@yemi33/minions 0.1.2374 → 0.1.2376

package/dashboard/js/settings.js

@@ -446,6 +446,7 @@ async function openSettings() {
     '<div class="settings-pane-sub">Persistent CC worker pool and git worktree provisioning. Tune these only if you see worktree-create timeouts or slow CC cold-spawns.</div>' +
     '<div class="settings-stack" style="margin-bottom:12px">' +
       settingsToggle('CC Worker Pool', 'set-ccUseWorkerPool', (e.ccUseWorkerPool === undefined ? ((e.ccCli || e.defaultCli) === 'copilot') : !!e.ccUseWorkerPool), 'Route Command Center / doc-chat through a persistent copilot --acp worker per tab instead of spawning a fresh CLI per turn. Copilot-only (Agent Client Protocol transport); Claude does not implement ACP, so this toggle has no effect when CC runtime is Claude. Default ON for copilot (cold-spawn ~20s on Windows); forced OFF for non-copilot CC runtimes regardless of this toggle.') +
+      settingsToggle('Agent Worker Pool', 'set-agentUseWorkerPool', e.agentUseWorkerPool !== false, 'Route fleet Copilot dispatches through persistent copilot --acp workers. Default ON; runtimes without ACP support ignore this setting.') +
       // W-mq6f2fe0000557fa — opt-in: auto-kill orphan spawn-agent processes
       // holding a stuck worktree's cwd. Gated by safe-reap criteria (cmdline
       // matches spawn-agent.js + basename + age > agentTimeout * 2). Default
@@ -484,12 +485,6 @@ async function openSettings() {
         '</select>' +
       '</div>' +
       settingsField('Copilot fallback model', 'set-copilotFallbackModel', e.copilotFallbackModel || '', 'e.g. gpt-5.4', 'Copilot has no --fallback-model flag. On a MODEL_UNAVAILABLE (overloaded/503) retry, the engine OVERRIDES --model with this value (Copilot only).') +
-      '</div>' +
-      '<div class="settings-stack" style="margin-top:12px">' +
-        settingsField('Copilot: disable agent MCP servers', 'set-copilotAgentDisabledMcpServers',
-          Array.isArray(e.copilotAgentDisabledMcpServers) ? e.copilotAgentDisabledMcpServers.join(', ') : (e.copilotAgentDisabledMcpServers || ''),
-          'e.g. playwright, maestro, loop',
-          'Comma-separated MCP server names (from ~/.copilot/mcp-config.json) the engine disables for autonomous Copilot agent dispatches by filtering them out of the agent-only COPILOT_HOME. Copilot loads your user MCP config on every spawn regardless of --add-dir; list the noisy/auth-popping servers (e.g. playwright, maestro) to keep them out of agents. Empty = inherit all.') +
       '</div>';
 
   const paneClaude =
@@ -588,7 +583,7 @@ async function openSettings() {
     '</div>' +
     '<h4>Agent Memory</h4>' +
     '<div class="settings-stack">' +
-      settingsToggle('Shadow mode', 'set-memoryRetrievalShadowMode', e.memoryRetrievalShadowMode !== false, 'Measure retrieval without changing prompts') +
+      settingsToggle('Shadow mode', 'set-memoryRetrievalShadowMode', !!e.memoryRetrievalShadowMode, 'Measure retrieval without changing prompts') +
       settingsToggle('Capture task episodes', 'set-memoryEpisodicCapture', !!e.memoryEpisodicCapture, 'Store compact outcomes, never transcripts') +
     '</div>' +
     '<div class="settings-grid-2">' +
@@ -1128,6 +1123,7 @@ async function saveSettings() {
       autoFixHumanComments: document.getElementById('set-autoFixHumanComments').checked,
       autoCompletePrs: document.getElementById('set-autoCompletePrs').checked,
       ccUseWorkerPool: !!document.getElementById('set-ccUseWorkerPool')?.checked,
+      agentUseWorkerPool: !!document.getElementById('set-agentUseWorkerPool')?.checked,
       autoReapOrphanWorktreeHolders: !!document.getElementById('set-autoReapOrphanWorktreeHolders')?.checked,
       liveCheckoutAutoStash: !!document.getElementById('set-liveCheckoutAutoStash')?.checked,
       liveCheckoutAutoReset: !!document.getElementById('set-liveCheckoutAutoReset')?.checked,
@@ -1188,7 +1184,6 @@ async function saveSettings() {
       claudeBareMode: !!document.getElementById('set-claudeBareMode')?.checked,
       claudeFallbackModel: (document.getElementById('set-claudeFallbackModel')?.value ?? '').trim(),
       copilotFallbackModel: (document.getElementById('set-copilotFallbackModel')?.value ?? '').trim(),
-      copilotAgentDisabledMcpServers: (document.getElementById('set-copilotAgentDisabledMcpServers')?.value ?? '').trim(),
       copilotDisableBuiltinMcps: !!document.getElementById('set-copilotDisableBuiltinMcps')?.checked,
       copilotStreamMode: document.getElementById('set-copilotStreamMode')?.value || 'on',
       copilotReasoningSummaries: !!document.getElementById('set-copilotReasoningSummaries')?.checked,

package/dashboard.js

@@ -11374,17 +11374,6 @@ What would you like to discuss or change? When you're happy, say "approve" and I
           else if (valid.includes(e.copilotStreamMode)) _setEngineConfig('copilotStreamMode', e.copilotStreamMode);
           else _clamped.push(`copilotStreamMode: "${e.copilotStreamMode}" not in [on, off] (kept previous value)`);
         }
-        // P-mcp-storm — MCP server names to disable for autonomous Copilot agents
-        // (--disable-mcp-server). Accept an array OR a comma/whitespace string;
-        // normalize to a deduped array of trimmed names. Empty clears (inherit all).
-        if (e.copilotAgentDisabledMcpServers !== undefined) {
-          const src = Array.isArray(e.copilotAgentDisabledMcpServers)
-            ? e.copilotAgentDisabledMcpServers
-            : String(e.copilotAgentDisabledMcpServers || '').split(/[\s,]+/);
-          const names = [...new Set(src.map(s => String(s == null ? '' : s).trim()).filter(Boolean))];
-          if (names.length) _setEngineConfig('copilotAgentDisabledMcpServers', names);
-          else _deleteEngineConfig('copilotAgentDisabledMcpServers');
-        }
         // W-mpmwxkrw000872ec — fontSize allowlist. Clamps invalid values
         // (rather than silently failing) so the dashboard bootstrap never
         // ends up with an unknown data-font-size attribute.
@@ -15099,18 +15088,6 @@ if (require.main === module) {
   // engine reads, port binding) is captured rather than dying silently.
   _installCrashHandlers();
 
