@yemi33/minions 0.1.2372 → 0.1.2373

package/engine/timeout.js

@@ -234,6 +234,31 @@ function checkDeferredStranded(activeProcesses, config) {
   }
 }
 
+// P-6e2a4c15 — cancel-vs-kill for pooled dispatches. A pooled dispatch's
+// `activeProcesses` record (`info`) carries `_pooled: true` (stamped by
+// engine.js#spawnAgent, P-1d8f0b93) and its `.proc` is a PooledAgentProcess
+// facade whose `.pid` is the SHARED, long-lived ACP worker's real OS pid —
+// not a per-dispatch child process. Every OS-level kill helper in this file
+// (`shared.killGracefully`, `shared.killImmediate`, `_escalatePlatformKill`)
+// ultimately runs `taskkill /F /T /PID <pid>` or SIGKILLs that pid's whole
+// process tree. Doing that to a pooled dispatch would kill the shared worker
+// out from under every OTHER dispatch waiting to reuse it from the pool —
+// exactly the collateral-damage risk `PooledAgentProcess#kill()` (P-1d8f0b93)
+// was built to avoid: it cancels the in-flight ACP turn and releases the
+// worker back to the pool without touching the OS process. Route every kill
+// request here through this helper so no call site can accidentally bypass
+// that primitive for a pooled record.
+function killTrackedProcess(info, { graceMs } = {}) {
+  if (!info || !info.proc) return;
+  if (info._pooled && typeof info.proc.kill === 'function') {
+    try { info.proc.kill(); }
+    catch (err) { try { log('warn', `Pooled dispatch cancel failed for ${info.agentId || '?'}: ${err.message}`); } catch {} }
+    return;
+  }
+  if (graceMs == null) shared.killImmediate(info.proc);
+  else shared.killGracefully(info.proc, graceMs);
+}
+
 // W-mq066js7000fff1f-c (Gap C): runs the kill-retry escalation ladder for an
 // already-steered process whose `_steeringAt` is set but which hasn't exited.
 // Caller is `checkSteering` per-tick loop; `info` is the `activeProcesses`
@@ -253,7 +278,7 @@ function _runSteeringKillLadder(id, info, config) {
   if (attempts < cap) {
     if (attempts === 0) {
       log('warn', `Steering: ${info.agentId} (${id}) didn't exit ${Math.round(wait / 1000)}s after kill — retrying gracefully`);
-      try { shared.killGracefully(info.proc, 5000); }
+      try { killTrackedProcess(info, { graceMs: 5000 }); }
       catch (err) { try { log('warn', `Steering kill retry (graceful) failed for ${info.agentId}: ${err.message}`); } catch {} }
     } else {
       log('warn', `Steering: ${info.agentId} (${id}) survived attempt ${attempts} — escalating (attempt ${attempts + 1}/${cap})`);
@@ -287,6 +312,13 @@ function _runSteeringKillLadder(id, info, config) {
 }
 
 function _escalatePlatformKill(info) {
+  // Pooled dispatches never reach the OS-level escalation path — cancel the
+  // ACP turn and release the worker instead of taskkill/SIGKILLing the
+  // shared worker process. See killTrackedProcess's comment above.
+  if (info?._pooled && info.proc && typeof info.proc.kill === 'function') {
+    try { info.proc.kill(); } catch { /* best-effort */ }
+    return;
+  }
   const pid = info?.proc?.pid;
   if (!pid) return;
   if (process.platform === 'win32') {
@@ -418,7 +450,7 @@ function checkSteering(config) {
         fs.appendFileSync(liveLogPath, `\n[steering] Message received but no session to resume. Killing agent — your message will be delivered on retry.\n`);
       } catch { /* optional */ }
 
-      shared.killImmediate(info.proc);
+      killTrackedProcess(info);
       info._steeringAt = Date.now();
       info._steeringNoSession = true;
       continue;
@@ -442,7 +474,7 @@ function checkSteering(config) {
       } catch { /* best-effort */ }
     }
 
