@yemi33/minions 0.1.2401 → 0.1.2403

package/dashboard/js/refresh.js

@@ -79,8 +79,9 @@ const _pageCounters = {
     return sch.length + '|' + sch.map(function(s) { return (s.id || '') + ':' + (s.enabled === false ? '0' : '1') + ':' + (s.cron || ''); }).sort().join(',');
   },
   tools: function(d) {
-    // skills + mcpServers are on /api/status directly, no cache to wait for.
-    return (d.skills || []).length + '|' + (d.mcpServers || []).length;
+    const tools = window._lastToolsInventory;
+    if (!tools) return null;
+    return (tools.skills || []).length + '|' + (tools.mcpServers || []).length;
   },
   engine: function(d) {
     const dispatch = window._lastDispatch;
@@ -447,6 +448,22 @@ function _refreshSidebarCounterSummaries() {
   // entry read it — drop the dead endpoint + fetch. (Review finding #9.)
 }
 
+function _renderToolsInventory(tools) {
+  if (!tools || !Array.isArray(tools.skills)
+      || !Array.isArray(tools.commands)
+      || !Array.isArray(tools.mcpServers)) return false;
+  if (_changed('skills', tools.skills)) {
+    _safeRender('skills', function() { renderSkills(tools.skills); });
+  }
+  if (_changed('commands', tools.commands)) {
+    _safeRender('commands', function() { renderCommands(tools.commands); });
+  }
+  if (_changed('mcpServers', tools.mcpServers)) {
+    _safeRender('mcpServers', function() { renderMcpServers(tools.mcpServers); });
+  }
+  return true;
+}
+
 function _processStatusUpdate(data, opts) {
   opts = opts || {};
   // Kick off the dedicated-endpoint summary refreshes (issue #2949). They
@@ -890,12 +907,25 @@ function _processStatusUpdate(data, opts) {
         }
       });
   });
-  _changed('skills', data.skills);
-  _safeRender('skills', function() { renderSkills(data.skills || []); });
-  _changed('commands', data.commands);
-  _safeRender('commands', function() { renderCommands(data.commands || []); });
-  _changed('mcpServers', data.mcpServers);
-  _safeRender('mcpServers', function() { renderMcpServers(data.mcpServers || []); });
+  // Skills/commands/MCP discovery runs in a child process behind /api/tools.
+  // It is only consumed by the Tools page, so every other page skips the
+  // request and /api/status stays a small, non-blocking health envelope.
+  _safeRender('toolsInventory', function() {
+    if (typeof currentPage !== 'undefined' && currentPage !== 'tools') return;
+    const seq = (window._refreshSeq = (window._refreshSeq || 0) + 1);
+    window._lastRequestedSeq = window._lastRequestedSeq || {};
+    window._lastRequestedSeq.toolsInventory = seq;
+    _condFetchJson('/api/tools')
+      .then(function(resp) {
+        if (seq < (window._lastRequestedSeq.toolsInventory || 0) || resp.notModified) return;
+        const tools = resp.data;
+        if (_renderToolsInventory(tools)) window._lastToolsInventory = tools;
+      })
+      .catch(function() {
+        const tools = window._lastToolsInventory;
+        if (tools) _renderToolsInventory(tools);
+      });
+  });
   // Harness propagation diagnostic comes from /api/harness/diagnostics.
   // HEAVY ENDPOINT: the handler runs a synchronous `git status` per linked
   // project (execFileSync, 10s timeout) which hard-blocks the dashboard event

package/dashboard.js

@@ -22,9 +22,11 @@ require('./engine/stdio-timestamps').installIfNotInstalled();
 
 const http = require('http');
 const zlib = require('zlib');
+const crypto = require('crypto');
 const fs = require('fs');
 const path = require('path');
 const v8 = require('v8');
+const { execFile } = require('child_process');
 const llm = require('./engine/llm');
 const { resolveRuntime, shouldSuppressPostMutationError } = require('./engine/runtimes');
 