-  // Deliberately do NOT set process.env.COPILOT_HOME here. Command Center,
-  // doc-chat, and the CC worker pool (`copilot --acp`) all spawn `copilot`
-  // as this process's children, so they should inherit the operator's real
-  // `~/.copilot` home (including their model preference in settings.json)
-  // exactly like an interactive `copilot` CLI session would — that's the
-  // documented CLI contract. An earlier revision forced these onto an
-  // isolated, MCP-filtered home to dodge MCP-server auth popups, but that
-  // broke CC's settings inheritance and reintroduced a staleness/reseed bug;
-  // reverted (W-mre75l6x00024f49). Per-dispatch agent isolation is unaffected
-  // — the engine process still seeds its own COPILOT_HOME at boot and
-  // re-stamps it per spawn via `_applyAgentCopilotHome` (engine.js).
-
   // Kick off first npm check on startup, then re-check every 4 hours.
   // Guarded here so that requiring dashboard as a module (unit tests, _withDashServer)
   // does not spawn npm child processes that keep the event loop alive past test teardown

package/docs/pr-review-fix-loop.md

@@ -11,6 +11,7 @@ How the engine manages the lifecycle of a PR from creation through review, fix,
 
 - `discoverFromPrs()` (engine.js) runs each tick (~10s)
 - Gates: `status === 'active'` + `reviewStatus === 'pending'` + not reviewed since last push + not dispatched + not on cooldown
+  - "Not reviewed since last push" is `!isPrReviewCurrent(pr)` — compares `pr.reviewedHeadSha` (the SHA the completed review verdict actually evaluated) against the live head, falling back to the legacy `lastPushedAt <= lastReviewedAt` timestamp comparison for PR records that predate `reviewedHeadSha`. The SHA-based check replaces a pure timestamp comparison, which could false-positive as "already reviewed" when a commit landed mid-review (`lastReviewedAt` is stamped at completion, i.e. *after* the mid-review push) — root cause of github:opg-microsoft/minions#821. Re-review (`reviewStatus === 'waiting'`) uses the mirrored `isPrFixedAfterReview(pr)` gate for the same reason. Both dispatch sites capture `reviewHeadSha: getPrCauseHead(pr)` into dispatch `meta` so the eventual verdict can stamp the exact SHA it evaluated.
 - Pre-dispatch: `checkLiveReviewStatus()` hits GitHub/ADO API to catch stale cached status
 - Routes to reviewer via `resolveAgent('review')`, dispatches with `review.md` playbook
 
@@ -144,8 +145,9 @@ A "branch unchanged" no-op report for a `BUILD_FAILURE`-cause fix used to be con
 | `buildErrorLog` | Poller | Actual CI error output for fix agents |
 | `_buildFixPushedAt` | Discovery (on dispatch) | Grace period timestamp |
 | `_buildFailNotified` | Discovery | Dedup for inbox alert |
-| `lastPushedAt` | Poller (new commit) | Tracks latest push for re-review logic |
-| `lastReviewedAt` | `updatePrAfterReview()` | Prevents re-dispatch if reviewed |
+| `lastPushedAt` | Poller (new commit) | Tracks latest push for re-review logic (legacy fallback signal) |
+| `lastReviewedAt` | `updatePrAfterReview()` | Legacy fallback for freshness gating on PR records that predate `reviewedHeadSha` |
+| `reviewedHeadSha` | `updatePrAfterReview()` | SHA the completed review verdict actually evaluated (captured at dispatch time via `meta.reviewHeadSha`, or falls back to the live head for legacy in-flight dispatches); primary review-freshness signal (`isPrReviewCurrent`/`isPrFixedAfterReview`) |
 | `minionsReview` | Post-completion hooks | `{ reviewer, reviewedAt, note, fixedAt }` |
 | `humanFeedback` | `pollPrHumanComments()` | `{ pendingFix, feedbackContent, lastProcessedCommentDate }` |
 | `_noOpFixes[cause]` | `recordPrNoOpFixAttempt()` | Per-cause record `{ count, paused, fingerprint, beforeHead, afterHead }` driving the issue #2969 pause loop |

package/docs/shared-lifecycle-module-map.md

@@ -321,8 +321,6 @@ means zero such files were found), **Proposed target module**.
 | `resolveCcModel` | 3935-3950 | Resolve the model for the Command Center / doc-chat. Priority: 1. `engine.ccModel` — CC-only override 2. `engine.defaultModel` — fleet default (CC inherits this when ccModel unset) 3. `undefined` — let the runtime adapte | yes | `engine/llm.js`, `engine/pre-dispatch-eval.js`, `test/unit/auto-recovery.test.js`, `test/unit.test.js`, `dashboard.js` | engine/shared.js (keep) |
 | `resolveAgentMaxBudget` | 3951-3973 | Resolve the per-spawn USD budget cap. Priority: 1. `agent.maxBudgetUsd` — per-agent override 2. `engine.maxBudgetUsd` — fleet default 3. `undefined` — no cap Uses nullish coalescing so a literal `0` is honored as a valid | yes | `test/unit.test.js`, `engine.js` | engine/shared.js (keep) |
 | `resolveAgentBareMode` | 3974-3991 | Resolve whether this agent should run in Claude `--bare` mode. Priority: 1. `agent.bareMode` — per-agent override (boolean) 2. `engine.claudeBareMode` — fleet default 3. `false` — hardcoded fallback Strict undefined/null | yes | `test/unit.test.js`, `engine.js` | engine/shared.js (keep) |
-| `_normalizeMcpServerList` | 3992-4005 | P-mcp-storm — Resolve the list of MCP server names to disable for spawned // Copilot agents. The engine FILTERS these out of the agent's seeded // COPILOT_HOME mcp-config (engine.js `_applyAgentCopilotHome`) — a server a | no | _internal-only (no callers found outside shared.js)_ | engine/shared.js (keep) |
-| `resolveCopilotAgentDisabledMcpServers` | 4006-4030 | Resolve copilot agent disabled mcp servers. | yes | `test/unit/agent-copilot-home.test.js` | engine/shared.js (keep) |
 | `applyLegacyCcModelMigration` | 4063-4082 | If `config.engine.ccModel` is set but `config.engine.defaultModel` is unset, mutate the in-memory `config.engine` so `defaultModel` mirrors `ccModel` and log a one-time deprecation notice. Does NOT write to disk. Returns | yes | `engine/cli.js`, `test/unit.test.js` | engine/shared.js (keep) |
 | `_resetLegacyCcModelMigrationFlag` | 4083-4113 | Test helper: reset the dedup flag so repeated tests can re-trigger the log. | yes | _internal-only (no callers found outside shared.js)_ | engine/shared.js (keep) |
 | `runtimeConfigWarnings` | 4114-4194 | Inspect runtime fleet config and return warning entries for misconfiguration. Warnings emitted: - Unknown CLI: any `cli` value (per-agent, ccCli, defaultCli) not in `registeredRuntimes`. Each unknown value produces one e | yes | `engine/preflight.js` | engine/process-utils.js (new) — process spawn/pid/tmp-dir lifecycle helpers |

package/docs/team-memory.md

@@ -12,7 +12,7 @@ Multiple agents work the same repository in parallel and across days. Without sh
 - Agents re-litigate decisions the team already made (drift, regressions).
 - Human-flagged warnings (e.g., "do not self-approve PRs") get ignored because they live outside the prompt.
 
