@yemi33/minions 0.1.2381 → 0.1.2383

package/engine/lifecycle.js

@@ -17,6 +17,7 @@ const harness = require('./harness');
 const smallStateStore = require('./small-state-store');
 const prdStore = require('./prd-store');
 const { isBranchActive } = require('./cooldown');
+const { resolveExecutionModel } = require('./execution-model');
 const { worktreeMatchesBranch, getWorktreeBranch, cleanupMergedPrLocalBranch } = require('./cleanup');
 const { getConfig, getInboxFiles, getNotes, getPrs, getDispatch,
   MINIONS_DIR, ENGINE_DIR, PLANS_DIR, INBOX_DIR, AGENTS_DIR } = queries;
@@ -2319,7 +2320,7 @@ function resolveReviewPrContext(pr, project, config, structuredCompletion = null
     : null;
 }
 
-async function updatePrAfterReview(agentId, pr, project, config, resultSummary, structuredCompletion = null, dispatchItem = null) {
+async function updatePrAfterReview(agentId, pr, project, config, resultSummary, structuredCompletion = null, dispatchItem = null, executionMetadata = null) {
 
   if (!config) config = getConfig();
   const completionStatus = normalizeCompletionStatus(structuredCompletion?.status);
@@ -2338,6 +2339,11 @@ async function updatePrAfterReview(agentId, pr, project, config, resultSummary,
   const reviewProject = reviewContext.project;
   const prScope = reviewContext.scope;
   const reviewerName = config.agents?.[agentId]?.name || agentId;
+  const reviewExecutionModel = resolveExecutionModel({
+    reportedModel: executionMetadata?.reportedModel,
+    capturedModel: dispatchItem?.executionModel,
+    requestedModel: dispatchItem?.requestedModel,
+  });
 
   // Check actual review status from the platform (agent may have approved or requested changes)
   // If platform hasn't propagated the vote yet (returns 'pending'), keep current status unchanged.
@@ -2549,6 +2555,7 @@ async function updatePrAfterReview(agentId, pr, project, config, resultSummary,
       reviewer: reviewerName,
       reviewedAt: ts(),
       note: reviewNote,
+      model: reviewExecutionModel.model,
       dispatchId: dispatchItem?.id || structuredCompletion?.dispatchId || null,
       sourceItem: dispatchItem?.meta?.item?.id || null,
       ...(reviewThreads.length > 0 ? { threads: reviewThreads } : {}),
@@ -3134,7 +3141,6 @@ function updatePrAfterFix(pr, project, source, options = {}, legacyDispatchId =
   if (!options || typeof options !== 'object' || Array.isArray(options)) {
     options = { automationCauseKey: options, dispatchId: legacyDispatchId };
   }
-  const explicitlyChangedBranch = options.branchChanged !== false;
   const prScope = project || 'central';
   const automationCauseKey = options.automationCauseKey || options.dispatchItem?.meta?.automationCauseKey || '';
   const fixDispatchId = options.dispatchItem?.id || options.dispatchId || legacyDispatchId || '';
@@ -3143,6 +3149,15 @@ function updatePrAfterFix(pr, project, source, options = {}, legacyDispatchId =
     source,
     task: options.dispatchItem?.task,
   });
+  const evidenceOnlyReviewResolution = cause === shared.PR_FIX_CAUSE.REVIEW_FEEDBACK
+    && options.reviewFindingResolution;
+  // Review-fix completion is governed by the live branch probe. Preserve the
+  // legacy files_changed behavior for unrelated fix causes.
+  let explicitlyChangedBranch = options.branchChanged !== false;
+  if (cause === shared.PR_FIX_CAUSE.REVIEW_FEEDBACK && options.branchChange) {
+    explicitlyChangedBranch = true;
+  }
+  if (evidenceOnlyReviewResolution) explicitlyChangedBranch = false;
   let result = null;
   shared.mutatePullRequests(prScope, (prs) => {
     if (!Array.isArray(prs)) return prs;
@@ -4569,8 +4584,8 @@ function parseCompletionBoolean(value) {
 }
 
