@yemi33/minions 0.1.2382 → 0.1.2384

package/engine/cli.js

@@ -9,6 +9,7 @@ const shared = require('./shared');
 const { safeRead, safeJson, safeJsonArr, safeWrite, readWorkItems, readPullRequests, mutateControl, mutateWorkItems, ts, WI_STATUS, WORK_TYPE, PLAN_STATUS, PR_STATUS, REVIEW_STATUS, DISPATCH_RESULT, FAILURE_CLASS } = shared;
 const queries = require('./queries');
 const agentWorkerPool = require('./agent-worker-pool');
+const { resolveCommentExecutionModel } = require('./execution-model');
 const { getConfig, getControl, getDispatch, getAgentStatus,
   MINIONS_DIR, ENGINE_DIR, AGENTS_DIR, PLANS_DIR, PRD_DIR, CONTROL_PATH } = queries;
 
@@ -652,6 +653,12 @@ const commands = {
 
         const hadPid = agentPid && agentPid > 0; // track before liveness check
         if (agentPid && agentPid > 0 && !isPidAlive(agentPid)) agentPid = null;
+        if (agentPid && !shared.isDispatchExecutionPathSafe(item, config)) {
+          e.log('warn', `Reattach: refusing ${item.id} — persisted execution path is not safe under current checkout config`);
+          try { shared.killImmediate({ pid: agentPid }); }
+          catch (err) { e.log('warn', `Reattach: failed to terminate unsafe dispatch ${item.id}: ${err.message}`); }
+          agentPid = null;
+        }
 
         // PID was found but confirmed dead — exempt from restart grace period (#869)
         if (hadPid && !agentPid) {
@@ -811,18 +818,14 @@ const commands = {
             );
           } catch (err) { e.log('warn', `Orphan dispatch complete: ${err.message}`); }
 
-          // P-d9e6b2c4 — live-mode dispatch-end auto-restore + terminal-failure
-          // notify on the engine-restart reattach completion path. originalRef
-          // is only persisted for live-mode dispatches (P-c5a1f3b8), so its
-          // presence is the liveMode signal here — the slimmed meta.project
-          // carries no checkoutMode. Mirrors the in-process onAgentClose wiring
-          // (engine.js). Fire-and-forget + best-effort: the helper swallows its
-          // own errors and only ever issues a plain `git checkout <originalRef>`
-          // (never --force/reset/clean/stash) against the operator tree.
-          if (item.originalRef && item.meta?.branch && item.meta?.project?.localPath) {
+          // Restore only records explicitly dispatched live and still configured
+          // live. Worktree mode fails closed even if stale state carries
+          // originalRef fields.
+          if (shared.isLiveCheckoutDispatchRecord(item, config)) {
             try {
               require('./live-checkout').maybeRestoreLiveCheckoutFromRecord({
                 item,
+                config,
                 isTerminalFailure: !isSuccess,
                 resultLabel: result,
                 log: (lvl, msg) => e.log(lvl, msg),
@@ -1200,6 +1203,38 @@ const commands = {
       const timeout = config.engine?.shutdownTimeout || shared.ENGINE_DEFAULTS.shutdownTimeout;
       const deadline = Date.now() + timeout;
 