-Team memory closes the loop. The engine always injects pinned context. By default it also injects recent team and personal notes; when structured retrieval is enabled outside shadow mode, it replaces those broad appendices with a bounded task-relevant memory pack. Playbooks still instruct agents to consult `knowledge/` and `notes/inbox/` on disk before going wider.
+Team memory closes the loop. The engine always injects pinned context. By default, structured retrieval replaces broad team and personal notes with a bounded task-relevant memory pack. Playbooks still instruct agents to consult `knowledge/` and `notes/inbox/` on disk before going wider.
 
 ## Structured memory and retrieval
 
@@ -20,11 +20,11 @@ Migration `017-agent-memory.js` backfills the existing Markdown sources into `me
 
 `engine/memory-retrieval.js` searches active records in global, current-project, and assigned-agent scopes. It reranks lexical matches by scope, trust, path match, recency, importance, and confidence, then packs the best records into a strict byte budget. Agent- or external-authored procedural records are never recalled as instructions. Every injected pack remains inside an `<UNTRUSTED-INPUT>` fence.
 
-Rollout is controlled by the default-off `memoryRetrieval` feature flag:
+Structured retrieval is controlled by the default-on `memoryRetrieval` feature flag:
 
 - **Flag off:** legacy prompt behavior.
-- **Flag on + `memoryRetrievalShadowMode: true` (default):** compute retrieval and telemetry, but keep legacy prompts.
-- **Flag on + shadow mode off:** inject `Relevant Memory` when retrieval finds evidence; otherwise fall back to legacy notes and personal memory.
+- **Flag on + shadow mode off (default):** inject `Relevant Memory` when retrieval finds evidence; otherwise fall back to legacy notes and personal memory.
+- **Flag on + `memoryRetrievalShadowMode: true`:** compute retrieval and telemetry, but keep legacy prompts.
 
 Settings expose top-k, candidate count, byte budget, shadow mode, and episodic capture. The Inbox page's **Memory search** control shows provenance and status and supports explicit pin, retract, and restore actions.
 

package/engine/features.js

@@ -96,8 +96,8 @@ const FEATURES = {
     expires: '2026-12-01',
   },
   'memoryRetrieval': {
-    description: 'Select bounded task-relevant long-term memory with SQLite FTS5 instead of injecting only recent team and personal notes. Starts in shadow mode by default.',
-    default: false,
+    description: 'Select bounded task-relevant long-term memory with SQLite FTS5 instead of injecting broad team and personal notes.',
+    default: true,
     addedIn: '0.1.2233',
     expires: '2027-01-31',
   },

package/engine/github.js

@@ -99,6 +99,28 @@ function getRepoSlug(project) {
   return `${org}/${repo}`;
 }
 
+function getPrRepoSlug(project, pr) {
+  const scope = shared.getPrScopeInfo(pr, pr?.url || '')?.scope || '';
+  if (scope && scope === shared.getProjectPrScope(project)) return getRepoSlug(project);
+  if (scope.startsWith('github:')) return scope.slice('github:'.length);
+  return getRepoSlug(project);
+}
+
+function getProjectRepoSlugs(project) {
+  const primary = getRepoSlug(project);
+  const slugs = primary ? [primary] : [];
+  const seen = new Set(slugs.map(slug => slug.toLowerCase()));
+  for (const scope of shared.getProjectAllPrScopes(project)) {
+    if (!scope.startsWith('github:')) continue;
+    const slug = scope.slice('github:'.length);
+    if (!seen.has(slug)) {
+      slugs.push(slug);
+      seen.add(slug);
+    }
+  }
+  return slugs;
+}
+
 function getConfiguredGitHubAuthorLogins(config = {}) {
   const accounts = config?.engine?.ghAccounts;
   if (!accounts || typeof accounts !== 'object') return new Set();
@@ -520,40 +542,40 @@ async function forEachActiveGhPr(config, callback) {
     const src = project?.workSources?.pullRequests || config?.workSources?.pullRequests;
     if (src && src.enabled === false) continue;
 
-    const slug = getRepoSlug(project);
-    if (!slug) continue;
-
-    // Skip projects in backoff (inaccessible repo)
-    if (isSlugInBackoff(slug)) continue;
-
     const prs = getPrs(project);
     const activePrs = prs.filter(pr => PR_POLLABLE_STATUSES.has(pr.status)
       && shared.isPrCompatibleWithProject(project, pr, pr.url || ''));
     if (activePrs.length === 0) continue;
 
-    // Probe repo accessibility before iterating PRs — avoids N warnings per inaccessible repo.
-    // W-mp5trwh60008386d: ghApi returns the GH_NOT_FOUND sentinel on 404 (a frozen object,
-    // *not* null). The pre-fix gate only matched `null`, so a 404 on the base repo (caused by
-    // a multi-account `gh auth` switch, network blip, or token rotation) fell through and every
-    // per-PR call below 404'd, permanently flipping all active PRs to `abandoned`. We now treat
-    // both null and GH_NOT_FOUND as "skip the project for this tick" and explicitly do NOT
-    // increment per-PR `_consecutive404s` counters since no per-PR call was made.
-    const probe = await ghApi('', slug);
-    if (probe === null || probe === GH_NOT_FOUND) {
-      if (probe === GH_NOT_FOUND) {
-        log('warn', `GitHub repo probe for ${slug} returned 404 — skipping all per-PR polls for this project this tick (avoids spurious abandonments). Per-PR 404 counters NOT incremented.`);
-      }
-      recordSlugFailure(slug);
-      continue;
-    }
-    resetSlugBackoff(slug);
-
     let projectUpdated = 0;
     const updatedRecords = [];
+    const slugProbes = new Map();
 