 // Detect a deliberate no-op completion — the agent correctly declined to make
-// changes (work was already shipped, dispatch premise was wrong, self-authored
-// review with no actionable feedback, etc.) and should NOT be flagged as a
+// changes (work was already shipped, dispatch premise was wrong, or a finding
+// was proven resolved/invalid with current-code evidence) and should NOT be flagged as a
 // silent failure for missing a PR. Honored signals:
 //   - completion.noop === true (canonical, primary)
 //   - completion.result === 'noop'  OR  completion.result.type === 'noop'
@@ -4578,8 +4593,8 @@ function parseCompletionBoolean(value) {
 // detected, or null otherwise. The status must be a successful terminal state
 // — a failed/partial/in-progress completion that also claims `noop` is a
 // contradiction and falls through to the normal contract.
-function parseCompletionNoop(completion) {
-  if (!completion || typeof completion !== 'object') return null;
+function completionDeclaresNoop(completion) {
+  if (!completion || typeof completion !== 'object') return false;
   const explicit = parseCompletionBoolean(completion.noop);
   let resultIsNoop = false;
   if (typeof completion.result === 'string') {
@@ -4587,7 +4602,11 @@ function parseCompletionNoop(completion) {
   } else if (completion.result && typeof completion.result === 'object') {
     resultIsNoop = String(completion.result.type || '').trim().toLowerCase() === 'noop';
   }
-  if (explicit !== true && !resultIsNoop) return null;
+  return explicit === true || resultIsNoop;
+}
+
+function parseCompletionNoop(completion) {
+  if (!completionDeclaresNoop(completion)) return null;
   const status = normalizeCompletionStatus(completion.status);
   if (status && status !== 'success' && status !== 'done' && status !== 'complete') return null;
   const reason = String(
@@ -4600,6 +4619,86 @@ function parseCompletionNoop(completion) {
   return reason || 'no-op completion';
 }
 
