePrRecords(config) {
 // a coding WI (not one of the validation types itself). Skips if the coding WI
 // has no PR.
 //
+// W-mrdq22j700056c6c — gated to real code-authoring completions only. Only
+// item.type in {implement, implement:large, fix} ever spawns a follow-up
+// validation WI. Every other work-item type (review, test, verify, setup,
+// explore, ask, docs, decompose, ...) is excluded even when it resolves a PR
+// ref and autoDispatch is on, because those completions don't author a code
+// diff worth re-validating — e.g. a `review` dispatch that merely comments on
+// someone else's PR previously spawned a spurious "Validate: Review opg PR
+// #792 ..." follow-up. See the ELIGIBLE_TYPES check below.
+//
 // Files exactly ONE validation WI per coding-WI completion (W-mrhybval0001).
 // `liveValidation.type` still governs CHECKOUT ROUTING — the set of work-item
 // types that run in-place on the live checkout (see resolveCheckoutMode's
@@ -6880,6 +6902,10 @@ function collapseAllDuplicatePrRecords(config) {
 // own type is excluded so a validation-type WI can't recursively validate
 // itself (anti-loop).
 //
+// Only these item.type values ever trigger this hook (see ELIGIBLE_TYPES
+// below) — real code-authoring completions, not review/test/verify/setup/
+// explore/ask/docs/decompose completions.
+//
 // Deduplicates per codingWiId: any non-terminal WI with
 // meta.liveValidationFor === codingWiId blocks a second dispatch, so only one
 // validation task is ever in flight per coding completion.
@@ -6894,6 +6920,14 @@ function collapseAllDuplicatePrRecords(config) {
 // Validate: ..."), repeating indefinitely. Any WI that was itself created
 // as a liveValidation follow-up (tagged via meta.liveValidationFor at
 // creation, below) must never re-trigger this hook, regardless of its type.
+//
+// W-mrdq22j700056c6c — only real code-authoring work-item types ever spawn a
+// live-validation follow-up. Every other completed type (review, test,
+// verify, setup, explore, ask, docs, decompose, ...) is excluded even when it
+// resolves a PR ref, because those completions don't author a code diff
+// worth re-validating.
+const ELIGIBLE_LIVE_VALIDATION_TYPES = new Set([WORK_TYPE.IMPLEMENT, WORK_TYPE.IMPLEMENT_LARGE, WORK_TYPE.FIX]);
+
 function autoDispatchLiveValidationWi(meta, config) {
   const item = meta?.item;
   if (!item?.id || !item?.type) return;
@@ -6903,6 +6937,12 @@ function autoDispatchLiveValidationWi(meta, config) {
   // "Validate: Validate: ..." cascade (W-mr9u39az000db5c2 / issue #708).
   if (item.meta && item.meta.liveValidationFor) return;
 
+  // W-mrdq22j700056c6c — only implement/implement:large/fix completions ever
+  // author a real code diff worth validating. Review, test, verify, setup,
+  // explore, ask, docs, decompose, etc. completions must never spawn a
+  // "Validate: ..." follow-up, even when they resolve a PR reference.
+  if (!ELIGIBLE_LIVE_VALIDATION_TYPES.has(item.type)) return;
+
   // Issue #716 — QA Session infrastructure WIs (SETUP/DRAFT/EXECUTE, tagged
   // via meta.sessionId and always dispatched with skipPr:true) never own a
   // real code diff, so there is nothing for a live-validation WI to validate.

package/engine/playbook.js

@@ -1060,12 +1060,12 @@ function renderPlaybook(type, vars) {
 // ─── Playbook Section Validator ──────────────────────────────────────────────
 