     for (const pr of activePrs) {
       const prNum = shared.getPrNumber(pr);
       if (!prNum) continue;
+      const slug = getPrRepoSlug(project, pr);
+      if (!slug) continue;
+
+      let probeResult = slugProbes.get(slug);
+      if (probeResult === undefined) {
+        if (isSlugInBackoff(slug)) {
+          probeResult = 'fail';
+        } else {
+          const probe = await ghApi('', slug);
+          probeResult = (probe === null || probe === GH_NOT_FOUND) ? 'fail' : 'ok';
+          if (probeResult === 'fail') {
+            if (probe === GH_NOT_FOUND) {
+              log('warn', `GitHub repo probe for ${slug} returned 404 — skipping all per-PR polls for this repository this tick (avoids spurious abandonments). Per-PR 404 counters NOT incremented.`);
+            }
+            recordSlugFailure(slug);
+          } else {
+            resetSlugBackoff(slug);
+          }
+        }
+        slugProbes.set(slug, probeResult);
+      }
+      if (probeResult !== 'ok') continue;
 
       try {
         const before = shared.snapshotPrRecord(pr);
@@ -612,7 +634,10 @@ async function forEachActiveGhPr(config, callback) {
   const centralPrs = safeJsonArr(centralPath);
   // Build a slug→project map for configured GitHub projects so we can detect
   // PRs that are actually owned by the project loop (present in per-project file).
-  const configuredGhProjectsBySlug = new Map(projects.map(p => [getRepoSlug(p), p]));
+  const configuredGhProjectsBySlug = new Map();
+  for (const project of projects) {
+    for (const slug of getProjectRepoSlugs(project)) configuredGhProjectsBySlug.set(slug.toLowerCase(), project);
+  }
   const activeCentral = centralPrs.filter(pr => {
     if (!PR_POLLABLE_STATUSES.has(pr.status)) return false;
     if (!pr.url) return false;
@@ -621,7 +646,7 @@ async function forEachActiveGhPr(config, callback) {
     // the project loop will never see it — the central branch must poll it.
     const ghMatch = pr.url.match(/github\.com\/([^/]+\/[^/]+)\/pull\/\d+/);
     if (ghMatch) {
-      const owningProject = configuredGhProjectsBySlug.get(ghMatch[1]);
+      const owningProject = configuredGhProjectsBySlug.get(ghMatch[1].toLowerCase());
       if (owningProject) {
         const projectPrs = safeJsonArr(projectPrPath(owningProject));
         if (projectPrs.some(p => p.id === pr.id)) return false; // present → project loop handles it
@@ -1425,12 +1450,6 @@ async function reconcilePrs(config) {
   let totalAdded = 0;
 
   for (const project of projects) {
-    const slug = getRepoSlug(project);
-    if (!slug) continue;
-
-    // Skip projects in backoff (inaccessible repo)
-    if (isSlugInBackoff(slug)) continue;
-
     // Skip projects with no tracked PRs and no work items — nothing to reconcile
     const existingPrs = getPrs(project);
     if (existingPrs.length === 0) {
@@ -1441,18 +1460,21 @@ async function reconcilePrs(config) {
       } catch { continue; }
     }
 
-    // Fetch open PRs — paginate to handle repos with >100 open PRs
-    const prsData = await ghApi('/pulls?state=open&per_page=100', slug, { paginate: true, timeout: 60000 });
-    if (!prsData || !Array.isArray(prsData)) {
-      recordSlugFailure(slug);
-      continue;
+    const ghPrs = [];
+    for (const slug of getProjectRepoSlugs(project)) {
+      if (isSlugInBackoff(slug)) continue;
+      // Fetch open PRs — paginate to handle repos with >100 open PRs.
+      const prsData = await ghApi('/pulls?state=open&per_page=100', slug, { paginate: true, timeout: 60000 });
+      if (!prsData || !Array.isArray(prsData)) {
+        recordSlugFailure(slug);
+        continue;
+      }
+      resetSlugBackoff(slug);
+      for (const pr of prsData) {
+        const branch = pr.head?.ref || '';
+        if (branchPatterns.some(pat => pat.test(branch))) ghPrs.push({ pr, slug });
+      }
     }
-    resetSlugBackoff(slug);
-
-    const ghPrs = prsData.filter(pr => {
-      const branch = pr.head?.ref || '';
-      return branchPatterns.some(pat => pat.test(branch));
-    });
 
     if (ghPrs.length === 0) continue;
 
@@ -1470,8 +1492,12 @@ async function reconcilePrs(config) {
     const centralItems = safeJsonArr(centralWiPath);
     const allItems = [...workItems, ...centralItems];
 
-    for (const ghPr of ghPrs) {
-      const prUrl = project.prUrlBase ? project.prUrlBase + ghPr.number : ghPr.html_url || '';
+    for (const { pr: ghPr, slug } of ghPrs) {
+      const primarySlug = getRepoSlug(project);
+      const prUrl = ghPr.html_url
+        || (slug.toLowerCase() === primarySlug?.toLowerCase() && project.prUrlBase
+          ? project.prUrlBase + ghPr.number
+          : `https://github.com/${slug}/pull/${ghPr.number}`);
       const prId = shared.getCanonicalPrId(project, ghPr.number, prUrl);
       // P-a7c4d2e8 (F3): validate API-derived branch ref before persistence
       // / regex matching. Defensive degrade — log and treat as missing on
@@ -1604,7 +1630,7 @@ async function reconcilePrs(config) {
  */
 async function checkLiveReviewStatus(pr, project) {
   try {
-    const slug = getRepoSlug(project);
+    const slug = getPrRepoSlug(project, pr);
     if (!slug) return null;
     const prNum = shared.getPrNumber(pr);
     if (!prNum) return null;
@@ -1654,7 +1680,7 @@ async function checkLiveReviewStatus(pr, project) {
 async function dismissPriorViewerChangesRequestedReviews(pr, project) {
   let tmpFile = null;
   try {
-    const slug = getRepoSlug(project);
+    const slug = getPrRepoSlug(project, pr);
     if (!slug) return null;
     const prNum = shared.getPrNumber(pr);
     if (!prNum) return null;
@@ -1758,7 +1784,7 @@ async function dismissPriorViewerChangesRequestedReviews(pr, project) {
  */
 async function checkLiveBuildAndConflict(pr, project) {
   try {
-    const slug = getRepoSlug(project);
+    const slug = getPrRepoSlug(project, pr);
     if (!slug) return null;
     const prNum = shared.getPrNumber(pr);
     if (!prNum) return null;
@@ -1846,9 +1872,6 @@ async function reconcileAbandonedPrs(config) {
   const slugProbeCache = new Map(); // slug → 'ok' | 'fail'
 
   for (const project of projects) {
-    const slug = getRepoSlug(project);
-    if (!slug) continue;
-
     const prPath = projectPrPath(project);
     const prs = safeJsonArr(prPath);
     // Filter: only abandoned PRs that don't already have the confirmed-404
@@ -1862,37 +1885,35 @@ async function reconcileAbandonedPrs(config) {
     );
     if (abandonedPrs.length === 0) continue;
 