@@ -69,11 +71,12 @@ const ccWorkerPool = require('./engine/cc-worker-pool');
 const diagnosticsMemory = require('./engine/diagnostics-memory');
 const memoryStore = require('./engine/memory-store');
 const smallStateStore = require('./engine/small-state-store');
+const toolsInventory = require('./engine/tools-inventory');
 const os = require('os');
 
 const { safeRead, safeReadOrNull, safeReadDir, safeWrite, safeJson, safeJsonObj, safeJsonArr, safeJsonNoRestore, safeUnlink, mutateJsonFileLocked, mutateTextFileLocked, mutateControl, mutateCooldowns, mutateWorkItems, getProjects: _getProjects, DONE_STATUSES, WI_STATUS, WORK_TYPE, WORKTREE_REQUIRING_TYPES, reopenWorkItem } = shared;
 const { getAgents, getAgentDetail, getPrdInfo, getWorkItems, getDispatchQueue,
-  getSkills, getCommands, getInbox, getNotesWithMeta, getPullRequests,
+  getInbox, getNotesWithMeta, getPullRequests,
   getEngineLog, getMetrics, getKnowledgeBaseEntries, getKnowledgeBaseEntriesSnapshot, getProjectGitStatus, timeSince,
   MINIONS_DIR, AGENTS_DIR, ENGINE_DIR, INBOX_DIR, PRD_DIR } = queries;
 
@@ -230,16 +233,31 @@ function _resetHeapSnapshotRateLimitForTesting() {
   _heapSnapshotLastCapturedAt = 0;
 }
 
+const _initializedProjectStateKeys = new Set();
+
 function ensureConfiguredProjectStateFiles() {
+  const configuredKeys = new Set();
   for (const p of PROJECTS) {
     const root = p.localPath ? path.resolve(p.localPath) : null;
+    const key = `${String(p.name || '').toLowerCase()}\0${shared._normalizeWorktreePath(root || '')}`;
+    configuredKeys.add(key);
+    if (_initializedProjectStateKeys.has(key)) continue;
     if (!root || !fs.existsSync(root)) continue;
     try {
       shared.initializeProjectState(p);
+      _initializedProjectStateKeys.add(key);
     } catch (e) {
       console.warn(`[dashboard] project state setup failed for "${p.name}": ${e.message}`);
     }
   }
+
+  for (const key of _initializedProjectStateKeys) {
+    if (!configuredKeys.has(key)) _initializedProjectStateKeys.delete(key);
+  }
+}
+
+function _resetInitializedProjectStatesForTesting() {
+  _initializedProjectStateKeys.clear();
 }
 
 function reloadConfig() {
@@ -2308,74 +2326,8 @@ function _parseCopilotMcpListJson(raw) {
   } catch { return []; }
 }
 
-// Read Claude's user-scope MCP servers from `~/.claude.json` directly.
-// Shelling out to `claude mcp list` is unreliable from the dashboard daemon —
-// the CLI's MCP health probes block on a TTY check when the parent has no
-// console (bin/minions.js launches the dashboard with windowsHide:true), and
-// neither exec() nor spawn(..., {detached:true}) reliably sidesteps it.
-// Config-file reads are zero-spawn, instant, and the file is the authoritative
-// source for which servers are registered.
-function _readClaudeUserMcpServers() {
-  try {
-    const data = safeJsonObj(path.join(os.homedir(), '.claude.json'));
-    const servers = data?.mcpServers || {};
-    return Object.entries(servers).map(([name, cfg]) => ({
-      name,
-      source: 'Claude user',
-      command: cfg.command || cfg.url || '',
-      args: Array.isArray(cfg.args) ? cfg.args.join(' ') : (cfg.args || ''),
-    }));
-  } catch { return []; }
-}
-
-// Copilot stores its MCP config at `~/.copilot/mcp-config.json` (may have a
-// UTF-8 BOM — Windows tooling tends to write one).
-function _readCopilotUserMcpServers() {
-  try {
-    const configPath = path.join(os.homedir(), '.copilot', 'mcp-config.json');
-    if (!fs.existsSync(configPath)) return [];
-    let raw = fs.readFileSync(configPath, 'utf8');
-    if (raw.charCodeAt(0) === 0xFEFF) raw = raw.slice(1);
-    const data = JSON.parse(raw);
-    const servers = data?.mcpServers || {};
-    return Object.entries(servers).map(([name, cfg]) => ({
-      name,
-      source: 'Copilot',
-      command: cfg.command || cfg.url || '',
-      args: Array.isArray(cfg.args) ? cfg.args.join(' ') : (cfg.args || ''),
-    }));
-  } catch { return []; }
-}
-
-function _readWorkspaceMcpServers(projects) {
-  const out = [];
-  for (const p of (projects || [])) {
-    if (!p?.localPath) continue;
-    const data = safeJsonObj(path.join(p.localPath, '.mcp.json'));
-    const servers = data.mcpServers || {};
-    for (const [name, cfg] of Object.entries(servers)) {
-      out.push({
-        name,
-        source: `Workspace: ${p.name}`,
-        command: cfg.command || cfg.url || '',
-        args: Array.isArray(cfg.args) ? cfg.args.join(' ') : (cfg.args || ''),
-      });
-    }
-  }
-  return out;
-}
-
-function _dedupeMcpServers(entries) {
-  const seen = new Set();
-  const out = [];
-  for (const e of entries) {
-    const key = `${e.source}::${e.name}`;
-    if (seen.has(key)) continue;
-    seen.add(key);
-    out.push(e);
-  }
-  return out;
-}
+const _readWorkspaceMcpServers = toolsInventory.readWorkspaceMcpServers;
+const _dedupeMcpServers = toolsInventory.dedupeMcpServers;
 