+function classifyBenignZeroTargetOutcome(dispatchItem, completion, resultSummary) {
+  const item = dispatchItem?.meta?.item;
+  if (!item?._scheduleId || item.createdBy !== 'scheduler') return null;
+  const type = dispatchItem?.type || item.type;
+  if (![WORK_TYPE.SETUP, WORK_TYPE.EXPLORE, WORK_TYPE.REVIEW].includes(type)) return null;
+  if (!completionDeclaresNoop(completion)) return null;
+  if (parseCompletionBoolean(completion?.needs_rerun ?? completion?.needsRerun) === true) return null;
+  if (parseCompletionBoolean(completion?.retryable) === true) return null;
+  if (completion?.securityFlags?.injectionAttempt === true) return null;
+  const failureClass = String(completion?.failure_class || '').trim().toLowerCase();
+  const nonceUnavailable = failureClass === 'completion-nonce-unavailable'
+    || failureClass === 'nonce-unavailable';
+  if (hasActionableFailureClass(failureClass) && !nonceUnavailable) return null;
+  const status = normalizeCompletionStatus(completion?.status);
+  const successfulStatus = status === 'success' || status === 'done' || status === 'complete';
+  const nonceTransportFailure = nonceUnavailable && (status.startsWith('fail') || status === 'error');
+  if (!successfulStatus && !nonceTransportFailure) return null;
+
+  const evidence = [...new Set([
+    completion?.summary,
+    completion?.noopReason,
+    completion?.noop_reason,
+    resultSummary,
+  ].filter(Boolean).map(value => String(value).trim()))].join(' ').trim();
+  if (!evidence) return null;
+
+  const mutationOccurred = [
+    /\b(?:a|one|[1-9]\d*)\s+(?:new\s+)?(?:work items?|reviews?|pull requests?|prs?|issues?)\s+(?:(?:was|were)\s+)?(?:created|enrolled|dispatched|posted|deleted|removed)\b/i,
+    /\b(?:created|enrolled|dispatched|posted|deleted|removed)\s+[1-9]\d*\b/i,
+  ].some(pattern => pattern.test(evidence));
+  if (mutationOccurred) return null;
+
+  const zeroTargets = [
+    /\bno\s+[^.!?\n]{0,120}\b(?:needed|required|eligible|qualif(?:y|ied)|found|remain(?:ed|ing)?|to\s+(?:review|remove|dispatch|enroll|process|merge|fix))\b/i,
+    /\bno\s+(?:open\s+issues?|eligible|qualifying|matching|context-only|merged|abandoned)\b/i,
+    /\b(?:0|zero)\s+(?:eligible|qualifying|matching|context-only|open)\b/i,
+  ].some(pattern => pattern.test(evidence));
+  if (!zeroTargets) return null;
+
+  const noMutation = [
+    /\bno\s+(?:api\s+)?(?:post|mutations?|writes?|actions?|changes?|modifications?|updates?|delete requests?|work items?|review work items?)\s+(?:(?:was|were)\s+)?(?:made|performed|taken|sent|created)?\b/i,
+    /\b(?:0|zero)\s+(?:were\s+)?(?:created|enrolled|dispatched|posted|deleted|removed)\b/i,
+    /\b(?:created|enrolled|dispatched|posted|deleted|removed)\s+(?:0|zero)\b/i,
+  ].some(pattern => pattern.test(evidence));
+  return noMutation ? evidence : null;
+}
+
+function validateReviewFixCompletion({ type, meta, branchChange, structuredCompletion } = {}) {
+  if (!shared.isFixLikeWorkType(type)) return { valid: true };
+  const cause = shared.getPrFixAutomationCause({
+    dispatchKey: meta?.dispatchKey,
+    source: meta?.source,
+    task: meta?.item?.title,
+  });
+  if (cause !== shared.PR_FIX_CAUSE.REVIEW_FEEDBACK
+      || (branchChange?.changed === true && branchChange.evidence === 'remote-head')) {
+    return { valid: true };
+  }
+
+  const findingId = shared.prReviewFindingIdentity(meta?.pr);
+  const resolution = structuredCompletion?.reviewFindingResolution;
+  const disposition = String(resolution?.disposition || '').trim().toLowerCase();
+  const reportedFindingId = String(resolution?.findingId || '').trim();
+  const currentCodeEvidence = String(resolution?.currentCodeEvidence || '').trim();
+  const hasCurrentCodeReference = /(?:[a-z]:[\\/])?[\w./\\-]+\.[a-z0-9]+:\d+\b/i.test(currentCodeEvidence)
+    || /\bcommit\s+[0-9a-f]{7,40}\b/i.test(currentCodeEvidence);
+  const validDisposition = disposition === 'already-resolved' || disposition === 'invalid';
+  const explicitNoop = !!parseCompletionNoop(structuredCompletion);
+
+  if (explicitNoop && validDisposition && reportedFindingId === findingId && hasCurrentCodeReference) {
+    return { valid: true, findingId, resolution };
+  }
+
+  return {
+    valid: false,
+    findingId,
+    reason: `Review-fix completion did not advance the PR branch and must explicitly prove the exact finding is already resolved or invalid with current-code evidence. Expected reviewFindingResolution.findingId="${findingId}", disposition "already-resolved" or "invalid", and a file:line or commit reference. Shared platform ownership, viewerDidAuthor, or reviewer/fixer agent equality is not evidence.`,
+  };
+}
+
 function normalizeReviewVerdict(verdict) {
   const value = String(verdict || '').trim().toLowerCase().replace(/[\s-]+/g, '_');
   if (value === 'approve' || value === 'approved') return REVIEW_STATUS.APPROVED;
@@ -5482,11 +5581,15 @@ async function runPostCompletionHooks(dispatchItem, agentId, code, stdout, confi
   // P-d2a8f6c1: a nonce mismatch always counts as an agent-reported failure
   // (regardless of what the discarded report claimed). This forces both the
   // effectiveSuccess gate below and the dispatch result in engine.js to ERROR.
-  const agentReportedFailure = !!nonceMismatch
-    || completionStatus.startsWith('fail')
+  const benignNoop = nonceMismatch
+    ? null
+    : classifyBenignZeroTargetOutcome(dispatchItem, structuredCompletion, completionGateSummary);
+  const agentReportedFailure = !!nonceMismatch || (!benignNoop && (
+    completionStatus.startsWith('fail')
     || completionStatus === 'error'
     || hasActionableFailureClass(structuredCompletion?.failure_class)
-    || agentNeedsRerun;
+    || agentNeedsRerun
+  ));
   // Untrusted completions cannot be honored as "retryable" by the agent — its
   // retryable claim was discarded with the rest of the report. Force false.
   const agentRetryable = nonceMismatch ? false : parseCompletionBoolean(structuredCompletion?.retryable);
@@ -5499,7 +5602,7 @@ async function runPostCompletionHooks(dispatchItem, agentId, code, stdout, confi
   if (autoRecovered) {
     log('info', `Auto-recovery: agent failed but created ${prsCreatedCount} PR(s) — upgrading ${meta.item.id} to done`);
   }
-  const effectiveSuccess = !nonceMismatch && ((isSuccess && !agentReportedFailure) || autoRecovered);
+  const effectiveSuccess = !nonceMismatch && (benignNoop || (isSuccess && !agentReportedFailure) || autoRecovered);
   if (!nonceMismatch) {
     const episodeOutcome = effectiveSuccess
       ? (autoRecovered || completionStatus.startsWith('partial') ? 'partial' : 'success')
@@ -5571,7 +5674,7 @@ async function runPostCompletionHooks(dispatchItem, agentId, code, stdout, confi
   // Without this, the second run produces no VERDICT, _retryCount increments,
   // and after 3 such bailouts the WI flips to status=failed even though the
   // original review was posted on the first run.
-  if (effectiveSuccess && type === WORK_TYPE.REVIEW && meta?.item?.id) {
+  if (effectiveSuccess && type === WORK_TYPE.REVIEW && meta?.item?.id && !benignNoop) {
     const verdict = reviewVerdictFromCompletion(structuredCompletion) || parseReviewVerdict(resultSummary);
     if (!verdict && isReviewBailout(resultSummary)) {
       log('info', `Review ${meta.item.id} bailed out (review already posted) — treating as DONE without retry`);
@@ -5721,7 +5824,9 @@ async function runPostCompletionHooks(dispatchItem, agentId, code, stdout, confi
 