-    // Probe base repo (cached). Failure → skip ALL of this slug's abandoned
-    // PRs and increment skipped counter — auth/access issue at boot, retry
-    // next restart.
-    let probeResult = slugProbeCache.get(slug);
-    if (probeResult === undefined) {
-      const probe = await ghApi('', slug);
-      probeResult = (probe === null || probe === GH_NOT_FOUND) ? 'fail' : 'ok';
-      slugProbeCache.set(slug, probeResult);
-    }
-    if (probeResult === 'fail') {
-      log('warn', `Abandoned PR reconciliation: skipping ${slug} (${abandonedPrs.length} PR${abandonedPrs.length === 1 ? '' : 's'}) — base-repo probe failed, retry next startup`);
-      skipped += abandonedPrs.length;
-      continue;
-    }
-
-    // Per-PR re-probe. Collect updates first, then apply via mutatePullRequests
-    // for atomic single-writer semantics. We match by prNumber on writeback
-    // (not id) because mutatePullRequests calls normalizePrRecords which can
-    // lowercase the id slug — prNumber is the stable key within a project's
-    // pull-requests.json.
-    const updates = []; // { prNumber, action, newStatus?, mergedAt? }
+    // Per-PR re-probe. Canonical ids keep same-number PRs from different
+    // repository scopes isolated during writeback.
+    const updates = []; // { prId, prNumber, action, newStatus?, mergedAt? }
     for (const pr of abandonedPrs) {
       const prNum = shared.getPrNumber(pr);
       if (!prNum) continue;
+      const slug = getPrRepoSlug(project, pr);
+      if (!slug) continue;
+      const prId = shared.getCanonicalPrId(project, pr, pr.url || '');
+      if (!prId) continue;
+
+      let probeResult = slugProbeCache.get(slug);
+      if (probeResult === undefined) {
+        const probe = await ghApi('', slug);
+        probeResult = (probe === null || probe === GH_NOT_FOUND) ? 'fail' : 'ok';
+        slugProbeCache.set(slug, probeResult);
+      }
+      if (probeResult === 'fail') {
+        log('warn', `Abandoned PR reconciliation: skipping ${slug} — base-repo probe failed, retry next startup`);
+        skipped++;
+        continue;
+      }
 
       try {
         const prData = await ghApi(`/pulls/${prNum}`, slug);
         if (prData === GH_NOT_FOUND) {
           // 404 with base-probe OK → genuinely deleted. Mark so we don't
           // re-probe this PR on future startups.
-          updates.push({ prNumber: prNum, action: 'confirm404' });
+          updates.push({ prId, prNumber: prNum, action: 'confirm404' });
           confirmedDeleted++;
           log('info', `Confirmed PR #${prNum} (${slug}): truly deleted, leaving abandoned`);
         } else if (prData) {
@@ -1915,6 +1936,7 @@ async function reconcileAbandonedPrs(config) {
             continue;
           }
           updates.push({
+            prId,
             prNumber: prNum,
             action: 'flip',
             newStatus,
@@ -1938,7 +1960,9 @@ async function reconcileAbandonedPrs(config) {
       const reconciledAt = ts();
       mutatePullRequests(prPath, (currentPrs) => {
         for (const upd of updates) {
-          const pr = currentPrs.find(p => shared.getPrNumber(p) === upd.prNumber);
+          const pr = currentPrs.find(p =>
+            shared.getCanonicalPrId(project, p, p.url || '') === upd.prId
+          );
           if (!pr) continue;
           // Defensive: never downgrade a merged record. Should already be
           // filtered by the abandoned-only scan above, but a concurrent writer

package/engine/inbox-store.js

@@ -9,6 +9,17 @@
 const crypto = require('node:crypto');
 const { getDb, withTransaction } = require('./db');
 
+// Per CLAUDE.md's "State storage" mutator contract, every mutator wrapper
+// must call emitStateEvent() after a successful write so the dashboard's
+// MAX(events.id) cache-version advances — otherwise the dashboard keeps
+// serving stale cached inbox state until an unrelated event happens to
+// bump the counter. Best-effort: never let event emission fail a write.
+function _emitInboxEvent(payload) {
+  try {
+    require('./db-events').emitStateEvent('inbox', payload);
+  } catch { /* best-effort */ }
+}
+
 // In-process monotonic counter. Millisecond timestamps are too coarse to
 // disambiguate bursts of createInboxEntry() calls for the same
 // recipient+sender pair (e.g. rapid consolidation/notification writes), and
@@ -126,6 +137,7 @@ function createInboxEntry({
       }
     }
 
+    _emitInboxEvent({ id, recipientSessionId, action: 'create' });
     return getInboxEntryById(id);
   });
 }
@@ -144,6 +156,7 @@ function markInboxEntriesAsRead(entryIds) {
     const query = `UPDATE inbox_entries SET unread = 0, read_at = ? WHERE id IN (${placeholders})`;
     const stmt = db.prepare(query);
     const result = stmt.run(now, ...entryIds);
+    if (result.changes > 0) _emitInboxEvent({ entryIds, action: 'mark_read' });
     return { wrote: result.changes > 0 };
   });
 }
@@ -161,6 +174,7 @@ function markInboxEntriesAsUnread(entryIds) {
     const query = `UPDATE inbox_entries SET unread = 1, read_at = NULL WHERE id IN (${placeholders})`;
     const stmt = db.prepare(query);
     const result = stmt.run(...entryIds);
+    if (result.changes > 0) _emitInboxEvent({ entryIds, action: 'mark_unread' });
     return { wrote: result.changes > 0 };
   });
 }
@@ -176,6 +190,7 @@ function markAllInboxAsRead(recipientSessionId) {
     const result = db.prepare(
       'UPDATE inbox_entries SET unread = 0, read_at = ? WHERE recipient_session_id = ? AND unread = 1'
     ).run(now, recipientSessionId);
+    if (result.changes > 0) _emitInboxEvent({ recipientSessionId, action: 'mark_all_read' });
     return { wrote: result.changes > 0 };
   });
 }
@@ -188,6 +203,7 @@ function deleteInboxEntry(id) {
 