+      async function cancelTimedOutPooled(ids) {
+        const closing = [];
+        for (const id of ids) {
+          const procInfo = e.activeProcesses.get(id);
+          if (!procInfo?._pooled) continue;
+          try {
+            procInfo.proc.kill();
+            if (typeof procInfo.proc.waitForClose === 'function') {
+              closing.push(procInfo.proc.waitForClose());
+            }
+          } catch (err) {
+            e.log('warn', `Failed to cancel pooled dispatch ${id} during shutdown: ${err.message}`);
+          }
+        }
+        await Promise.allSettled(closing);
+
+        const stillActive = new Set((getDispatch().active || []).map(item => item.id));
+        for (const id of ids) {
+          e.activeProcesses.delete(id);
+          e.realActivityMap.delete(id);
+          if (!stillActive.has(id)) continue;
+          e.completeDispatch(
+            id,
+            DISPATCH_RESULT.ERROR,
+            'Pooled dispatch cancelled after graceful shutdown timeout',
+            '',
+            { failureClass: FAILURE_CLASS.TIMEOUT, retryable: true },
+          );
+        }
+        finishShutdown(`Shutdown timeout (${timeout / 1000}s) — cancelled ${ids.length} pooled agent(s) for retry.`, 1);
+      }
+
       const poll = setInterval(() => {
         pooledIds = getOutstandingPooledIds();
         if (pooledIds.length === 0 && agentWorkerPool.isDrained()) {
@@ -1209,24 +1244,10 @@ const commands = {
         }
         if (Date.now() >= deadline) {
           clearInterval(poll);
-          for (const id of pooledIds) {
-            const procInfo = e.activeProcesses.get(id);
-            if (procInfo?._pooled) {
-              try { procInfo.proc.kill(); } catch (err) {
-                e.log('warn', `Failed to cancel pooled dispatch ${id} during shutdown: ${err.message}`);
-              }
-              e.activeProcesses.delete(id);
-              e.realActivityMap.delete(id);
-            }
-            e.completeDispatch(
-              id,
-              DISPATCH_RESULT.ERROR,
-              'Pooled dispatch cancelled after graceful shutdown timeout',
-              '',
-              { failureClass: FAILURE_CLASS.TIMEOUT, retryable: true },
-            );
-          }
-          finishShutdown(`Shutdown timeout (${timeout / 1000}s) — cancelled ${pooledIds.length} pooled agent(s) for retry.`, 1);
+          void cancelTimedOutPooled(pooledIds).catch((err) => {
+            e.log('error', `Pooled shutdown cleanup failed: ${err.message}`);
+            finishShutdown(`Shutdown cleanup failed after timeout: ${err.message}`, 1);
+          });
         }
       }, 2000);
     }
@@ -2076,6 +2097,11 @@ const commands = {
       console.error('error: must supply either --body-file <path> or --body <text>');
       process.exit(2);
     }
+    const executionModel = resolveCommentExecutionModel({
+      dispatch: getDispatch(),
+      agentId,
+      workItemId,
+    });
 
     // ── Azure DevOps: <prNumber> --host ado --ado-org --ado-project --repo-id ──
     if (isAdo) {
@@ -2097,6 +2123,7 @@ const commands = {
       const adoComment = require('./ado-comment');
       adoComment.postAdoPrComment({
         orgBase, project, repositoryId, prNumber, body, agentId, kind, workItemId,
+        model: executionModel.model,
         resolved: flags.resolved === true,
       }).then((result) => {
         if (result && result.threadId) {
@@ -2135,7 +2162,7 @@ const commands = {
 
     try {
       const result = ghComment.postPrComment({
-        repo, prNumber, body, agentId, kind, workItemId,
+        repo, prNumber, body, agentId, kind, workItemId, model: executionModel.model,
       });
       if (result.output) console.log(result.output);
     } catch (e) {
@@ -2274,6 +2301,7 @@ module.exports = {
   _readDispatchPid: readDispatchPid,
   _normalizeSessionBranch: normalizeSessionBranch,
   _dispatchSessionBranch: dispatchSessionBranch,
+  _resolveCommentExecutionModel: resolveCommentExecutionModel, // exported for testing
   // W-mpcyvff6000pf828 (#2653) — heartbeat writer + factory exported for tests
   _writeHeartbeatNow: writeHeartbeatNow,
   _createHeartbeatInterval: createHeartbeatInterval,

package/engine/comment-format.js

@@ -48,14 +48,17 @@ function linkifyBrandTrailer(text) {
 // org/project/repoId).
 //
 // Marker format (single line, ASCII):
-//   <!-- minions:agent=<agentId> kind=<kind> wi=<workItemId> -->
+//   <!-- minions:agent=<agentId> kind=<kind> wi=<workItemId> model=<modelId> -->
 //
 // Validation (enforced before the marker is built):
 //   - agentId    /^[a-z][a-z0-9-]{0,30}$/
 //   - kind       /^[a-z][a-z0-9-]{0,30}$/
 //   - workItemId /^[A-Z]-[a-z0-9]+$/   (optional)
+//   - model       concrete runtime execution model (optional)
 //   - no field may contain `--` (would close the HTML comment early)
 