 function getMcpServers() {
   const now = Date.now();
@@ -2383,12 +2335,7 @@ function getMcpServers() {
     return _mcpServersCache;
   }
   try {
-    const entries = [
-      ..._readClaudeUserMcpServers(),
-      ..._readCopilotUserMcpServers(),
-      ..._readWorkspaceMcpServers(PROJECTS),
-    ];
-    _mcpServersCache = _dedupeMcpServers(entries);
+    _mcpServersCache = toolsInventory.getMcpServers(PROJECTS);
   } catch (e) {
     console.error('[mcp-discovery] refresh failed:', e.message?.split('\n')?.[0]);
     if (!_mcpServersCache) _mcpServersCache = [];
@@ -2397,6 +2344,135 @@ function getMcpServers() {
   return _mcpServersCache;
 }
 
+const TOOLS_INVENTORY_CACHE_TTL_MS = 30000;
+const TOOLS_INVENTORY_CHILD_TIMEOUT_MS = 30000;
+const TOOLS_INVENTORY_CHILD_WATCHDOG_MS = 35000;
+const TOOLS_INVENTORY_MAX_BYTES = 4 * 1024 * 1024;
+let _toolsInventoryCache = null;
+let _toolsInventoryCacheJson = null;
+let _toolsInventoryCacheEtag = null;
+let _toolsInventoryCacheTs = 0;
+let _toolsInventoryRefreshPromise = null;
+let _toolsInventoryChild = null;
+let _toolsInventoryScanner = _scanToolsInventoryInChild;
+
+function _validateToolsInventoryPayload(payload) {
+  if (!payload || typeof payload !== 'object'
+      || !Array.isArray(payload.skills)
+      || !Array.isArray(payload.commands)
+      || !Array.isArray(payload.mcpServers)) {
+    throw new Error('tools inventory child returned an invalid payload');
+  }
+  return {
+    skills: payload.skills,
+    commands: payload.commands,
+    mcpServers: payload.mcpServers,
+  };
+}
+
+function _scanToolsInventoryInChild() {
+  const childPath = path.join(__dirname, 'engine', 'tools-inventory.js');
+  return new Promise((resolve, reject) => {
+    let settled = false;
+    let watchdog = null;
+    const child = execFile(process.execPath, [childPath], {
+      cwd: MINIONS_DIR,
+      env: { ...process.env, MINIONS_HOME: MINIONS_DIR },
+      encoding: 'utf8',
+      maxBuffer: TOOLS_INVENTORY_MAX_BYTES,
+      timeout: TOOLS_INVENTORY_CHILD_TIMEOUT_MS,
+      windowsHide: true,
+    }, (error, stdout, stderr) => {
+      if (settled) return;
+      settled = true;
+      if (watchdog) clearTimeout(watchdog);
+      if (_toolsInventoryChild === child) _toolsInventoryChild = null;
+      if (error) {
+        const detail = String(stderr || error.message || '').trim().slice(0, 500);
+        reject(new Error(`tools inventory scan failed${detail ? `: ${detail}` : ''}`));
+        return;
+      }
+      try {
+        resolve(_validateToolsInventoryPayload(JSON.parse(stdout)));
+      } catch (parseError) {
+        reject(new Error(`tools inventory scan returned invalid JSON: ${parseError.message}`));
+      }
+    });
+    _toolsInventoryChild = child;
+    watchdog = setTimeout(() => {
+      if (settled) return;
+      settled = true;
+      if (_toolsInventoryChild === child) _toolsInventoryChild = null;
+      try { shared.killImmediate(child); } catch { /* child may already be gone */ }
+      reject(new Error(`tools inventory scan exceeded ${TOOLS_INVENTORY_CHILD_WATCHDOG_MS}ms watchdog`));
+    }, TOOLS_INVENTORY_CHILD_WATCHDOG_MS);
+    watchdog.unref();