   return withTransaction(db, () => {
     const result = db.prepare('DELETE FROM inbox_entries WHERE id = ?').run(id);
+    if (result.changes > 0) _emitInboxEvent({ id, action: 'delete' });
     return { wrote: result.changes > 0 };
   });
 }
@@ -204,6 +220,7 @@ function deleteInboxEntries(entryIds) {
     const placeholders = entryIds.map(() => '?').join(',');
     const query = `DELETE FROM inbox_entries WHERE id IN (${placeholders})`;
     const result = db.prepare(query).run(...entryIds);
+    if (result.changes > 0) _emitInboxEvent({ entryIds, action: 'delete_batch' });
     return { wrote: result.changes > 0 };
   });
 }
@@ -222,6 +239,7 @@ function deleteInboxEntriesOlderThan(timestampMs, { unreadOnly = false } = {}) {
       query += ' AND unread = 1';
     }
     const result = db.prepare(query).run(...params);
+    if (result.changes > 0) _emitInboxEvent({ timestampMs, unreadOnly, action: 'delete_older_than' });
     return { wrote: result.changes > 0, deletedCount: result.changes };
   });
 }
@@ -252,6 +270,7 @@ function markInboxEntryNotified(id) {
   return withTransaction(db, () => {
     const now = Date.now();
     const result = db.prepare('UPDATE inbox_entries SET notified_at = ? WHERE id = ?').run(now, id);
+    if (result.changes > 0) _emitInboxEvent({ id, action: 'mark_notified' });
     return { wrote: result.changes > 0 };
   });
 }

package/engine/shared.js

@@ -3485,25 +3485,8 @@ const ENGINE_DEFAULTS = {
   claudePreApproveWorkspaceMcps: true,
   copilotStreamMode: 'on',           // Copilot --stream <on|off>: 'on' streams assistant.message_delta events live; 'off' batches them
   copilotReasoningSummaries: false,  // Copilot --enable-reasoning-summaries (Anthropic-family models only)
-  ccUseWorkerPool: false,            // Sub-task C of W-mp2w003600196c51 (CC perf): when true AND CC runtime is copilot, _invokeCcStream routes through engine/cc-worker-pool.js (persistent `copilot --acp` per CC tab) instead of spawning a fresh CLI per turn. Off by default — opt-in feature flag. **Structurally copilot-only**: the pool spawns `copilot --acp` (Agent Client Protocol); Claude Code does not implement ACP, so resolveCcUseWorkerPool returns false on non-copilot CC runtimes even with explicit-true (W-mphlriic00095f69 — prevents silent runtime switch). Engine/agent dispatch path stays per-process regardless.
+  ccUseWorkerPool: true,             // Sub-task C of W-mp2w003600196c51 (CC perf): when true AND CC runtime is copilot, _invokeCcStream routes through engine/cc-worker-pool.js (persistent `copilot --acp` per CC tab) instead of spawning a fresh CLI per turn. On by default (PR #2492 cold-spawn measurements; matches engine/features.js's `ccUseWorkerPool` registry default) — opt out via `engine.ccUseWorkerPool: false`. **Structurally copilot-only**: the pool spawns `copilot --acp` (Agent Client Protocol); Claude Code does not implement ACP, so resolveCcUseWorkerPool returns false on non-copilot CC runtimes even with explicit-true (W-mphlriic00095f69 — prevents silent runtime switch). Engine/agent dispatch path stays per-process regardless.
   agentUseWorkerPool: false,         // P-9b3d5f61: mirrors ccUseWorkerPool's shape but for the fleet agent-dispatch path (engine/agent-worker-pool.js). Opt-in, default OFF — see resolveAgentUseWorkerPool in engine/shared.js for the full priority chain and rationale.
-  // PR #321 — "kill auth-popup storm". Copilot spawns and authenticates EVERY
-  // MCP server in `$COPILOT_HOME/mcp-config.json` on every process start, even
-  // when the corresponding tool is hidden from the model via
-  // `--disable-mcp-server`. If left unfiltered, every auth-requiring user MCP
-  // (azure-kusto/azmcp, DevBox, workiq, loop, teams, …) boots and pops a
-  // Microsoft sign-in window on EVERY agent spawn — at minions' continuous
-  // spawn cadence that is an infinite popup storm.
-  //
-  // The engine therefore points agents at a private COPILOT_HOME
-  // (`shared.resolveAgentCopilotHome`) whose mcp-config is a copy of the operator's
-  // `~/.copilot/mcp-config.json` MINUS the names in this list (see engine.js
-  // `_applyAgentCopilotHome`). Default [] = inherit ALL of the operator's MCP
-  // servers for agents (non-breaking). Add a name to disable it for agents only;
-  // the operator's interactive `~/.copilot` is never touched. Per-agent override
-  // `agent.copilotAgentDisabledMcpServers`. Resolved through
-  // `shared.resolveCopilotAgentDisabledMcpServers(agent, engine)`.
-  copilotAgentDisabledMcpServers: [],
   maxBudgetUsd: undefined,       // fleet USD ceiling for --max-budget-usd (per-agent override: agents.<id>.maxBudgetUsd). Honors 0 via ?? so a literal cap of $0 works
   disableModelDiscovery: false,  // skip runtime.listModels() REST calls fleet-wide (settings UI falls back to free-text)
   // Phase 8 (qa-runs.json + qa-sessions.json → SQL). When true, every QA
@@ -3605,7 +3588,7 @@ const ENGINE_DEFAULTS = {
   agentMemorySummaryEnabled: false, // opt-in: when true, eviction batches go through an LLM-compressed summary before being dropped. Default off to mirror the conservative gating on the existing reconcile pass (LLM cost + test stability). Operators flip via engine.agentMemorySummaryEnabled.
   agentMemorySummaryThreshold: 30, // batch window: when summary is enabled and a prune evicts entries, fold at least this many oldest sections into one summary. Means "summary every ~30 entries" in steady state (the original PRD intent).
   agentMemorySummaryDays: 30, // age trigger: when the oldest section is older than this and >= agentMemorySummaryThreshold entries exist, summarize the oldest window even if the file is under the entry cap.
-  memoryRetrievalShadowMode: true, // compute + measure FTS5 retrieval but preserve legacy prompt injection until explicitly disabled
+  memoryRetrievalShadowMode: false, // inject bounded FTS5-selected memory by default; true computes telemetry while preserving legacy prompt injection
   memoryRetrievalTopK: 8, // maximum structured memory records injected into one dispatch
   memoryRetrievalMaxBytes: 8 * 1024, // hard byte budget for the Relevant Memory prompt appendix
   memoryRetrievalCandidateLimit: 50, // bounded FTS5 candidate pool before deterministic re-ranking
@@ -3863,7 +3846,7 @@ function resolveCcUseWorkerPool(engine) {
   if (engine && (engine.ccUseWorkerPool === true || engine.ccUseWorkerPool === false)) {
     return engine.ccUseWorkerPool;
   }
-  return true; // CC runtime is copilot — default ON (cold-start savings)
+  return ENGINE_DEFAULTS.ccUseWorkerPool;
 }
 
 /**
@@ -3988,39 +3971,6 @@ function resolveAgentBareMode(agent, engine) {
   return false;
 }
 