-    shared.killImmediate(info.proc);
+    killTrackedProcess(info);
   }
 }
 
@@ -619,7 +651,7 @@ function checkTimeouts(config) {
     if (elapsed > itemTimeout) {
       log('warn', `Agent ${info.agentId} (${id}) hit hard timeout after ${Math.round(elapsed / 1000)}s — killing`);
       dispatch().updateAgentStatus(id, AGENT_STATUS.TIMED_OUT, `Hard timeout after ${Math.round(elapsed / 1000)}s`);
-      shared.killGracefully(info.proc, 5000);
+      killTrackedProcess(info, { graceMs: 5000 });
     }
   }
 
@@ -700,7 +732,7 @@ function checkTimeouts(config) {
     runPostCompletionHooks(item, item.agent, processExitCode, fullLogForHooks, config, { detectPhantom: true, expectedNonce, completionNonceRequired }).catch(e => log('warn', 'post-completion hooks: ' + e.message));
 
     if (hasProcess) {
-      shared.killImmediate(activeProcesses.get(item.id)?.proc);
+      killTrackedProcess(activeProcesses.get(item.id));
       activeProcesses.delete(item.id);
     }
   }
@@ -815,7 +847,7 @@ function checkTimeouts(config) {
           // Clear the cached session so retry does not re-enter the same stuck --resume path.
           try { shared.safeUnlink(path.join(AGENTS_DIR, item.agent, 'session.json')); } catch {}
           activeProcesses.delete(item.id);
-          shared.killGracefully(procInfo.proc, 5000);
+          killTrackedProcess(procInfo, { graceMs: 5000 });
           deadItems.push({ item, reason, failureClass: FAILURE_CLASS.TIMEOUT });
         }
       }
@@ -867,7 +899,18 @@ function checkTimeouts(config) {
 
     if (!processAlive && (canReapDeadProcess || silentMs > staleOrphanTimeout) && (Date.now() > engineRestartGraceUntil || canReapDeadProcess)) {
       // Last-resort PID check: lost tracked handle but OS process may still be alive.
-      if (isOsPidAliveForDispatch(item.id)) {
+      // P-3f5b7d26 — SKIPPED for pooled dispatches (item.pooled, persisted by
+      // engine.js#spawnAgent). The PID recorded for a pooled dispatch is the
+      // shared ACP worker's real OS pid (engine/acp-transport.js#spawnAcp),
+      // whose command line is literally `copilot --acp ...` — it would always
+      // pass isProcessCommandLineMatchingAgent's `cmdline.includes('copilot')`
+      // check below even though that worker has no relationship to THIS
+      // dispatch (a fresh engine's agent-worker-pool.js always cold-starts
+      // empty; the pool never reconnects a restart-era worker to any prior
+      // dispatch). Without this guard a coincidentally-still-alive (or
+      // PID-recycled) worker process would be misread as "still running",
+      // parking the dispatch forever instead of routing it to retry.
+      if (!item.pooled && isOsPidAliveForDispatch(item.id)) {
         // Cross-check the PID's command line: a recycled OS PID can be alive
         // under an unrelated process (Windows reuses PIDs aggressively). Without
         // this cmdline gate, the dispatch is parked indefinitely as 'active'
@@ -1018,4 +1061,5 @@ module.exports = {
   _resetSteeringStoreCacheForTest, _setSteeringStoreForTest,
   // exported for testing — steering clamp helpers and deferred checkpoint
   _clampSteeringDeferredMaxMs, _clampSteeringMaxKillRetries, _appendLiveOutputLine, deferSteeringUntilCheckpoint,
+  killTrackedProcess, _escalatePlatformKill, // exported for testing — P-6e2a4c15 cancel-vs-kill
 };