 // Required structural section patterns — warn (do not throw) when absent.
-// Only '## Your Task' is checked: it's the one section every playbook template
-// actually implements. '## Tools' / '## Constraints' were removed (#775) —
-// no template in playbooks/ defines those headers, so the checks always
-// failed and produced 100%-failure-rate warn-level noise in engine/log.json.
+// Playbooks use a few established names for the task-bearing section; accept
+// all of them rather than generating warn-level noise for valid templates.
+// '## Tools' / '## Constraints' were removed (#775) because no template
+// consistently implements those headers.
 const _REQUIRED_PROMPT_SECTIONS = [
-  { pattern: /^## Your Task\b/m,   label: '## Your Task' },
+  { pattern: /^## (?:Your Task|Task Description|Mission)\b/m, label: 'task section' },
 ];
 
 /**

package/engine/process-utils.js

@@ -566,9 +566,9 @@ function findProcessCwdHolders(worktreePath, opts = {}) {
   return _parseCwdHolderLines(raw, resolved);
 }
 
-// Cross-check a single PID's command line for a Minions agent invocation
-// (`claude` or `copilot`, including the `node spawn-agent.js --runtime <name>`
-// wrapper and `gh copilot` fallback). Used by orphan/recycled-PID safety:
+// Cross-check a single PID's command line for a Minions agent invocation,
+// including the shared spawn wrapper and every bundled runtime CLI. Used by
+// orphan/recycled-PID safety:
 //   - engine/cleanup.js: gate before killing a PID found in engine/tmp/pid-*.pid
 //   - engine/timeout.js: gate before parking a dispatch as still-alive when
 //     the OS PID is alive but may belong to an unrelated recycled-PID process
@@ -578,9 +578,20 @@ function findProcessCwdHolders(worktreePath, opts = {}) {
 // macOS / when /proc isn't available: fallback `ps -p <pid> -o command=`.
 //
 // Returns false when the PID is invalid, the process doesn't exist, the
-// command line can't be read, or the cmdline contains neither `claude` nor
-// `copilot`. False is the safe default for both call sites: cleanup falls
+// command line can't be read, or the cmdline contains no recognized agent
+// marker. False is the safe default for both call sites: cleanup falls
 // through to "skip kill" and timeout falls through to "treat PID as dead".
+const AGENT_COMMAND_PATTERNS = [
+  /(?:^|[\s"'\\/])(?:claude|copilot|codex)(?:\.exe|\.cmd|\.bat|\.js)?(?=$|[\s"])/i,
+  /[\\/]claude-code[\\/]cli\.js(?=$|[\s"])/i,
+  /[\\/]@github[\\/](?:copilot|copilot-cli)[\\/](?:(?:dist|bin)[\\/])?index\.js(?=$|[\s"])/i,
+];
+
+function _commandLineMatchesAgent(cmdline) {
+  const value = String(cmdline || '');
+  return AGENT_COMMAND_PATTERNS.some(pattern => pattern.test(value));
+}
+
 function isProcessCommandLineMatchingAgent(pid) {
   const n = Number(pid);
   if (!Number.isInteger(n) || n <= 0) return false;
@@ -605,8 +616,7 @@ function isProcessCommandLineMatchingAgent(pid) {
     }
   } catch { return false; }
   if (!cmdline) return false;
-  const lower = cmdline.toLowerCase();
-  return lower.includes('claude') || lower.includes('copilot');
+  return _commandLineMatchesAgent(cmdline);
 }
 
 function _buildChildMap(processes) {
@@ -693,6 +703,7 @@ module.exports = {
   _parseCwdHolderLines,
   findProcessCwdHolders,
   isProcessCommandLineMatchingAgent,
+  _commandLineMatchesAgent, // exported for testing
   _buildChildMap,
   listProcessDescendants,
   listProcessReachable,