   let completionContractFailure = null;
   if (effectiveSuccess && meta?.item?.id && !skipDoneStatus) {
-    const nonTerminalCompletion = detectNonTerminalResultSummary(completionGateSummary, structuredCompletion, reportCompletion, { detectPhantom });
+    const nonTerminalCompletion = benignNoop
+      ? null
+      : detectNonTerminalResultSummary(completionGateSummary, structuredCompletion, reportCompletion, { detectPhantom });
     if (nonTerminalCompletion) {
       const isPhantomDetection = nonTerminalCompletion.phrase === 'phantom-completion';
       // P-e0b4f7a5 — before deferring a phantom retry, attempt to recover
@@ -5750,13 +5855,70 @@ async function runPostCompletionHooks(dispatchItem, agentId, code, stdout, confi
   }
 
   // No-op signal: agent declared the work was correctly NOT done (already
-  // shipped, dispatch premise wrong, self-authored review, etc.). Skip the PR
+  // shipped, dispatch premise wrong, evidence-backed resolved finding, etc.). Skip the PR
   // attachment contract — a missing PR is intentional, not a silent failure.
-  const noopRationale = (effectiveSuccess && meta?.item?.id && !skipDoneStatus)
-    ? parseCompletionNoop(structuredCompletion)
+  let prFixBranchChange = null;
+  let prFixBuildStillFailing = null;
+  if (shared.isFixLikeWorkType(type) && effectiveSuccess && meta?.pr?.id) {
+    try {
+      prFixBranchChange = await detectPrFixBranchChange(meta, config);
+    } catch (err) {
+      log('warn', `PR fix no-op detection for ${meta.pr.id}: ${err.message}`);
+      prFixBranchChange = { changed: null, reason: err.message };
+    }
+    if (prFixBranchChange?.changed === false) {
+      const fixCause = shared.getPrFixAutomationCause({
+        dispatchKey: dispatchItem?.meta?.dispatchKey,
+        source: meta?.source,
+        task: dispatchItem?.task,
+      });
+      if (fixCause === shared.PR_FIX_CAUSE.BUILD_FAILURE) {
+        try {
+          const liveStatus = await checkBuildStillFailingLive(meta.pr, meta.project);
+          if (liveStatus === shared.BUILD_STATUS.FAILING) {
+            prFixBuildStillFailing = liveStatus;
+          }
+        } catch (err) {
+          log('warn', `Live build re-check for ${meta.pr.id}: ${err.message}`);
+        }
+      }
+    }
+  }
+  let noopRationale = (effectiveSuccess && !skipDoneStatus)
+    ? (parseCompletionNoop(structuredCompletion) || benignNoop)
     : null;
+  let reviewFixResolution = null;
+  if (effectiveSuccess && !skipDoneStatus) {
+    const reviewFixValidation = validateReviewFixCompletion({
+      type,
+      meta,
+      branchChange: prFixBranchChange,
+      structuredCompletion,
+    });
+    if (!reviewFixValidation.valid) {
+      skipDoneStatus = true;
+      meta._agentId = agentId;
+      const detection = {
+        phrase: 'review-fix-resolution-evidence-missing',
+        reason: reviewFixValidation.reason,
+      };
+      const reason = meta?.item?.id
+        ? deferNonTerminalCompletion(meta, detection)
+        : detection.reason;
+      completionContractFailure = {
+        reason,
+        itemId: meta?.item?.id || dispatchItem.id,
+        nonTerminal: true,
+        processWorkItemFailure: false,
+      };
+      noopRationale = null;
+      log('warn', `Review-fix completion rejected for ${meta?.item?.id || dispatchItem.id}: ${reviewFixValidation.reason}`);
+    } else {
+      reviewFixResolution = reviewFixValidation.resolution || null;
+    }
+  }
   if (noopRationale) {
-    log('info', `No-op completion for ${meta.item.id}: ${noopRationale.slice(0, 200)}`);
+    log('info', `No-op completion for ${meta?.item?.id || dispatchItem.id}: ${noopRationale.slice(0, 200)}`);
   }
 
   if (effectiveSuccess && meta?.item?.id && !skipDoneStatus && !noopRationale) {
@@ -5994,41 +6156,6 @@ async function runPostCompletionHooks(dispatchItem, agentId, code, stdout, confi
 