+const { normalizeExecutionModel } = require('./execution-model');
+
 const AGENT_ID_RE = /^[a-z][a-z0-9-]{0,30}$/;
 const KIND_RE = /^[a-z][a-z0-9-]{0,30}$/;
 const WORK_ITEM_ID_RE = /^[A-Z]-[a-z0-9]+$/;
@@ -63,7 +66,7 @@ const WORK_ITEM_ID_RE = /^[A-Z]-[a-z0-9]+$/;
 // Marker line (single-line HTML comment). Multiline flag so it matches at the
 // start of any line — required for round-trip detection of the builder output.
 const MINIONS_COMMENT_MARKER_RE =
-  /^<!--\s*minions:agent=([^\s]+)\s+kind=([^\s]+)(?:\s+wi=([^\s]+))?\s*-->/m;
+  /^<!--\s*minions:agent=([^\s]+)\s+kind=([^\s]+)(?:\s+wi=([^\s]+))?(?:\s+model=([^\s]+))?\s*-->/m;
 
 // Canonical-format sample marker for tests/fixtures that need a marked body but
 // don't care about the specific fields.
@@ -85,18 +88,44 @@ function _validateField(name, value, re) {
   }
 }
 
-function _validateMarkerInputs({ agentId, kind, workItemId }) {
+function _validateMarkerInputs({ agentId, kind, workItemId, model }) {
   _validateField('agentId', agentId, AGENT_ID_RE);
   _validateField('kind', kind, KIND_RE);
   if (workItemId !== undefined && workItemId !== null) {
     _validateField('workItemId', workItemId, WORK_ITEM_ID_RE);
   }
+  if (model !== undefined && model !== null && !normalizeExecutionModel(model)) {
+    throw new Error(`invalid model: ${JSON.stringify(model)}`);
+  }
+}
+
+function _encodeMarkerModel(model) {
+  const encoded = encodeURIComponent(model);
+  return encoded.includes('--') ? encoded.replace(/-/g, '%2D') : encoded;
 }
 
-function _buildMarker({ agentId, kind, workItemId }) {
-  _validateMarkerInputs({ agentId, kind, workItemId });
+function _buildMarker({ agentId, kind, workItemId, model }) {
+  _validateMarkerInputs({ agentId, kind, workItemId, model });
   const wi = (workItemId !== undefined && workItemId !== null) ? ` wi=${workItemId}` : '';
-  return `<!-- minions:agent=${agentId} kind=${kind}${wi} -->`;
+  const modelPart = model ? ` model=${_encodeMarkerModel(model)}` : '';
+  return `<!-- minions:agent=${agentId} kind=${kind}${wi}${modelPart} -->`;
+}
+
+const MODEL_SIGNOFF_RE =
+  /(\b(?:Review|Reviewed|Fixed|Verified|Rebased) by (?:Minions|\[Minions\]\([^)]+\)) \([^\r\n)]*? · )[^)\r\n]+(\))/g;
+
+function stampExecutionModel(text, model) {
+  const normalized = normalizeExecutionModel(model);
+  if (!normalized || typeof text !== 'string') return text;
+  return text.replace(MODEL_SIGNOFF_RE, (_match, prefix, suffix) => `${prefix}${normalized}${suffix}`);
+}
+
+function _stampLeadingMarkerModel(text, model) {
+  if (!model || typeof text !== 'string') return text;
+  return text.replace(MINIONS_COMMENT_MARKER_RE, (marker, agentId, kind, workItemId) => {
+    if (marker !== text.slice(0, marker.length)) return marker;
+    return _buildMarker({ agentId, kind, workItemId, model });
+  });
 }
 
 /**
@@ -106,41 +135,49 @@ function _buildMarker({ agentId, kind, workItemId }) {
  * Idempotency: if `body` already starts with a minions marker it is returned
  * with the brand transform applied but no second marker prepended.
  *
- * @param {{agentId:string, kind:string, workItemId?:string, body?:string}} args
+ * @param {{agentId:string, kind:string, workItemId?:string, model?:string, body?:string}} args
  * @returns {string} the final comment body
  */
-function buildMinionsCommentBody({ agentId, kind, workItemId, body }) {
+function buildMinionsCommentBody({ agentId, kind, workItemId, model, body }) {
   // Validate the inputs even when the body is pre-marked, so callers can't
   // silently bypass validation by pre-marking their body.
-  _validateMarkerInputs({ agentId, kind, workItemId });
+  _validateMarkerInputs({ agentId, kind, workItemId, model });
   let safeBody = body == null ? '' : String(body);
 