-// P-mcp-storm — Resolve the list of MCP server names to disable for spawned
-// Copilot agents. The engine FILTERS these out of the agent's seeded
-// COPILOT_HOME mcp-config (engine.js `_applyAgentCopilotHome`) — a server absent
-// from the config can't be spawned, which is the only effective disable
-// (`--disable-mcp-server` does not stop the process). Chain: per-agent
-// `agent.copilotAgentDisabledMcpServers` → `engine.copilotAgentDisabledMcpServers`
-// → `[]` (inherit all). Tolerant of either an array OR a comma/whitespace-
-// separated string (Settings UI / `MINIONS_*` env deliver strings). Always
-// returns a deduped array of trimmed, non-empty strings. See ENGINE_DEFAULTS
-// for the full rationale.
-function _normalizeMcpServerList(v) {
-  if (v == null) return null;
-  const raw = Array.isArray(v) ? v : String(v).split(/[\s,]+/);
-  const out = [];
-  const seen = new Set();
-  for (const item of raw) {
-    const name = String(item == null ? '' : item).trim();
-    if (!name || seen.has(name)) continue;
-    seen.add(name);
-    out.push(name);
-  }
-  return out;
-}
-
-function resolveCopilotAgentDisabledMcpServers(agent, engine) {
-  const a = agent ? _normalizeMcpServerList(agent.copilotAgentDisabledMcpServers) : null;
-  if (a) return a;
-  const e = engine ? _normalizeMcpServerList(engine.copilotAgentDisabledMcpServers) : null;
-  if (e) return e;
-  return [];
-}
-
-
 // ─── Legacy ccModel → defaultModel Migration ─────────────────────────────────
 //
 // Pre-P-3b8e5f1d, `engine.ccModel` was the single fleet-wide model knob (it
@@ -6051,91 +6001,6 @@ function resolveAgentTempBaseDir(project, engine, minionsDir) {
   return path.join(anchor, '.agent-temp');
 }
 
-/**
- * Resolve the stable, repo-external COPILOT_HOME used to isolate spawned
- * Copilot agents from the operator's interactive `~/.copilot` MCP servers
- * (W-copilot-auth-popup-storm / PR #321 — "give copilot agents an MCP-free
- * COPILOT_HOME (kill auth-popup storm)"). Copilot spawns and authenticates
- * EVERY server in `$COPILOT_HOME/mcp-config.json` on every process start;
- * `--disable-mcp-server <name>` only hides that server's tools from the model,
- * it does NOT stop the server process from launching (verified live: agents
- * spawned azmcp.exe/workiq.exe despite those servers being in
- * `copilotAgentDisabledMcpServers`). The only effective lever is to point
- * agents at a COPILOT_HOME whose mcp-config has NO disabled-list servers — see
- * `ensureAgentCopilotHome` below, which the engine seeds at boot and re-stamps
- * per dispatch (`_applyAgentCopilotHome` in engine.js).
- *
- * `COPILOT_HOME` overrides `$HOME/.copilot`; copilot auth is unaffected (it
- * uses GH_TOKEN / the OS credential store, not files under the home), and the
- * operator's real `~/.copilot` — i.e. their interactive copilot — is
- * completely untouched.
- *
- * Placed OUTSIDE the repo so concurrent git branch switches in the working
- * tree can never delete or dirty it, on the MINIONS_DIR volume (copilot's
- * session-store can grow to GBs, so keep it off a possibly-full system
- * drive). Stable path so copilot session resume (`--resume`) stays
- * consistent across spawns. Falls back to the user home when no minionsDir
- * is given.
- *
- * Base selection is cross-platform (W-copilot-home-posix-root): on Windows
- * the MINIONS_DIR drive root (`C:\`, `D:\`, or a UNC share root) is
- * user-writable, so we anchor there. On POSIX the filesystem root (`/`) is
- * NOT user-writable — a home placed there can never be created (`mkdir`
- * EACCES), `ensureAgentCopilotHome` fail-opens and returns the uncreatable
- * path anyway, and every spawned `copilot --acp` / copilot agent then
- * inherits a `COPILOT_HOME` it can't use and exits code 1 silently. So when
- * the drive root is the bare POSIX root we fall back to the user home —
- * repo-external, writable, and on the user's own volume.
- */
-function resolveAgentCopilotHome(minionsDir) {
-  let base;
-  if (minionsDir) {
-    const root = path.parse(path.resolve(String(minionsDir))).root;
-    // The POSIX filesystem root ('/') is not user-writable; Windows drive/UNC
-    // roots are. Anchor at the user home in the unwritable-root case.
-    base = (root === '/' || root === path.sep) ? os.homedir() : root;
-  } else {
-    base = os.homedir();
-  }
-  return path.join(base, '.minions-agent-copilot-home');
-}
-
-// Seed the agent COPILOT_HOME's mcp-config (copy of `~/.copilot/mcp-config.json`
-// MINUS `engine.copilotAgentDisabledMcpServers`) and return the home path. This
-// is the source of truth for "what MCP servers may an agent-dispatch copilot
-// load." It is applied to the engine-process copilot spawn paths ONLY — agent
-// dispatches (`_applyAgentCopilotHome`) and the engine process's own internal
-// `llm.callLLM` calls — by setting `process.env.COPILOT_HOME` at engine boot
-// and re-stamping it per dispatch, so those copilot CHILDREN inherit the
-// filtered config. copilot SPAWNS every server in its config and
-// authenticates it (`--disable-mcp-server` only hides tools), so any
-// auth-requiring server pops a Microsoft window per spawn — filtering the
-// config is the only effective control. Idempotent: writes only when the
-// content changes (safe under concurrent callers). The operator's real
-// `~/.copilot` (interactive copilot, and now also Command Center / doc-chat /
-// the CC worker pool, per W-mre75l6x00024f49) is never touched. Fail-open.
-function ensureAgentCopilotHome(minionsDir, engine) {
-  const home = resolveAgentCopilotHome(minionsDir);
-  try {
-    fs.mkdirSync(home, { recursive: true });
-    const disabled = new Set(resolveCopilotAgentDisabledMcpServers(null, engine));
-    let servers = {};
-    try {
-      const userCfgPath = path.join(os.homedir(), '.copilot', 'mcp-config.json');
-      const userCfg = JSON.parse(fs.readFileSync(userCfgPath, 'utf8').replace(/^/, ''));
-      for (const [name, def] of Object.entries(userCfg.mcpServers || {})) {
-        if (!disabled.has(name)) servers[name] = def;
-      }
-    } catch { servers = {}; /* no/unreadable user config → no MCPs */ }
-    const desired = JSON.stringify({ mcpServers: servers }, null, 2);
-    const cfgFile = path.join(home, 'mcp-config.json');
-    let current = null;
-    try { current = fs.readFileSync(cfgFile, 'utf8'); } catch {}
-    if (current !== desired) fs.writeFileSync(cfgFile, desired);
-  } catch { /* fail-open: leave whatever home/config exists */ }
-  return home;
-}
-
 // ── Spawn cwd vs worktree placement (W-mp73x32w000l143d) ──────────────────────
 // Work types that don't need a git worktree — they read repo state but don't
 // produce code changes. Centralized here so engine.js spawnAgent and any
@@ -9056,7 +8921,6 @@ module.exports = {
   resolvePollFlag, // P-c4d8e1a3 — granular per-poller flag resolution
   resolveAgentCli, resolveCcCli, resolveCcUseWorkerPool, resolveAgentUseWorkerPool, resolveAgentAcpPoolSize, resolveAgentModel, resolveCcModel,
   resolveAgentMaxBudget, resolveAgentBareMode,
-  resolveCopilotAgentDisabledMcpServers,
   applyLegacyCcModelMigration, _resetLegacyCcModelMigrationFlag,
   runtimeConfigWarnings,
   projectWorkSourceWarnings,
@@ -9162,9 +9026,7 @@ module.exports = {
   parseWorktreePorcelain,
   assertWorktreeOutsideProject,
   resolveProjectRootDir,
-  resolveAgentCopilotHome,
   resolveAgentTempBaseDir,
-  ensureAgentCopilotHome,
   resolveSpawnPaths,
   validateWorkItemWorkdir,
   applyWorkdir,