+  });
+}
+
+function _terminateToolsInventoryChild() {
+  const child = _toolsInventoryChild;
+  _toolsInventoryChild = null;
+  if (!child) return;
+  try { shared.killImmediate(child); } catch { /* child may already be gone */ }
+}
+
+function _refreshToolsInventory() {
+  const now = Date.now();
+  if (_toolsInventoryCache && now - _toolsInventoryCacheTs < TOOLS_INVENTORY_CACHE_TTL_MS) {
+    return Promise.resolve(_toolsInventoryCache);
+  }
+  if (_toolsInventoryRefreshPromise) return _toolsInventoryRefreshPromise;
+
+  _toolsInventoryRefreshPromise = Promise.resolve()
+    .then(() => _toolsInventoryScanner())
+    .then(payload => {
+      const next = _validateToolsInventoryPayload(payload);
+      const json = JSON.stringify(next);
+      _toolsInventoryCache = next;
+      _toolsInventoryCacheJson = json;
+      _toolsInventoryCacheEtag = `"tools-${crypto.createHash('sha256').update(json).digest('hex')}"`;
+      _toolsInventoryCacheTs = Date.now();
+      return next;
+    })
+    .finally(() => {
+      _toolsInventoryRefreshPromise = null;
+    });
+  return _toolsInventoryRefreshPromise;
+}
+
+async function handleToolsInventory(req, res) {
+  try {
+    await _refreshToolsInventory();
+    res.setHeader('ETag', _toolsInventoryCacheEtag);
+    res.setHeader('Cache-Control', 'private, max-age=0, must-revalidate');
+    if (_ifNoneMatchHasEtag(req?.headers?.['if-none-match'], _toolsInventoryCacheEtag)) {
+      res.statusCode = 304;
+      res.end();
+      return;
+    }
+    res.statusCode = 200;
+    res.setHeader('Content-Type', 'application/json; charset=utf-8');
+    res.end(_toolsInventoryCacheJson);
+  } catch (error) {
+    jsonReply(res, 503, { error: error.message }, req);
+  }
+}
+
+function _setToolsInventoryScannerForTesting(scanner) {
+  _toolsInventoryScanner = typeof scanner === 'function' ? scanner : _scanToolsInventoryInChild;
+}
+
+function _resetToolsInventoryCacheForTesting() {
+  _terminateToolsInventoryChild();
+  _toolsInventoryCache = null;
+  _toolsInventoryCacheJson = null;
+  _toolsInventoryCacheEtag = null;
+  _toolsInventoryCacheTs = 0;
+  _toolsInventoryRefreshPromise = null;
+  _toolsInventoryScanner = _scanToolsInventoryInChild;
+}
+
 function parsePinnedEntries(content) {
   if (!content) return [];
   const entries = [];
@@ -2492,9 +2568,9 @@ function _ifNoneMatchHasEtag(headerValue, currentEtag) {
 // We union them here. Adding a new tracked file means adding ONE line to
 // the appropriate list in queries.js — the dashboard side stays a thin
 // delegate that doesn't need to know about per-source semantics anymore.
-function _mtimeTrackedFiles() {
+async function _mtimeTrackedFiles() {
   const fast = queries.getStatusFastStateMtimePaths(CONFIG);
-  const slow = queries.getStatusSlowStateMtimePaths(CONFIG);
+  const slow = await queries.getStatusSlowStateMtimePathsAsync(CONFIG);
   // Dedup with a Set — many paths (per-project work-items, git refs) appear
   // in both registries since both fast (workItems slice) and slow (PRD
   // progress derived from same data) read them.
@@ -2519,37 +2595,68 @@ function _getCurrentEventVersion() {
   }
 }
 