package/engine.js

@@ -36,6 +36,12 @@ const { exec, execAsync, execSilent, runFile, ts, ENGINE_DEFAULTS,
   FAILURE_CLASS, resolvePollFlag } = shared;
 const { resolveRuntime } = require('./engine/runtimes');
 const { assertStaleHeadOk, preApproveWorkspaceMcps } = require('./engine/spawn-agent');
+// P-1d8f0b93 — fleet ACP worker pool + its child_process-shaped facade.
+// NOTE: engine/agent-worker-pool.js is a DIFFERENT module from the
+// dashboard's single-tab CC pool (engine.js must never import that one —
+// see the cc-tab-pool wiring regression guard test).
+const agentWorkerPool = require('./engine/agent-worker-pool');
+const { PooledAgentProcess } = require('./engine/pooled-agent-process');
 const adoGitAuth = require('./engine/ado-git-auth');
 const queries = require('./engine/queries');
 const dispatchEvents = require('./engine/dispatch-events');
@@ -4458,6 +4464,18 @@ async function spawnAgent(dispatchItem, config) {
   const resolvedModel = runtime.resolveModel(shared.resolveAgentModel(agentConfig, engineConfig));
   const resolvedMaxBudget = shared.resolveAgentMaxBudget(agentConfig, engineConfig);
   const resolvedBare = shared.resolveAgentBareMode(agentConfig, engineConfig);
+  // P-1d8f0b93 — pool a copilot dispatch through the persistent ACP worker
+  // pool (engine/agent-worker-pool.js) instead of cold-spawning a fresh CLI
+  // process, when the capability + config gate allows it. Structurally
+  // copilot-only (runtime.capabilities.acpWorkerPool) — see
+  // shared.resolveAgentUseWorkerPool for the exact precedence chain.
+  const useAgentPool = shared.resolveAgentUseWorkerPool(engineConfig, runtime);
+  if (useAgentPool) {
+    // Idempotent — cheap to call on every pooled dispatch so a live config
+    // change (agentAcpPoolSize / maxConcurrent) takes effect without a
+    // separate engine-restart-only wiring hook.
+    agentWorkerPool.setPoolSize(shared.resolveAgentAcpPoolSize(engineConfig));
+  }
 
   // W-mpg6isvy000xca4d — On retry after FAILURE_CLASS.MODEL_UNAVAILABLE, swap
   // to the runtime-appropriate fallback model. Two paths gated on
@@ -4582,7 +4600,14 @@ async function spawnAgent(dispatchItem, config) {
   childEnv.MINIONS_NO_AUTO_OPEN = '1';
   // MCP-free copilot config so agents never pop a per-spawn Microsoft auth
   // window — see _applyAgentCopilotHome / shared.resolveAgentCopilotHome.
-  _applyAgentCopilotHome(childEnv);
+  // P-1d8f0b93 — SKIPPED for pooled dispatches: the pooled ACP worker is a
+  // long-lived process shared across many dispatches, so it always uses the
+  // operator's REAL COPILOT_HOME (this is the isolation-removal half of the
+  // pooling feature — MCP-auth-popup risk becomes bounded by pool size
+  // instead of eliminated per-dispatch; documented tradeoff in the plan).
+  if (!useAgentPool) {
+    _applyAgentCopilotHome(childEnv);
+  }
   // Keep agent scratch off a (possibly full) system drive — anchors TEMP/TMP to
   // the worktree volume. See _applyAgentTempEnv / shared.resolveAgentTempBaseDir.
   _applyAgentTempEnv(childEnv, project);
@@ -4614,6 +4639,14 @@ async function spawnAgent(dispatchItem, config) {
   const spawnScript = path.join(ENGINE_DIR, 'spawn-agent.js');
 
   const spawnArgs = [spawnScript, promptPath, sysPromptPath, ...args];
+  // P-1d8f0b93 — the pooled-dispatch branch further down (agentWorkerPool
+  // acquireWorker) accepts an optional `hermeticDirs` (workspace-manifest
+  // `allowed_repos` beyond the primary cwd — see engine/agent-worker-pool.js
+  // header doc). Repository harness discovery (skills/commands/--add-dir) is
+  // now delegated entirely to the native runtime CLI (#817), so there is no
+  // longer an engine-computed add-dir set to reuse here; leave it empty and
+  // let agentWorkerPool's `_applyHermeticDirs` no-op as designed.
+  const addDirs = [];
 