+  safeBody = stampExecutionModel(safeBody, model);
+
   // Brand-link safety net: deterministically hyperlink the first bare
   // "… by Minions" signature trailer (no-op when the agent already linked it).
   safeBody = linkifyBrandTrailer(safeBody);
 
-  if (_LEADING_MARKER_RE.test(safeBody)) return safeBody;
-  const marker = _buildMarker({ agentId, kind, workItemId });
+  if (_LEADING_MARKER_RE.test(safeBody)) return _stampLeadingMarkerModel(safeBody, model);
+  const marker = _buildMarker({ agentId, kind, workItemId, model });
   return `${marker}\n\n${safeBody}`;
 }
 
 /**
- * Inverse of the marker builder: parse `{agentId, kind, workItemId}` out of a
- * marked body, or null when no marker is present.
+ * Inverse of the marker builder: parse `{agentId, kind, workItemId, model?}`
+ * out of a marked body, or null when no marker is present.
  */
 function parseMinionsMarker(body) {
   if (typeof body !== 'string' || body.length === 0) return null;
   const m = body.match(MINIONS_COMMENT_MARKER_RE);
   if (!m) return null;
-  return {
+  const parsed = {
     agentId: m[1],
     kind: m[2],
     workItemId: m[3] === undefined ? undefined : m[3],
   };
+  if (m[4] !== undefined) {
+    try { parsed.model = decodeURIComponent(m[4]); }
+    catch { return null; }
+  }
+  return parsed;
 }
 
 module.exports = {
   linkifyBrandTrailer,
+  stampExecutionModel,
   MINIONS_BRAND_URL,
   // Neutral marker + body builder (consumed by gh-comment.js and ado-comment.js).
   buildMinionsCommentBody,

package/engine/create-pr-worktree.js

@@ -1,7 +1,7 @@
 /**
  * engine/create-pr-worktree.js — checkout-mode-aware Create-PR staging.
  *
- * Background (the bug this fixes): the CC "Create PR" flow has the LLM commit /
+ * Background (the bug this fixes): the CC "Create PR" flow used to have the LLM commit /
  * branch / push directly in the project's LIVE operator checkout
  * (`project.localPath`). For a `checkoutMode: "worktree"` project that is wrong —
  * a misstep by the LLM (committing before branching, freelancing `git pull`)
@@ -10,16 +10,13 @@
  *   - `live`     → operate in the live checkout (handled by the existing flow);
  *   - `worktree` → operate in an isolated git worktree, never the live checkout.
  *
- * This module implements the `worktree` path. `prepareCreatePrWorktree` moves the
- * uncommitted edits CC made in the live checkout into a fresh worktree (created
- * off the same base commit, on a new branch) and then restores the live checkout
- * clean — DETERMINISTICALLY, server-side, so nothing relies on the LLM running
- * git correctly. CC is then told to commit / push / open the PR inside the
- * returned worktree path, and to call `cleanupCreatePrWorktree` when done.
+ * This module implements the `worktree` path. `prepareCreatePrWorktree` copies
+ * pre-existing operator edits into a fresh worktree created from the configured
+ * main tip. The source checkout is never reset, cleaned, checked out, or deleted
+ * from; the operator remains the sole owner of that tree.
  *
- * Safety ordering: the worktree is populated and verified BEFORE the live
- * checkout is touched. If applying the diff fails, the worktree is removed and
- * the live checkout is left exactly as it was — the operator never loses work.
+ * If applying the diff fails, the worktree is removed and the source checkout is
+ * left exactly as it was.
  */
 
 const fs = require('fs');
@@ -29,16 +26,15 @@ const shared = require('./shared');
 const PATCH_APPLY_TIMEOUT_MS = 120000;
 