-// Stat a tracked path with transient-error tolerance. ENOENT (file/dir doesn't
-// exist) is normal — fresh installs, deleted projects, empty PRD dirs all hit
-// this — and maps to 0 so the entry just doesn't bust the cache. EBUSY /
-// EACCES / EPERM are transient on Windows (OneDrive sync, antivirus scan,
-// file replication service); falling through to 0 would produce oscillating
-// mtimes (real, then 0, then real again) that look like a real change on
-// every other poll. Preserving the previous successful mtime on those errors
-// keeps the cache stable across short lock windows.
-function _statMtimeMs(fp, prevSnapshot) {
+const STATUS_MTIME_REFRESH_TTL_MS = 1000;
+let _currentMtimes = {};
+let _currentMtimesTs = 0;
+let _mtimeRefreshPromise = null;
+
+// Async transient-tolerant equivalent of the former statSync hot path. ENOENT
+// maps to 0; lock/access errors preserve the prior value so antivirus or a
+// temporarily unavailable project root cannot oscillate the cache.
+async function _statMtimeMs(fp, prevSnapshot) {
   try {
-    return fs.statSync(fp).mtimeMs;
+    return (await fs.promises.stat(fp)).mtimeMs;
   } catch (e) {
-    if (e && e.code === 'ENOENT') return 0;
+    if (e && (e.code === 'ENOENT' || e.code === 'ENOTDIR')) return 0;
     return prevSnapshot && (fp in prevSnapshot) ? prevSnapshot[fp] : 0;
   }
 }
 
+async function _scanStatusMtimes(paths, previous) {
+  const entries = await Promise.all(paths.map(async fp => [
+    fp,
+    await _statMtimeMs(fp, previous),
+  ]));
+  return Object.fromEntries(entries);
+}
+
+function _refreshStatusMtimes() {
+  if (_mtimeRefreshPromise) return _mtimeRefreshPromise;
+  const previous = _currentMtimes;
+  const hadSnapshot = _currentMtimesTs > 0;
+  _mtimeRefreshPromise = _mtimeTrackedFiles()
+    .then(paths => _scanStatusMtimes(paths, previous))
+    .then(next => {
+      const changed = hadSnapshot && _mtimesChanged(previous, next);
+      _currentMtimes = next;
+      _currentMtimesTs = Date.now();
+      if (changed && (_statusCache || _statusRebuildPromise)) invalidateStatusCache();
+      return next;
+    })
+    .finally(() => {
+      _mtimeRefreshPromise = null;
+    });
+  return _mtimeRefreshPromise;
+}
+
 function _getMtimes() {
-  const result = {};
-  for (const fp of _mtimeTrackedFiles()) {
-    result[fp] = _statMtimeMs(fp, _lastMtimes);
+  if (!_currentMtimesTs || Date.now() - _currentMtimesTs >= STATUS_MTIME_REFRESH_TTL_MS) {
+    _refreshStatusMtimes().catch(error => {
+      console.warn(`[dashboard] status mtime refresh failed: ${error.message}`);
+    });
   }
-  return result;
+  return _currentMtimes;
 }
 