package/engine/queries.js

@@ -995,12 +995,25 @@ function getPullRequests(config) {
   // Then merge non-conflicting fields from the loser into the winner so we
   // never lose prdItems, sourcePlan, itemType, minionsReview, or
   // _automationFixCauses if only the loser carried them.
+  // Issue #803 — defense in depth: if a canonical PR id has a tombstoned
+  // (userDeleted:true) copy in ANY scope, treat the whole id as deleted, not
+  // just that one record. Without this, a delete that (for whatever reason)
+  // only tombstones one scope's copy would still have its untouched
+  // cross-scope duplicate survive grouping below and get picked as the
+  // dedupe "winner", silently resurrecting a PR the user just deleted.
+  const tombstonedIds = new Set();
+  for (const pr of sqlPrs) {
+    if (pr && pr.id && pr.userDeleted === true) tombstonedIds.add(pr.id);
+  }
+
   const groups = [];
   const groupsById = new Map();
   for (const pr of sqlPrs) {
     if (!pr || !pr.id) continue;
-    // Issue #384: skip tombstoned records (user explicitly deleted)
+    // Issue #384/#803: skip tombstoned records (user explicitly deleted), and
+    // skip ANY record sharing an id that has a tombstoned copy elsewhere.
     if (pr.userDeleted === true) continue;
+    if (tombstonedIds.has(pr.id)) continue;
     if (!groupsById.has(pr.id)) {
       const g = [];
       groupsById.set(pr.id, g);
@@ -3270,10 +3283,6 @@ function getStatusFastStateMtimePaths(config) {
  *     Claude CLI mutations (mcp add/remove, settings edits), not on every
  *     prompt, so whole-file tracking is acceptable.
  *
- * Files intentionally NOT tracked here:
- *   - version, autoMode, installId — change only on human/CLI edits, which
- *     already pop the slow-state via reloadConfig + the 60 s TTL.
- *
  * Per-project `.git/logs/HEAD` + `.git/FETCH_HEAD` ARE tracked here in
  * addition to the fast-state tracker. The project payload (`projects:`
  * with ahead/behind counts) lives in the slow-state slice, and
@@ -3314,6 +3323,14 @@ function getStatusSlowStateMtimePaths(config) {
   // in the payload anymore.
   const files = [];
 
+  // Config-derived status fields (projects, autoMode, version settings) can be
+  // changed by the CLI or another process without calling dashboard-local
+  // invalidateStatusCache(). The unified cache has no TTL fallback, so these
+  // source files must participate in the mtime registry.
+  files.push(CONFIG_PATH);
+  files.push(path.join(MINIONS_DIR, '.install-id'));
+  files.push(path.join(MINIONS_DIR, 'package.json'));
+
   // Skill discovery roots (surfaced by _buildStatusSlowState → getSkills).
   // Mirrors collectSkillFiles' source enumeration so adding a new runtime
   // adapter automatically extends the tracker. ENOENT is tolerated by

package/engine/shared.js

@@ -7882,7 +7882,17 @@ function upsertPullRequestRecord(prPath, entry, { project = null, itemId = null,
     ...(Array.isArray(itemIds) ? itemIds : [itemId]),
   ]);
   const prNumber = getPrNumber(entry.prNumber ?? entry.id ?? entry.url);
-  const canonicalId = getCanonicalPrId(project, entry.prNumber ?? entry.id ?? entry.url ?? prNumber, entry.url || '');
+  // Issue #802: when the caller already resolved a scope-qualified canonical
+  // id (e.g. `ado:office/office/office#5370216`, as enrollPrFromCanonicalId
+  // does before calling here), it must win over recomputing from a bare
+  // entry.prNumber + project. Recomputing silently downgrades to a legacy
+  // `PR-<n>` stub whenever project is null/unresolvable (getCanonicalPrId
+  // can't derive a scope), discarding the good id even though it was passed
+  // in. Prefer entry.id whenever it already parses as canonical.
+  const hasCanonicalEntryId = typeof entry.id === 'string' && parseCanonicalPrId(entry.id) != null;
+  const canonicalId = hasCanonicalEntryId
+    ? getCanonicalPrId(project, entry.id, entry.url || '')
+    : getCanonicalPrId(project, entry.prNumber ?? entry.id ?? entry.url ?? prNumber, entry.url || '');
   if (!canonicalId) throw new Error('PR id required');
   const normalizedEntry = {
     ...entry,
@@ -7930,6 +7940,23 @@ function upsertPullRequestRecord(prPath, entry, { project = null, itemId = null,
       delete target.userDeletedAt;
       resurrected = true;
     }
+    // W-mrduef3q000m2172 — defense-in-depth: `prs` here is scoped to a single
+    // scope's array (mutatePullRequests routes by prPath). If a caller
+    // resolved the wrong scope for an already-tombstoned canonical id (the
+    // record actually lives in a DIFFERENT scope's file), the above check
+    // never sees it and would otherwise fall through to insert-as-new,
+    // silently clearing the tombstone. Check globally before inserting.
+    if (!target) {
+      try {
+        const store = require('./pull-requests-store');
+        const globalMatch = (store.readAllPullRequests() || [])
+          .find(pr => pr && pr.id === canonicalId && pr.userDeleted === true);
+        if (globalMatch) {
+          skipped = true;
+          return prs;
+        }
+      } catch { /* best-effort global tombstone check — fall through on failure */ }
+    }
     // P-e9f0a2b4 — When findPrRecord returns null but multiple records share the
     // same prNumber (e.g. cross-scope contamination or a project-config change
     // that shifted canonical IDs), collapse the duplicates before inserting.