package/engine.js

@@ -2100,32 +2100,6 @@ async function recoverPartialWorktree(rootDir, worktreePath, branchName, gitOpts
   }
 }
 
-// Seed a spawned agent's COPILOT_HOME mcp-config as a copy of the operator's
-// `~/.copilot/mcp-config.json` MINUS the servers in
-// `engine.copilotAgentDisabledMcpServers`, then point COPILOT_HOME at it.
-//
-// Why config-filtering and not `--disable-mcp-server`: copilot SPAWNS every
-// server in its config on startup and authenticates it; `--disable-mcp-server
-// <name>` only hides that server's TOOLS from the model, it does NOT stop the
-// server process (PR #321 — verified live: agents spawned azmcp.exe/workiq.exe
-// despite those servers being in `copilotAgentDisabledMcpServers`).
-//
-// Default disabled list `[]` => agents inherit ALL of the operator's MCP servers
-// (non-breaking; matches interactive copilot). Add a name to disable it for
-// agents. COPILOT_HOME is copilot-specific; claude/codex ignore it, so this is
-// set unconditionally (no runtime.name branching, per the adapter contract).
-// Copilot auth is unaffected (GH_TOKEN / OS credential store); the operator's
-// real ~/.copilot is untouched. Best-effort/fail-open: any failure leaves the
-// inherited COPILOT_HOME so a hiccup never blocks a dispatch.
-function _applyAgentCopilotHome(childEnv) {
-  // Re-seed (picks up Settings changes to the disabled list) + stamp the env.
-  // process.env.COPILOT_HOME is also set at engine boot (see below) so the
-  // child would inherit it anyway; this is belt-and-suspenders + keeps the
-  // seed fresh per dispatch. See shared.ensureAgentCopilotHome.
-  try { childEnv.COPILOT_HOME = shared.ensureAgentCopilotHome(MINIONS_DIR, getConfig()?.engine); }
-  catch { /* leave inherited COPILOT_HOME untouched */ }
-}
-
 // Point a spawned agent's TEMP/TMP/TMPDIR at a scratch dir on the worktree
 // volume instead of the (often full) system drive — see
 // shared.resolveAgentTempBaseDir. copilot/node/git + JVM-based MCP servers write
@@ -4598,16 +4572,6 @@ async function spawnAgent(dispatchItem, config) {
   // random localhost port (blank window). Belt-and-suspenders with dashboard.js's
   // stdout.isTTY gate.
   childEnv.MINIONS_NO_AUTO_OPEN = '1';
-  // MCP-free copilot config so agents never pop a per-spawn Microsoft auth
-  // window — see _applyAgentCopilotHome / shared.resolveAgentCopilotHome.
-  // P-1d8f0b93 — SKIPPED for pooled dispatches: the pooled ACP worker is a
-  // long-lived process shared across many dispatches, so it always uses the
-  // operator's REAL COPILOT_HOME (this is the isolation-removal half of the
-  // pooling feature — MCP-auth-popup risk becomes bounded by pool size
-  // instead of eliminated per-dispatch; documented tradeoff in the plan).
-  if (!useAgentPool) {
-    _applyAgentCopilotHome(childEnv);
-  }
   // Keep agent scratch off a (possibly full) system drive — anchors TEMP/TMP to
   // the worktree volume. See _applyAgentTempEnv / shared.resolveAgentTempBaseDir.
   _applyAgentTempEnv(childEnv, project);
@@ -5059,8 +5023,6 @@ async function spawnAgent(dispatchItem, config) {
       // W-mqef-dashboard-tty — same browser-popup suppression on steering resume
       // (see the initial spawn site). Agents must never auto-open a browser.
       childEnv.MINIONS_NO_AUTO_OPEN = '1';
-      // Same MCP-free copilot home on steering resume (see the initial spawn site).
-      _applyAgentCopilotHome(childEnv);
       // Same agent-scratch redirect on steering resume.
       _applyAgentTempEnv(childEnv, project);
       if (getRepoHost(project) === 'ado') {
@@ -11685,17 +11647,6 @@ function ensureGitHooksInstalled() {
 
 if (require.main === module) {
   try { ensureGitHooksInstalled(); } catch { /* best-effort */ }
-  // Every copilot this process spawns — agent dispatches AND internal
-  // `llm.callLLM` calls (consolidation, classification, meetings, …) — inherits
-  // this process's COPILOT_HOME, so point it at the seeded, MCP-filtered home.
-  // Without this, those `direct:true` copilot calls load the operator's full
-  // `~/.copilot` stack and pop a Microsoft auth window per call. This isolation
-  // is engine-process-only: the dashboard process deliberately does NOT set
-  // COPILOT_HOME at its own boot, so Command Center / doc-chat / the CC worker
-  // pool inherit the operator's real `~/.copilot` home instead (reverted in
-  // W-mre75l6x00024f49; see dashboard.js boot for rationale).
-  // See shared.ensureAgentCopilotHome. Fail-open.
-  try { process.env.COPILOT_HOME = shared.ensureAgentCopilotHome(MINIONS_DIR, getConfig()?.engine); } catch {}
   const { handleCommand } = require('./engine/cli');
   const [cmd, ...args] = process.argv.slice(2);
   handleCommand(cmd, args);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yemi33/minions",
-  "version": "0.1.2374",
+  "version": "0.1.2376",
   "description": "Multi-agent AI dev team that runs from ~/.minions/ — five autonomous agents share a single engine, dashboard, and knowledge base",
   "bin": {
     "minions": "bin/minions.js"