-// Reset per-source caches whose TTL would otherwise survive an mtime-triggered
-// status rebuild and serve stale data.
+function _resetStatusMtimeCacheForTesting() {
+  _currentMtimes = {};
+  _currentMtimesTs = 0;
+  _mtimeRefreshPromise = null;
+}
+
+// Version data remains in /api/status and must reflect package/git mtime
+// changes. Tools inventory has its own child-process cache and endpoint.
 function _invalidateInnerCachesForRebuild() {
-  try { queries.invalidateSkillsCache(); } catch { /* optional */ }
-  _mcpServersCache = null;
-  _mcpServersCacheTs = 0;
   _diskVersionCache = null;
   _diskVersionCacheTs = 0;
 }
@@ -2588,10 +2695,9 @@ function invalidateStatusCache(_opts) {
   _statusPushTimer = setTimeout(() => {
     _statusPushTimer = null;
     if (_statusStreamClients.size === 0) return;
-    const data = getStatusJson();
-    for (const res of _statusStreamClients) {
-      try { res.write('data: ' + data + '\n\n'); } catch { _removeSseClient(_statusStreamClients, res); }
-    }
+    _pushStatusToSseClients(true).catch(error => {
+      console.warn(`[dashboard] status SSE push failed: ${error.message}`);
+    });
   }, 500);
 }
 
@@ -2649,12 +2755,10 @@ function _buildStatusSlowState() {
   // /api/schedules, pipelines → /api/pipelines, pinned → /api/pinned.
   // What's left here is genuine "shape of the install" state that has no
   // staleness problem: projects + git status (server-only compute), runtime
-  // capability roll-ups (skills + mcpServers), config-derived autoMode +
-  // initialized + installId, and the version banner.
+  // config-derived autoMode + initialized + installId, and the version banner.
+  // Skills, commands, and MCP servers live on /api/tools because their
+  // filesystem discovery runs in a child process.
   return {
-    skills: getSkills(),
-    commands: getCommands(CONFIG),
-    mcpServers: getMcpServers(),
     projects: PROJECTS.map(p => {
       const status = getProjectGitStatus(p.localPath, p.mainBranch);
       const mainBranch = p.mainBranch || null;
@@ -2831,6 +2935,10 @@ function refreshStatusAsync() {
   if (_statusRebuildPromise) return _statusRebuildPromise;
 
   _statusRebuildPromise = (async () => {
+    // A cache hit can otherwise complete synchronously before the assignment
+    // above stores the Promise, so the finally block clears null and the outer
+    // assignment then resurrects an already-resolved single-flight forever.
+    await Promise.resolve();
     const profile = _statusTimingActive();
     const tOverall = profile ? process.hrtime.bigint() : null;
     let fastBuildMs = 0;
@@ -2914,6 +3022,18 @@ function refreshStatusAsync() {
   return _statusRebuildPromise;
 }
 
+async function _ensureStatusCache() {
+  if (_statusCache) return _statusCache;
+  // A request can inherit an older single-flight rebuild and then race both a
+  // worktree-count and mtime refresh. Allow several cooperative retries rather
+  // than falling back to the synchronous builder or returning a transient 500.
+  for (let attempt = 0; attempt < 5 && !_statusCache; attempt++) {
+    await refreshStatusAsync();
+  }
+  if (!_statusCache) throw new Error('status cache invalidated during rebuild; retry');
+  return _statusCache;
+}
+
 // Test seams (W-mpehsyhv0017085a) — exported via module.exports so the unit
 // stress test can drive the rebuild deterministically without standing up an
 // http server. None of these are referenced by production code paths.
@@ -2935,9 +3055,9 @@ function _resetStatusCacheForTesting() {
   _lastEventVersion = -1;
 }
 
-/** Return cached JSON string of status — single stringify, reused by SSE and /api/status */
+/** Serialize the current cache once. Callers must refresh asynchronously first. */
 function getStatusJson() {
-  getStatus(); // ensure _statusCache is fresh
+  if (!_statusCache) throw new Error('status cache is not ready');
   if (!_statusCacheJson) {
     const profile = _statusTimingActive();
     const tStringify = profile ? process.hrtime.bigint() : null;
@@ -3361,17 +3481,9 @@ async function _handleStatusRequest(req, res) {
     if (_statusCache) {
       Promise.resolve().then(refreshStatusAsync).catch(() => { /* next poll + SSE push retry */ });
     } else {
-      // Cold start or post-hard-invalidation: nothing to serve → await one
-      // rebuild. refreshStatusAsync yields the event loop mid-rebuild so CC
-      // SSE heartbeats keep flowing during a slow build.
-      try { await refreshStatusAsync(); } catch { /* fall through — getStatusJson will sync-rebuild */ }
-      // Race-guard fallback: if refresh discarded its result because
-      // invalidateStatusCache() fired mid-rebuild, _statusCache is still null.
-      // Trigger a synchronous rebuild here so the ETag we compute reflects
-      // freshly-built post-invalidate state, not the stale pre-invalidate one.
-      if (!_statusCache) {
-        try { getStatus(); } catch { /* getStatusJson below will retry */ }
-      }
+      // Cold start or post-hard-invalidation: retry an invalidation-raced
+      // rebuild asynchronously. Never fall back to the synchronous builder.
+      await _ensureStatusCache();
     }
 