 /**
- * Move a worktree-mode project's uncommitted live-checkout changes into an
- * isolated worktree and restore the live checkout clean.
+ * Copy a worktree-mode project's uncommitted operator changes into an isolated
+ * worktree without modifying the source checkout.
  *
  * @returns {Promise<{ ok:true, worktreePath, branch, baseBranch, baseSha,
  *   trackedChanged:boolean, untrackedCount:number } | { ok:false, reason:string }>}
- * @throws on a git/fs failure AFTER which the live checkout is guaranteed
- *   untouched (the operator keeps their work).
+ * @throws on a git/fs failure; the source checkout remains untouched.
  */
 async function prepareCreatePrWorktree({
-  project, branch, minionsDir, engine, log = () => {}, _git, _fs,
+  project, projects, branch, minionsDir, engine, log = () => {}, _git, _fs,
 } = {}) {
   const git = _git || ((args, opts) => shared.shellSafeGit(args, opts));
   const fsm = _fs || fs;
@@ -49,12 +45,15 @@ async function prepareCreatePrWorktree({
   if (!localPath) {
     throw new Error('prepareCreatePrWorktree: project.localPath required');
   }
+  if (shared.resolveCheckoutMode(project, shared.WORK_TYPE.IMPLEMENT) !== shared.CHECKOUT_MODES.WORKTREE) {
+    throw new Error('prepareCreatePrWorktree: project must use checkoutMode "worktree"');
+  }
   const mainBranch = (project.mainBranch && String(project.mainBranch).trim()) || 'main';
 
-  // 1. Capture the uncommitted state from the live checkout.
-  const baseSha = (await git(['-C', localPath, 'rev-parse', 'HEAD'])).trim();
-  if (!/^[0-9a-f]{7,40}$/i.test(baseSha)) {
-    throw new Error(`prepareCreatePrWorktree: could not resolve HEAD in ${localPath} (got ${JSON.stringify(baseSha)})`);
+  // 1. Capture the uncommitted state from the protected operator checkout.
+  const sourceHeadSha = (await git(['-C', localPath, 'rev-parse', 'HEAD'])).trim();
+  if (!/^[0-9a-f]{7,40}$/i.test(sourceHeadSha)) {
+    throw new Error(`prepareCreatePrWorktree: could not resolve HEAD in ${localPath} (got ${JSON.stringify(sourceHeadSha)})`);
   }
   // `git diff HEAD --binary` captures staged + unstaged tracked changes
   // (including deletions and binary deltas) as a single patch.
@@ -70,9 +69,29 @@ async function prepareCreatePrWorktree({
     return { ok: false, reason: 'no-changes' };
   }
 
-  // 2. Create an isolated worktree off the SAME base commit the edits were made
-  //    against, on a NEW branch (so it never collides with `main` being checked
-  //    out in the live tree, and never commits onto a shared branch).
+  // 2. Resolve the configured main tip without changing the operator checkout.
+  // Prefer the fetched remote-tracking ref; local-only repos fall back to the
+  // local main branch.
+  try {
+    await git(['-C', localPath, 'fetch', 'origin', mainBranch], { timeout: 30000 });
+  } catch (e) {
+    log('warn', `[cc-create-pr] fetch origin ${mainBranch} failed; trying local ${mainBranch}: ${e.message}`);
+  }
+  let baseSha = '';
+  for (const ref of [`refs/remotes/origin/${mainBranch}`, `refs/heads/${mainBranch}`]) {
+    try {
+      baseSha = (await git(['-C', localPath, 'rev-parse', '--verify', ref])).trim();
+    } catch { /* try next base */ }
+    if (/^[0-9a-f]{7,40}$/i.test(baseSha)) break;
+    baseSha = '';
+  }
+  if (!baseSha) {
+    throw new Error(`prepareCreatePrWorktree: could not resolve origin/${mainBranch} or local ${mainBranch}`);
+  }
+
+  // 3. Create a fresh isolated branch from main, then apply only the captured
+  // uncommitted changes. Topic commits currently checked out by the operator
+  // never enter the PR.
   const uid = shared.uid();
   const sanitized = String(project.name || 'project').replace(/[^a-zA-Z0-9._-]/g, '-').slice(0, 40) || 'project';
   const requested = branch && String(branch).trim();
@@ -86,6 +105,7 @@ async function prepareCreatePrWorktree({
   const wtRel = (engine && engine.worktreeRoot) || shared.ENGINE_DEFAULTS.worktreeRoot;
   const worktreesBase = path.resolve(projectRoot, wtRel);
   const wtPath = path.join(worktreesBase, `cc-createpr-${sanitized}-${uid}`);
+  shared.assertWorktreeOutsideProjects(wtPath, Array.isArray(projects) ? projects : [project]);
   try { fsm.mkdirSync(worktreesBase, { recursive: true }); } catch { /* best-effort; worktree add will surface a real failure */ }
 
   await git(
@@ -94,8 +114,8 @@ async function prepareCreatePrWorktree({
   );
   try { shared.writeWorktreeOwnerMarker(wtPath, { source: 'cc-create-pr', project: project.name }); } catch { /* marker is best-effort */ }
 