package/engine/worktree-gc.js

@@ -769,9 +769,9 @@ function pruneOrphanWorktrees(opts) {
   const globalLiveDirNames = new Set();
   for (const d of [...(dispatchSnap.active || []), ...(dispatchSnap.pending || [])]) {
     if (!d || !d.id || !d.meta || !d.meta.branch) continue;
-    const dispatchProject = (d.meta.project && typeof d.meta.project === 'string')
+    const dispatchProject = typeof d.meta.project === 'string'
       ? d.meta.project
-      : 'default';
+      : (d.meta.project?.name || 'default');
     try {
       globalLiveDirNames.add(_buildWorktreeDirName({
         dispatchId: d.id,

package/engine.js

@@ -28,13 +28,14 @@ require('./engine/stdio-timestamps').installIfNotInstalled();
 
 const fs = require('fs');
 const path = require('path');
+const os = require('os');
 const crypto = require('crypto');
 const shared = require('./engine/shared');
 const { exec, execAsync, execSilent, runFile, ts, ENGINE_DEFAULTS,
   WI_STATUS, DONE_STATUSES, WORK_TYPE, PLAN_STATUS, PRD_ITEM_STATUS, PRD_MATERIALIZABLE, PR_STATUS, REVIEW_STATUS, DISPATCH_RESULT, AGENT_STATUS,
   FAILURE_CLASS, resolvePollFlag } = shared;
 const { resolveRuntime } = require('./engine/runtimes');
-const { assertStaleHeadOk } = require('./engine/spawn-agent');
+const { assertStaleHeadOk, preApproveWorkspaceMcps, computeAddDirs } = require('./engine/spawn-agent');
 const adoGitAuth = require('./engine/ado-git-auth');
 const queries = require('./engine/queries');
 const dispatchEvents = require('./engine/dispatch-events');
@@ -10140,7 +10141,9 @@ async function discoverWork(config) {
             const activeMissionIds = new Set();
             const activeScheduleIds = new Set();
             for (const existing of items) {
-              if (existing.status === WI_STATUS.DONE || existing.status === WI_STATUS.FAILED) continue;
+              if (DONE_STATUSES.has(existing.status) ||
+                  existing.status === WI_STATUS.FAILED ||
+                  existing.status === WI_STATUS.CANCELLED) continue;
               if (existing._missionId) activeMissionIds.add(existing._missionId);
               if (existing._scheduleId) activeScheduleIds.add(existing._scheduleId);
             }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yemi33/minions",
-  "version": "0.1.2362",
+  "version": "0.1.2364",
   "description": "Multi-agent AI dev team that runs from ~/.minions/ — five autonomous agents share a single engine, dashboard, and knowledge base",
   "bin": {
     "minions": "bin/minions.js"