     // ETag = monotonic cache version. Bumped on every successful rebuild and
@@ -3405,15 +3517,24 @@ async function _handleStatusRequest(req, res) {
   }
 }
 
-// Periodic push for engine-driven SQL state changes that bypass invalidateStatusCache.
-setInterval(() => {
+async function _pushStatusToSseClients(force = false) {
   if (_statusStreamClients.size === 0) return;
+  await refreshStatusAsync();
+  await _ensureStatusCache();
   const data = getStatusJson();
-  if (data === _lastStatusPushRef) return; // O(1) reference comparison — new string ref means content changed
+  if (!force && data === _lastStatusPushRef) return;
   _lastStatusPushRef = data;
   for (const res of _statusStreamClients) {
     try { res.write('data: ' + data + '\n\n'); } catch { _removeSseClient(_statusStreamClients, res); }
   }
+}
+
+// Periodic push for engine-driven SQL state changes that bypass invalidateStatusCache.
+setInterval(() => {
+  if (_statusStreamClients.size === 0) return;
+  _pushStatusToSseClients().catch(error => {
+    console.warn(`[dashboard] periodic status SSE push failed: ${error.message}`);
+  });
 }, 10000).unref();
 
 
@@ -13401,10 +13522,22 @@ What would you like to discuss or change? When you're happy, say "approve" and I
       });
       return jsonReply(res, 200, { ok: true }, req);
     }},
-    { method: 'GET', path: '/api/status-stream', desc: 'SSE stream of real-time status updates', handler: (req, res) => {
-      res.writeHead(200, { 'Content-Type': 'text/event-stream', 'Cache-Control': 'no-cache', 'Connection': 'keep-alive' });
-      res.write('data: ' + getStatusJson() + '\n\n');
-      _trackSseClient(_statusStreamClients, req, res);
+    { method: 'GET', path: '/api/tools', desc: 'Skills, commands, and MCP inventory scanned outside the dashboard event loop', handler: handleToolsInventory },
+    { method: 'GET', path: '/api/status-stream', desc: 'SSE stream of real-time status updates', handler: async (req, res) => {
+      try {
+        try {
+          await refreshStatusAsync();
+        } catch (error) {
+          if (!_statusCache) throw error;
+        }
+        await _ensureStatusCache();
+        const data = getStatusJson();
+        res.writeHead(200, { 'Content-Type': 'text/event-stream', 'Cache-Control': 'no-cache', 'Connection': 'keep-alive' });
+        res.write('data: ' + data + '\n\n');
+        _trackSseClient(_statusStreamClients, req, res);
+      } catch (error) {
+        jsonReply(res, 503, { error: error.message }, req);
+      }
     }},
     { method: 'GET', path: '/api/health', desc: 'Lightweight health check for monitoring', handler: handleHealth },
     { method: 'GET', path: '/api/keep-processes', desc: 'List all active agents/<id>/keep-pids.json entries (W-mp68q6ke0010de68)', handler: handleKeepProcessesList },
@@ -14909,10 +15042,10 @@ module.exports = {
   refreshStatusAsync,
   handleStatus: _handleStatusRequest,
   invalidateStatusCache,
+  _ensureStatusCache, getStatusJson, _pushStatusToSseClients, // exported for testing
   // exported for testing — see test/unit/status-snapshot-budget.test.js (P-f2a3b4c5).
-  // The slim snapshot builder is the synchronous assembler used by getStatusJson()
-  // and refreshStatusAsync(); the budget test calls it directly to measure byte
-  // size and rebuild-time without standing up an HTTP server.
+  // The budget test calls the synchronous builder directly to measure byte size
+  // and rebuild time; production request/SSE paths use refreshStatusAsync().
   getStatus,
   // Raw state-file passthrough — exported for direct unit testing.
   handleStateRead,
@@ -14927,6 +15060,9 @@ module.exports = {
   _setStatusRefreshHook,
   _resetStatusCacheForTesting,
   _ifNoneMatchHasEtag,
+  _scanStatusMtimes, _refreshStatusMtimes, _resetStatusMtimeCacheForTesting, // exported for testing
+  handleToolsInventory, _refreshToolsInventory, _setToolsInventoryScannerForTesting, _resetToolsInventoryCacheForTesting, // exported for testing
+  _ensureConfiguredProjectStateFiles: ensureConfiguredProjectStateFiles, _resetInitializedProjectStatesForTesting, // exported for testing
   _countWorktrees, _refreshWorktreeCount, _scanWorktreeCount, _resetWorktreeCountCacheForTesting, // exported for testing
   // W-status-swr — exported for direct unit tests of the subprocess-free git
   // HEAD parser and the prefix-tolerant short-SHA comparison. No production
@@ -14999,6 +15135,9 @@ if (require.main === module) {
       .catch(error => {
         console.warn(`[boot] worktree count pre-warm failed: ${error && error.message}`);
       });
+    _refreshStatusMtimes().catch(error => {
+      console.warn(`[boot] status mtime pre-warm failed: ${error && error.message}`);
+    });
     try {
       await warmProjectGitStatusCache();
       const ms = Date.now() - _warmStartedAt;
@@ -15124,7 +15263,9 @@ if (require.main === module) {
     // and stalls the freshly-reloaded page in a spinner. Warming on listen
     // means the first request hits the cached buffer.
     setImmediate(() => {
-      try { getStatusJson(); } catch { /* warm-up is best-effort */ }
+      refreshStatusAsync()
+        .then(() => getStatusJson())
+        .catch(error => console.warn(`[boot] status cache warm-up failed: ${error.message}`));
     });
 