-  // 3. Reproduce the live-checkout changes inside the worktree. If anything here
-  //    fails, tear the worktree down and leave the live checkout untouched.
+  // 4. Reproduce the operator-checkout changes inside the worktree. If anything
+  //    here fails, tear the worktree down and leave the source untouched.
   try {
     if (hasTracked) {
       const patchFile = path.join(wtPath, `.cc-createpr-${uid}.patch`);
@@ -111,64 +131,15 @@ async function prepareCreatePrWorktree({
     }
   } catch (e) {
     // Tear the worktree down via shared.removeWorktree (EPERM/EBUSY retry +
-    // escalation + real-repo refusal — CLAUDE.md footgun #6). The live checkout
-    // has NOT been touched yet at this point, so the operator keeps their work.
+    // escalation + real-repo refusal — CLAUDE.md footgun #6).
     try { shared.removeWorktree(wtPath, projectRoot, worktreesBase); } catch { /* leak rather than throw a second error */ }
     throw new Error(
       `prepareCreatePrWorktree: failed to stage changes into the worktree — ${e.message}. ` +
-      'The live checkout was left untouched.',
-    );
-  }
-
-  // 4. The worktree now holds the changes — restore the live checkout clean.
-  //    The captured edits are SAFE in the worktree (step 3 verified), so the
-  //    documented job here is to return the live checkout to a clean HEAD.
-  //    Use `git reset --hard HEAD` (NOT `git checkout -- .`): the old
-  //    working-tree-only revert left the STAGED INDEX intact, so any change CC
-  //    had `git add`-ed stayed staged → the live checkout was reported "restored"
-  //    while still dirty, wedging the next Create-PR / live dispatch (the
-  //    operator's "no recovery from dirty checkout"). `reset --hard` reverts
-  //    staged + unstaged tracked changes in one shot; untracked entries are
-  //    removed surgically below (only the ones we captured — never ignored or
-  //    pre-existing untracked files, which `git clean` would wrongly nuke).
-  //    This `reset --hard` is intentional and scoped to THIS Create-PR-worktree
-  //    staging flow whose explicit contract is to restore the live checkout
-  //    clean — it is NOT the live-checkout DISPATCH mode (which never resets).
-  const residualUntracked = [];
-  try {
-    await git(['-C', localPath, 'reset', '--hard', 'HEAD']);
-    for (const rel of untracked) {
-      const target = path.join(localPath, rel.replace(/\/$/, ''));
-      try {
-        // Retry transient Windows file locks (EBUSY/EPERM/ENOTEMPTY) before
-        // giving up — a single failed unlink is what left the tree dirty. A few
-        // quick retries ride out a transient AV/indexer lock without a long stall.
-        shared._retryFsOp(() => fsm.rmSync(target, { recursive: true, force: true }), `cc-create-pr rm ${rel}`, { attempts: 4, baseMs: 100 });
-      } catch (rmErr) {
-        residualUntracked.push(rel);
-        log('warn', `[cc-create-pr] could not remove untracked ${rel} from live checkout after retries: ${rmErr.message}`);
-      }
-    }
-  } catch (e) {
-    // shared.removeWorktree carries the EPERM/EBUSY retry + escalation +
-    // real-repo refusal (CLAUDE.md footgun #6 — don't hand-roll force-remove).
-    try { shared.removeWorktree(wtPath, projectRoot, worktreesBase); } catch { /* leak rather than double-throw */ }
-    throw new Error(
-      `prepareCreatePrWorktree: failed to restore live checkout — ${e.message}. ` +
-      `Worktree at ${wtPath} may need manual cleanup.`,
+      'The operator checkout was left untouched.',
     );
   }
 