   // Archive is manual — user archives plans from the dashboard when ready
 
-  let prFixBranchChange = null;
-  let prFixBuildStillFailing = null;
-  if (shared.isFixLikeWorkType(type) && effectiveSuccess && meta?.pr?.id) {
-    try {
-      prFixBranchChange = await detectPrFixBranchChange(meta, config);
-    } catch (err) {
-      log('warn', `PR fix no-op detection for ${meta.pr.id}: ${err.message}`);
-      prFixBranchChange = { changed: null, reason: err.message };
-    }
-    // #639 — a BUILD_FAILURE fix that didn't change the branch is not
-    // necessarily a genuine no-op: the agent may have found its own (or a
-    // prior dispatch's) fix commit already present and concluded "nothing to
-    // change" without checking whether CI actually turned green on that
-    // commit. Re-poll live CI for the head before letting updatePrAfterFix
-    // accept the no-op — if it's still failing, flag it so the no-op path
-    // records a distinct fixIneffective signal instead of a clean no-op.
-    if (prFixBranchChange?.changed === false) {
-      const fixCause = shared.getPrFixAutomationCause({
-        dispatchKey: dispatchItem?.meta?.dispatchKey,
-        source: meta?.source,
-        task: dispatchItem?.task,
-      });
-      if (fixCause === shared.PR_FIX_CAUSE.BUILD_FAILURE) {
-        try {
-          const liveStatus = await checkBuildStillFailingLive(meta.pr, meta.project);
-          if (liveStatus === shared.BUILD_STATUS.FAILING) {
-            prFixBuildStillFailing = liveStatus;
-          }
-        } catch (err) {
-          log('warn', `Live build re-check for ${meta.pr.id}: ${err.message}`);
-        }
-      }
-    }
-  }
-
   // Scheduled task back-reference: update SQL state and write a linked inbox note.
   if (meta?.item?._scheduleId) {
     try {
@@ -6133,12 +6260,21 @@ async function runPostCompletionHooks(dispatchItem, agentId, code, stdout, confi
   const hardContractFail = completionContractFailure?.severity === 'hard'
     || completionContractFailure?.nonTerminal === true;
   const finalResult = hardContractFail ? DISPATCH_RESULT.ERROR : (effectiveSuccess ? DISPATCH_RESULT.SUCCESS : DISPATCH_RESULT.ERROR);
-  if (type === WORK_TYPE.REVIEW && finalResult === DISPATCH_RESULT.SUCCESS && !skipDoneStatus) {
-    await updatePrAfterReview(agentId, meta?.pr, meta?.project, config, resultSummary, structuredCompletion, dispatchItem);
+  if (type === WORK_TYPE.REVIEW && finalResult === DISPATCH_RESULT.SUCCESS && !skipDoneStatus && !benignNoop) {
+    await updatePrAfterReview(
+      agentId,
+      meta?.pr,
+      meta?.project,
+      config,
+      resultSummary,
+      structuredCompletion,
+      dispatchItem,
+      { reportedModel: model },
+    );
   } else if (type === WORK_TYPE.REVIEW) {
     log('warn', `Skipping PR review metadata update for ${meta?.pr?.id || meta?.pr?.url || '(unknown PR)'} because review dispatch ${dispatchItem.id} did not complete cleanly`);
   }
-  if (shared.isFixLikeWorkType(type) && effectiveSuccess) {
+  if (shared.isFixLikeWorkType(type) && effectiveSuccess && !skipDoneStatus) {
     updatePrAfterFix(meta?.pr, meta?.project, meta?.source, {
       branchChanged: fixCompletionChangedBranch(structuredCompletion),
       automationCauseKey: meta?.automationCauseKey,
@@ -6147,6 +6283,7 @@ async function runPostCompletionHooks(dispatchItem, agentId, code, stdout, confi
       buildStillFailing: prFixBuildStillFailing,
       config,
       noopReason: noopRationale || meta?._noopReason || '',
+      reviewFindingResolution: reviewFixResolution,
     });
     // W-mpg58wv3 — closure-loop dispatch. When the completed fix WI was spawned
     // to address a minion REQUEST_CHANGES (its meta carries
@@ -6232,7 +6369,7 @@ async function runPostCompletionHooks(dispatchItem, agentId, code, stdout, confi
   const metricsResult = isAutoRetry ? 'retry' : finalResult;
   updateMetrics(agentId, dispatchItem, metricsResult, taskUsage, prsCreatedCount, model);
 
-  return { resultSummary, taskUsage, autoRecovered, structuredCompletion, completionContractFailure, agentReportedFailure, agentRetryable, nonceMismatch };
+  return { resultSummary, taskUsage, autoRecovered, structuredCompletion, completionContractFailure, agentReportedFailure, agentRetryable, nonceMismatch, benignNoop };
 }
 