   // Live output file — stamped BEFORE child process is spawned (#W-mo248lkjwgsu).
   // Writing the stub pre-spawn lets the orphan detector distinguish three failure modes
@@ -4687,12 +4720,43 @@ async function spawnAgent(dispatchItem, config) {
     // exactly — the agent's process already starts here, but cd-ing around or
     // sub-shells can drift, so the env var is the stable anchor.
     childEnv.MINIONS_AGENT_CWD = cwd;
-    proc = runFile(process.execPath, spawnArgs, {
-      cwd,
-      stdio: ['pipe', 'pipe', 'pipe'],
-      env: childEnv,
-      detached: true,
-    });
+    if (!useAgentPool) {
+      proc = runFile(process.execPath, spawnArgs, {
+        cwd,
+        stdio: ['pipe', 'pipe', 'pipe'],
+        env: childEnv,
+        detached: true,
+      });
+    } else {
+      // P-1d8f0b93 — pooled copilot dispatch. No separate spawn-agent.js
+      // child process exists, so build the SAME combined prompt text that
+      // process would have received via runtime.buildPrompt(...) directly
+      // here, and hand it to a PooledAgentProcess facade instead of
+      // cold-spawning. Everything downstream (stdout/stderr handlers,
+      // onAgentClose, live-output.log, PID-file writing below) treats `proc`
+      // identically to a real child_process either way.
+      const pooledPromptText = runtime.buildPrompt(fullTaskPrompt, systemPrompt, { sessionId: cachedSessionId });
+      proc = new PooledAgentProcess({
+        pool: agentWorkerPool,
+        dispatchId: id,
+        cwd,
+        model: effectiveModel,
+        effort: requestedEffort,
+        // Mirrors the CC worker pool's convention (dashboard.js) — a single
+        // flat top-level config array, not per-agent-resolved.
+        mcpServers: (engineConfig && engineConfig.mcpServers) || [],
+        hermeticDirs: addDirs,
+        promptText: pooledPromptText,
+      });
+      // The child_process PID file is normally written asynchronously by
+      // spawn-agent.js itself (engine/spawn-agent.js:606) once it starts.
+      // There is no such child process here, so the engine writes the
+      // equivalent file itself as soon as the pool hands back a real OS PID
+      // (mirrors that write: async, best-effort, same `String(pid)` shape).
+      proc.on('acquired', () => {
+        try { fs.writeFile(pidFilePath, String(proc.pid || ''), () => {}); } catch { /* best-effort */ }
+      });
+    }
     _phaseT.spawnCallEnd = Date.now();
 
     // Seed realActivityMap and stamp PID immediately — BEFORE any handlers (#W-mo25loq8kjer).
@@ -4720,6 +4784,11 @@ async function spawnAgent(dispatchItem, config) {
         _runtimeResumeAwaitingFirstOutput: true,
       } : {}),
       _pendingSteeringFiles: pendingSteering.entries,
+      // P-1d8f0b93 — marks a pooled dispatch so engine/timeout.js's
+      // cancel-vs-kill wiring (P-6e2a4c15, killTrackedProcess /
+      // _escalatePlatformKill) can route `.kill()` to cancel+release the
+      // ACP worker instead of SIGKILL/taskkill on the shared worker's OS pid.
+      ...(useAgentPool ? { _pooled: true } : {}),
     };
     activeProcesses.set(id, initialProcInfo);
     registeredInActiveProcesses = true;
@@ -6008,6 +6077,11 @@ async function spawnAgent(dispatchItem, config) {
     // route output parsing through the right adapter. Also surfaces the choice
     // in dispatch.json for debugging multi-runtime fleets.
     item.runtimeName = runtimeName;
+    // P-3f5b7d26 — persist pooled on the DISK record (activeProcesses/_pooled
+    // is wiped on restart); cli.js's reattach path needs this since a pooled
+    // ACP worker isn't spawned detached and a fresh pool cold-starts empty —
+    // a live worker PID must never be mistaken for a resumable dispatch.
+    if (useAgentPool) item.pooled = true;
     // W-mq5rwwss000f30a7 — persist the worktree path so the live-worktree
     // guard (shared.isWorktreePathLive) can correlate destructive callers
     // (removeWorktree, cleanup orphan-dir sweep, pool-return, quarantine)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yemi33/minions",
-  "version": "0.1.2372",
+  "version": "0.1.2373",
   "description": "Multi-agent AI dev team that runs from ~/.minions/ — five autonomous agents share a single engine, dashboard, and knowledge base",
   "bin": {
     "minions": "bin/minions.js"