-  // If untracked removal could not fully clean the live tree, surface it in the
-  // return (liveTreeDirty) instead of silently reporting success — the caller
-  // can warn CC / the operator rather than letting the residue wedge the next
-  // dispatch with a phantom "dirty" refusal.
-  const liveTreeDirty = residualUntracked.length > 0;
-  if (liveTreeDirty) {
-    log('warn', `[cc-create-pr] live checkout ${localPath} left with ${residualUntracked.length} residual untracked path(s) after staging; surfacing liveTreeDirty`);
-  } else {
-    log('info', `[cc-create-pr] staged ${project.name} changes into isolated worktree ${wtPath} on branch ${branchName} (live checkout restored)`);
-  }
+  log('info', `[cc-create-pr] copied ${project.name} changes into isolated worktree ${wtPath} on branch ${branchName}; operator checkout preserved`);
   return {
     ok: true,
     worktreePath: wtPath,
@@ -177,8 +148,7 @@ async function prepareCreatePrWorktree({
     baseSha,
     trackedChanged: hasTracked,
     untrackedCount: untracked.length,
-    liveTreeDirty,
-    residualUntracked,
+    sourceCheckoutPreserved: true,
   };
 }
 
@@ -187,7 +157,7 @@ async function prepareCreatePrWorktree({
  * touch a path that doesn't carry the minions ownership marker (so a bad/forged
  * path can never delete an arbitrary directory).
  */
-async function cleanupCreatePrWorktree({ worktreePath, project, _git, _fs } = {}) {
+async function cleanupCreatePrWorktree({ worktreePath, project, projects, _git, _fs } = {}) {
   const git = _git || ((args, opts) => shared.shellSafeGit(args, opts));
   const fsm = _fs || fs;
   if (!worktreePath || typeof worktreePath !== 'string') {
@@ -200,6 +170,14 @@ async function cleanupCreatePrWorktree({ worktreePath, project, _git, _fs } = {}
   if (!shared.hasWorktreeOwnerMarker(worktreePath)) {
     return { ok: false, reason: 'not-owned' };
   }
+  try {
+    shared.assertWorktreeOutsideProjects(
+      worktreePath,
+      Array.isArray(projects) ? projects : (project ? [project] : shared.getProjects()),
+    );
+  } catch {
+    return { ok: false, reason: 'protected-project-overlap' };
+  }
   const fromDir = (project && project.localPath) || worktreePath;
   try {
     await git(['-C', fromDir, 'worktree', 'remove', '--force', worktreePath]);

package/engine/dispatch.js

@@ -978,7 +978,12 @@ function markCompletedSourceWorkItem(item) {
 // ─── Complete Dispatch ───────────────────────────────────────────────────────
 
 function completeDispatch(id, result = DISPATCH_RESULT.SUCCESS, reason = '', resultSummary = '', opts = {}) {
-  const { processWorkItemFailure = true, processWorkItemSuccess = false, failureClass } = opts;
+  const {
+    processWorkItemFailure = true,
+    processWorkItemSuccess = false,
+    countAgentRetryFailure = true,
+    failureClass,
+  } = opts;
   const agentRetryable = normalizeRetryableDecision(opts.agentRetryable ?? opts.retryable);
   let item = null;
   let completedSourceWorkItem = false;
@@ -1185,7 +1190,7 @@ function completeDispatch(id, result = DISPATCH_RESULT.SUCCESS, reason = '', res
                   // agent hits the threshold. Skip when no agent is resolvable
                   // (anonymous failures shouldn't corrupt the map shape).
                   const failedAgent = item.agent || wi.dispatched_to;
-                  if (failedAgent) shared.bumpAgentRetryCount(wi, failedAgent);
+                  if (failedAgent && countAgentRetryFailure) shared.bumpAgentRetryCount(wi, failedAgent);
                   delete wi.failReason;
                   delete wi.failedAt;
                   delete wi.dispatched_at;