 // ─── PR → PRD Status Sync ─────────────────────────────────────────────────────
@@ -6986,6 +7123,8 @@ module.exports = {
   parseReviewVerdict,
   isReviewBailout,
   parseCompletionNoop,
+  classifyBenignZeroTargetOutcome, // exported for testing
+  validateReviewFixCompletion,
   detectNonTerminalResultSummary,
   deferNonTerminalCompletion,
   deferPhantomCompletion,

package/engine/llm.js

@@ -18,7 +18,15 @@ const {
   ENGINE_DEFAULTS,
   resolveCcCli, resolveCcModel,
 } = shared;
-const { resolveRuntime } = require('./runtimes');
+const {
+  resolveRuntime,
+  resolveRuntimeByCapability,
+  listRuntimes,
+  RUNTIME_IMAGES_FILE_OPTION,
+  sanitizeInvocationOptions,
+  resolveInvocationOptions,
+  buildSpawnFlags,
+} = require('./runtimes');
 
 const MINIONS_DIR = shared.MINIONS_DIR;
 const ENGINE_DIR = path.join(MINIONS_DIR, 'engine');
@@ -217,15 +225,17 @@ function _runtimeInstallHint(runtimeName, runtime) {
 function _missingRuntimeMessage(runtimeName, runtime, reason) {
   const selected = runtime?.name || runtimeName || 'configured';
   if (!runtime) {
+    const installLines = listRuntimes().map((name) => {
+      const adapter = resolveRuntime(name);
+      return `- ${name}: ${_runtimeInstallHint(name, adapter)}`;
+    });
     return [
       `Minions can't run the configured runtime "${selected}".`,
       '',
       reason || 'The configured runtime is not registered.',
       '',
       'Choose a supported runtime in Settings -> Engine -> defaultCli/ccCli, then install its CLI:',
-      '- Claude Code: npm install -g @anthropic-ai/claude-code or download from https://claude.ai/download',
-      '- OpenAI Codex CLI: npm install -g @openai/codex or brew install --cask codex',
-      '- GitHub Copilot CLI: install via GitHub CLI/gh-copilot or download from https://github.com/github/copilot-cli/releases',
+      ...installLines,
       '',
       'After installing, restart Minions so the dashboard and engine inherit the updated PATH.',
     ].join('\n');
@@ -239,10 +249,9 @@ function _missingRuntimeMessage(runtimeName, runtime, reason) {
     '',
     'After installing, restart Minions so the dashboard and engine inherit the updated PATH.',
   ];
-  if (selected === 'claude') {
-    lines.push('Or switch Settings -> Engine -> defaultCli/ccCli to "copilot" or "codex" after installing another supported runtime.');
-  } else {
-    lines.push('Or switch Settings -> Engine -> defaultCli/ccCli back to "claude" after installing Claude Code.');
+  const alternatives = listRuntimes().filter(name => name !== selected);
+  if (alternatives.length) {
+    lines.push(`Or switch Settings -> Engine -> defaultCli/ccCli to another installed runtime: ${alternatives.join(', ')}.`);
   }
   return lines.join('\n');
 }
@@ -337,37 +346,12 @@ function _runtimeUnavailableResult(callOpts = {}) {
 // ─── Spawn Helpers ───────────────────────────────────────────────────────────
 
 /**
- * Translate the unified opts bag into the named CLI flags consumed by
- * `engine/spawn-agent.js`. spawn-agent.js parses these back into an opts
- * object and calls `runtime.buildArgs(opts)` once — keeping the adapter as
- * the single source of truth and avoiding double-flag emission.
- *
- * Capability gating (matches engine.js _buildAgentSpawnFlags from P-2a6d9c4f):
- *   - effort/sessionId/maxBudget/bare/fallbackModel are dropped when the
- *     runtime's matching capability is false.
- *   - Copilot-specific opts (stream, disableBuiltinMcps,
- *     reasoningSummaries) are emitted unconditionally; the Claude adapter
- *     ignores them via the "tolerate unknown opts" rule.
+ * Encode the semantic invocation options through the stable runtime facade.
+ * Legacy named wrapper flags remain for compatibility; the opaque options bag
+ * is authoritative for adapter fields the wrapper does not know yet.
  */
 function _buildSpawnAgentFlags(runtime, opts = {}) {
-  const caps = (runtime && runtime.capabilities) || {};
-  const flags = ['--runtime', String(runtime?.name || 'claude')];
-
-  if (opts.maxTurns != null) flags.push('--max-turns', String(opts.maxTurns));
-  if (opts.model) flags.push('--model', String(opts.model));
-  if (opts.allowedTools) flags.push('--allowedTools', String(opts.allowedTools));
-
-  if (caps.effortLevels && opts.effort) flags.push('--effort', String(opts.effort));
-  if (caps.sessionResume && opts.sessionId) flags.push('--resume', String(opts.sessionId));
-  if (caps.budgetCap && opts.maxBudget != null) flags.push('--max-budget-usd', String(opts.maxBudget));
-  if (caps.bareMode && opts.bare === true) flags.push('--bare');
-  if (caps.fallbackModel && opts.fallbackModel) flags.push('--fallback-model', String(opts.fallbackModel));
-
-  if (opts.stream === 'on' || opts.stream === 'off') flags.push('--stream', opts.stream);
-  if (opts.disableBuiltinMcps === true) flags.push('--disable-builtin-mcps');
-  if (opts.reasoningSummaries === true) flags.push('--enable-reasoning-summaries');
-
-  return flags;
+  return buildSpawnFlags(runtime, opts);
 }
 