     // ─── Engine Watchdog ─────────────────────────────────────────────────────
@@ -15214,6 +15355,7 @@ if (require.main === module) {
   function _gracefulShutdown() {
     try { flushPendingDocSessions(); } catch {}
     try { shared.clearDashboardPortFile(MINIONS_DIR); } catch {}
+    _terminateToolsInventoryChild();
     // P-c3d4e5f6 — stop the diagnostics-memory sampler cleanly so the
     // setInterval handle doesn't keep the event loop alive on SIGTERM.
     if (_memorySamplerStop) {

package/docs/README.md

@@ -69,7 +69,7 @@ Architecture, design proposals, and lifecycle references for people working on t
 - [skills.md](skills.md) — Skill block format: how agents emit reusable `\`\`\`skill` blocks and how the engine extracts them into native personal-skill directories.
 - [slim-ux/concepts.md](slim-ux/concepts.md) — Slim-UX design notes: simplified surface concepts driving the project picker, inline project link, and decoupled folder picker.
 - [slim-ux/architecture-suggestions.md](slim-ux/architecture-suggestions.md) — Slim-UX follow-up architecture suggestions paired with `concepts.md`.
-- [team-memory.md](team-memory.md) — Per-agent memory layer (`knowledge/agents/<id>.md`) and the consolidation/routing rules that populate it from `notes/inbox/`.
+- [team-memory.md](team-memory.md) — End-to-end hybrid memory system: file-backed inputs and consolidation, SQL/FTS5 records, retrieval and fallback, prompt bounds, episodic capture, security, APIs, and operations.
 - [timeouts-and-liveness.md](timeouts-and-liveness.md) — What kills (or doesn't kill) a live tracked agent: the wall-clock vs steering kill invariants, spawn-phase watchdog gates, steering safety nets, and stale-orphan detection ladder.
 - [watches.md](watches.md) — Persistent monitoring jobs: target-type registry, conditions, follow-up actions, and the `watches.d/` plugin folder.
 - [workspace-manifests.md](workspace-manifests.md) — Declarative per-agent permission scoping: `allowed_tools` / `allowed_repos` / `allowed_external_urls` / `memory_scope`, dispatch-time repo gate, and runtime `--allowedTools` narrowing.