package/engine/execution-model.js

@@ -0,0 +1,68 @@
+/**
+ * Runtime-model evidence shared by dispatch, PR-comment, and review persistence.
+ *
+ * Priority is deliberate: runtime completion output is authoritative, an
+ * earlier stream/session capture is next, and the requested model is only a
+ * fallback when Minions explicitly sent one to the runtime. No catalog-based
+ * default inference belongs here.
+ */
+
+const UNKNOWN_MODEL = 'unknown';
+const MODEL_ID_RE = /^[A-Za-z0-9][A-Za-z0-9._:/-]{0,127}$/;
+
+function normalizeExecutionModel(value) {
+  if (typeof value !== 'string') return null;
+  const model = value.trim();
+  return MODEL_ID_RE.test(model) ? model : null;
+}
+
+function resolveExecutionModel({
+  reportedModel,
+  capturedModel,
+  requestedModel,
+} = {}) {
+  for (const [source, value] of [
+    ['reported', reportedModel],
+    ['captured', capturedModel],
+    ['requested', requestedModel],
+  ]) {
+    const model = normalizeExecutionModel(value);
+    if (model) return { model, source };
+  }
+  return { model: UNKNOWN_MODEL, source: 'unknown' };
+}
+
+function _dispatchWorkItemId(item) {
+  return item?.meta?.item?.id
+    || item?.meta?.workItemId
+    || item?.workItemId
+    || null;
+}
+
+function resolveCommentExecutionModel({
+  dispatch,
+  agentId,
+  workItemId,
+} = {}) {
+  const active = Array.isArray(dispatch?.active) ? dispatch.active : [];
+  const candidates = active.filter((item) => {
+    if (String(item?.agent || '').toLowerCase() !== String(agentId || '').toLowerCase()) return false;
+    if (!workItemId) return true;
+    return item.id === workItemId || _dispatchWorkItemId(item) === workItemId;
+  });
+  candidates.sort((a, b) => String(b.started_at || '').localeCompare(String(a.started_at || '')));
+  const item = candidates[0] || null;
+  if (!item) return { model: null, source: 'none' };
+  return resolveExecutionModel({
+    capturedModel: item?.executionModel,
+    requestedModel: item?.requestedModel,
+  });
+}
+
+module.exports = {
+  UNKNOWN_MODEL,
+  MODEL_ID_RE,
+  normalizeExecutionModel,
+  resolveExecutionModel,
+  resolveCommentExecutionModel,
+};

package/engine/gh-comment.js

@@ -4,7 +4,7 @@
  * minions-authored PR comments by structure rather than by body shape.
  *
  * Marker format (single line, ASCII):
- *   <!-- minions:agent=<agentId> kind=<kind> wi=<workItemId> -->
+ *   <!-- minions:agent=<agentId> kind=<kind> wi=<workItemId> model=<modelId> -->
  *
  * Followed by `\n\n` and then the caller-provided body. `wi=` is omitted when
  * no workItemId is supplied. The marker is intentionally minimal so it round-
@@ -14,6 +14,7 @@
  *   - agentId    /^[a-z][a-z0-9-]{0,30}$/  (lowercase, hyphenated, ≤31 chars)
  *   - kind       /^[a-z][a-z0-9-]{0,30}$/  (same shape — categorical tag)
  *   - workItemId /^[A-Z]-[a-z0-9]+$/       (e.g. W-mp3bp0ha000997ab, P-d5a8c9b6)
+ *   - model      concrete runtime model, when active-dispatch evidence exists
  *   - no field may contain `--` (would close the HTML comment early)
  *   - no field may contain `=` `<` `>` `\n` `"` `'` `` ` ``  ` `  (whitespace)
  *
@@ -153,13 +154,14 @@ function postPrComment({
   agentId,
   kind,
   workItemId,
+  model,
   timeoutMs = 30000,
   execFileSync = _execFileSync,
   resolveTokenForSlug,
 } = {}) {
   _validateRepo(repo);
   _validatePrNumber(prNumber);
-  const finalBody = buildMinionsCommentBody({ agentId, kind, workItemId, body });
+  const finalBody = buildMinionsCommentBody({ agentId, kind, workItemId, model, body });
   const file = _writeTempBodyFile(finalBody);
   const env = _resolveTokenEnvForRepo(repo, resolveTokenForSlug);
   try {
@@ -182,13 +184,14 @@ function postPrReviewComment({
   agentId,
   kind,
   workItemId,
+  model,
   timeoutMs = 30000,
   execFileSync = _execFileSync,
   resolveTokenForSlug,
 } = {}) {
   _validateRepo(repo);
   _validatePrNumber(prNumber);
-  const finalBody = buildMinionsCommentBody({ agentId, kind, workItemId, body });
+  const finalBody = buildMinionsCommentBody({ agentId, kind, workItemId, model, body });
   const file = _writeTempBodyFile(finalBody);
   const env = _resolveTokenEnvForRepo(repo, resolveTokenForSlug);
   try {