 /**
@@ -379,15 +363,12 @@ function _buildSpawnAgentFlags(runtime, opts = {}) {
  *
  * Indirect path: uses engine/spawn-agent.js — mostly a fallback when the
  *   direct path can't resolve the binary cache. spawn-agent.js handles
- *   adapter resolution itself; we just hand it `--runtime <name>` plus the
- *   named flags it knows how to parse.
+ *   adapter resolution itself; we hand it the runtime plus an opaque options
+ *   bag, so adding a harness flag does not require wrapper changes.
  */
 function _spawnProcess(promptText, sysPromptText, callOpts) {
   const {
-    direct, label, runtime, model, maxTurns, allowedTools, effort, sessionId,
-    maxBudget, bare, fallbackModel,
-    stream, disableBuiltinMcps, reasoningSummaries,
-    images,
+    direct, label, runtime, adapterOptions = {},
   } = callOpts;
 
   const id = uid();
@@ -399,24 +380,10 @@ function _spawnProcess(promptText, sysPromptText, callOpts) {
   const cleanupFiles = [];
   const cleanupDirs = [llmTmpDir];
   const caps = (runtime && runtime.capabilities) || {};
-  const adapterOpts = {
-    model, maxTurns, allowedTools, effort, sessionId,
-    maxBudget, bare, fallbackModel,
-    stream, disableBuiltinMcps, reasoningSummaries,
-    images,
+  const adapterOpts = sanitizeInvocationOptions(runtime, {
+    ...adapterOptions,
     tmpDir: llmTmpDir,
-  };
-  // Capability-gate per-flag opts before prompt construction so adapters can
-  // make resume-aware prompt decisions from the same opts used for argv.
-  if (!caps.effortLevels) adapterOpts.effort = undefined;
-  if (!caps.sessionResume) adapterOpts.sessionId = undefined;
-  if (!caps.budgetCap) adapterOpts.maxBudget = undefined;
-  if (!caps.bareMode) adapterOpts.bare = undefined;
-  if (!caps.fallbackModel) adapterOpts.fallbackModel = undefined;
-  // P-7b2e4d01 — defense in depth: never forward images to a runtime that
-  // can't read them (callLLM/callLLMStreaming already gate + surface a typed
-  // error upstream; this protects any other _spawnProcess caller).
-  if (!caps.imageInput) adapterOpts.images = undefined;
+  });
   const finalPrompt = runtime.buildPrompt(promptText, sysPromptText, adapterOpts);
 
   // ── Direct path ──
@@ -426,7 +393,7 @@ function _spawnProcess(promptText, sysPromptText, callOpts) {
     // Only write a sys-prompt tmp file when the runtime actually consumes one
     // via --system-prompt-file (Claude) AND we're not resuming (resumed sessions
     // already have the sys prompt baked in).
-    if (!sessionId && sysPromptText && caps.systemPromptFile) {
+    if (!adapterOpts.sessionId && sysPromptText && caps.systemPromptFile) {
       sysTmpPath = path.join(llmTmpDir, `direct-sys-${id}.md`);
       fs.writeFileSync(sysTmpPath, sysPromptText);
       cleanupFiles.push(sysTmpPath);
@@ -472,12 +439,16 @@ function _spawnProcess(promptText, sysPromptText, callOpts) {
   const pidPath = promptPath.replace(/prompt-/, 'pid-').replace(/\.md$/, '.pid');
   cleanupFiles.push(promptPath, sysPath, pidPath);
 
-  const spawnScript = path.join(ENGINE_DIR, 'spawn-agent.js');
-  const adapterFlags = _buildSpawnAgentFlags(runtime, {
-    model, maxTurns, allowedTools, effort, sessionId,
-    maxBudget, bare, fallbackModel,
-    stream, disableBuiltinMcps, reasoningSummaries,
-  });
+  const spawnScript = runtime.spawnScript || path.join(ENGINE_DIR, 'spawn-agent.js');
+  const indirectAdapterOpts = { ...adapterOpts };
+  if (Array.isArray(indirectAdapterOpts.images) && indirectAdapterOpts.images.length) {
+    const imagesPath = path.join(llmTmpDir, `runtime-images-${id}.json`);
+    safeWrite(imagesPath, JSON.stringify(indirectAdapterOpts.images));
+    cleanupFiles.push(imagesPath);
+    indirectAdapterOpts[RUNTIME_IMAGES_FILE_OPTION] = imagesPath;
+    delete indirectAdapterOpts.images;
+  }
+  const adapterFlags = _buildSpawnAgentFlags(runtime, indirectAdapterOpts);
   const args = [spawnScript, promptPath, sysPath, ...adapterFlags];
 
   const proc = runFile(process.execPath, args, {
@@ -692,11 +663,16 @@ function _resolveModelForRuntime(runtime, callOpts) {
 function _resolveRuntimeFeatureOpts({
   stream, disableBuiltinMcps, reasoningSummaries, engineConfig,
 } = {}) {
-  const engine = engineConfig || {};
+  const runtime = resolveRuntimeByCapability('acpWorkerPool');
+  const resolved = resolveInvocationOptions(runtime, {
+    stream,
+    disableBuiltinMcps,
+    reasoningSummaries,
+  }, { engineConfig: engineConfig || {} });
   return {
-    stream: stream ?? engine.copilotStreamMode,
-    disableBuiltinMcps: disableBuiltinMcps ?? engine.copilotDisableBuiltinMcps,
-    reasoningSummaries: reasoningSummaries ?? engine.copilotReasoningSummaries,
+    stream: resolved.stream,
+    disableBuiltinMcps: resolved.disableBuiltinMcps,
+    reasoningSummaries: resolved.reasoningSummaries,
   };
 }
 
@@ -770,17 +746,17 @@ function callLLM(promptText, sysPromptText, opts = {}) {
   const model = _resolveModelForRuntime(runtime, { model: modelOverride, engineConfig });
   const imageGate = _resolveImageOpts(images, runtime && runtime.capabilities);
   if (imageGate.error) return _resolvedCallResult(_imageUnsupportedResult(runtime, imageGate.error));
-  const runtimeFeatureOpts = _resolveRuntimeFeatureOpts({
-    stream, disableBuiltinMcps, reasoningSummaries, engineConfig,
-  });
+  const runtimeOptions = resolveInvocationOptions(runtime, {
+    model, maxTurns, allowedTools, effort, sessionId,
+    maxBudget, bare, fallbackModel, images: imageGate.images,
+    stream, disableBuiltinMcps, reasoningSummaries,
+  }, { engineConfig: engineConfig || {} });
 
   let _abort = null;
   const promise = new Promise((resolve) => {
     const _startMs = Date.now();
     const { proc, cleanupFiles, cleanupDirs } = _spawnProcess(promptText, sysPromptText, {
-      direct, label, runtime, model, maxTurns, allowedTools, effort, sessionId,
-      maxBudget, bare, fallbackModel, images: imageGate.images,
-      ...runtimeFeatureOpts,
+      direct, label, runtime, adapterOptions: runtimeOptions,
     });
     let resolved = false;
     let exitFallbackTimer = null;
@@ -895,17 +871,17 @@ function callLLMStreaming(promptText, sysPromptText, opts = {}) {
   const model = _resolveModelForRuntime(runtime, { model: modelOverride, engineConfig });
   const imageGate = _resolveImageOpts(images, runtime && runtime.capabilities);
   if (imageGate.error) return _resolvedCallResult(_imageUnsupportedResult(runtime, imageGate.error));
-  const runtimeFeatureOpts = _resolveRuntimeFeatureOpts({
-    stream, disableBuiltinMcps, reasoningSummaries, engineConfig,
-  });
+  const runtimeOptions = resolveInvocationOptions(runtime, {
+    model, maxTurns, allowedTools, effort, sessionId,
+    maxBudget, bare, fallbackModel, images: imageGate.images,
+    stream, disableBuiltinMcps, reasoningSummaries,
+  }, { engineConfig: engineConfig || {} });
 
   let _abort = null;
   const promise = new Promise((resolve) => {
     const _startMs = Date.now();
     const { proc, cleanupFiles, cleanupDirs } = _spawnProcess(promptText, sysPromptText, {
-      direct, label, runtime, model, maxTurns, allowedTools, effort, sessionId,
-      maxBudget, bare, fallbackModel, images: imageGate.images,
-      ...runtimeFeatureOpts,
+      direct, label, runtime, adapterOptions: runtimeOptions,
     });
     let resolved = false;
     let exitFallbackTimer = null;

package/engine/memory-store.js

@@ -269,10 +269,12 @@ function searchMemoryRecords(query, options = {}) {
   }
   const limit = Math.max(1, Math.min(200, Number(options.limit) || 50));
   args.push(limit);
+  // CROSS JOIN pins FTS as the outer loop; Node 22's SQLite otherwise prefers
+  // the scope index and evaluates MATCH once for every scoped record.
   const sql = `
     SELECT m.*, bm25(memory_records_fts, 5.0, 1.0, 2.0, 3.0) AS fts_rank
     FROM memory_records_fts
-    JOIN memory_records m ON m.rowid=memory_records_fts.rowid
+    CROSS JOIN memory_records m ON m.rowid=memory_records_fts.rowid
     WHERE ${where.join(' AND ')}
     ORDER BY fts_rank
     LIMIT ?