@yemi33/minions 0.1.2402 → 0.1.2403

package/dashboard/js/refresh.js

@@ -79,8 +79,9 @@ const _pageCounters = {
     return sch.length + '|' + sch.map(function(s) { return (s.id || '') + ':' + (s.enabled === false ? '0' : '1') + ':' + (s.cron || ''); }).sort().join(',');
   },
   tools: function(d) {
-    // skills + mcpServers are on /api/status directly, no cache to wait for.
-    return (d.skills || []).length + '|' + (d.mcpServers || []).length;
+    const tools = window._lastToolsInventory;
+    if (!tools) return null;
+    return (tools.skills || []).length + '|' + (tools.mcpServers || []).length;
   },
   engine: function(d) {
     const dispatch = window._lastDispatch;
@@ -447,6 +448,22 @@ function _refreshSidebarCounterSummaries() {
   // entry read it — drop the dead endpoint + fetch. (Review finding #9.)
 }
 
+function _renderToolsInventory(tools) {
+  if (!tools || !Array.isArray(tools.skills)
+      || !Array.isArray(tools.commands)
+      || !Array.isArray(tools.mcpServers)) return false;
+  if (_changed('skills', tools.skills)) {
+    _safeRender('skills', function() { renderSkills(tools.skills); });
+  }
+  if (_changed('commands', tools.commands)) {
+    _safeRender('commands', function() { renderCommands(tools.commands); });
+  }
+  if (_changed('mcpServers', tools.mcpServers)) {
+    _safeRender('mcpServers', function() { renderMcpServers(tools.mcpServers); });
+  }
+  return true;
+}
+
 function _processStatusUpdate(data, opts) {
   opts = opts || {};
   // Kick off the dedicated-endpoint summary refreshes (issue #2949). They
@@ -890,12 +907,25 @@ function _processStatusUpdate(data, opts) {
         }
       });
   });
-  _changed('skills', data.skills);
-  _safeRender('skills', function() { renderSkills(data.skills || []); });
-  _changed('commands', data.commands);
-  _safeRender('commands', function() { renderCommands(data.commands || []); });
-  _changed('mcpServers', data.mcpServers);
-  _safeRender('mcpServers', function() { renderMcpServers(data.mcpServers || []); });
+  // Skills/commands/MCP discovery runs in a child process behind /api/tools.
+  // It is only consumed by the Tools page, so every other page skips the
+  // request and /api/status stays a small, non-blocking health envelope.
+  _safeRender('toolsInventory', function() {
+    if (typeof currentPage !== 'undefined' && currentPage !== 'tools') return;
+    const seq = (window._refreshSeq = (window._refreshSeq || 0) + 1);
+    window._lastRequestedSeq = window._lastRequestedSeq || {};
+    window._lastRequestedSeq.toolsInventory = seq;
+    _condFetchJson('/api/tools')
+      .then(function(resp) {
+        if (seq < (window._lastRequestedSeq.toolsInventory || 0) || resp.notModified) return;
+        const tools = resp.data;
+        if (_renderToolsInventory(tools)) window._lastToolsInventory = tools;
+      })
+      .catch(function() {
+        const tools = window._lastToolsInventory;
+        if (tools) _renderToolsInventory(tools);
+      });
+  });
   // Harness propagation diagnostic comes from /api/harness/diagnostics.
   // HEAVY ENDPOINT: the handler runs a synchronous `git status` per linked
   // project (execFileSync, 10s timeout) which hard-blocks the dashboard event

package/dashboard.js

@@ -22,9 +22,11 @@ require('./engine/stdio-timestamps').installIfNotInstalled();
 
 const http = require('http');
 const zlib = require('zlib');
+const crypto = require('crypto');
 const fs = require('fs');
 const path = require('path');
 const v8 = require('v8');
+const { execFile } = require('child_process');
 const llm = require('./engine/llm');
 const { resolveRuntime, shouldSuppressPostMutationError } = require('./engine/runtimes');
 
@@ -69,11 +71,12 @@ const ccWorkerPool = require('./engine/cc-worker-pool');
 const diagnosticsMemory = require('./engine/diagnostics-memory');
 const memoryStore = require('./engine/memory-store');
 const smallStateStore = require('./engine/small-state-store');
+const toolsInventory = require('./engine/tools-inventory');
 const os = require('os');
 
 const { safeRead, safeReadOrNull, safeReadDir, safeWrite, safeJson, safeJsonObj, safeJsonArr, safeJsonNoRestore, safeUnlink, mutateJsonFileLocked, mutateTextFileLocked, mutateControl, mutateCooldowns, mutateWorkItems, getProjects: _getProjects, DONE_STATUSES, WI_STATUS, WORK_TYPE, WORKTREE_REQUIRING_TYPES, reopenWorkItem } = shared;
 const { getAgents, getAgentDetail, getPrdInfo, getWorkItems, getDispatchQueue,
-  getSkills, getCommands, getInbox, getNotesWithMeta, getPullRequests,
+  getInbox, getNotesWithMeta, getPullRequests,
   getEngineLog, getMetrics, getKnowledgeBaseEntries, getKnowledgeBaseEntriesSnapshot, getProjectGitStatus, timeSince,
   MINIONS_DIR, AGENTS_DIR, ENGINE_DIR, INBOX_DIR, PRD_DIR } = queries;
 
@@ -230,16 +233,31 @@ function _resetHeapSnapshotRateLimitForTesting() {
   _heapSnapshotLastCapturedAt = 0;
 }
 
+const _initializedProjectStateKeys = new Set();
+
 function ensureConfiguredProjectStateFiles() {
+  const configuredKeys = new Set();
   for (const p of PROJECTS) {
     const root = p.localPath ? path.resolve(p.localPath) : null;
+    const key = `${String(p.name || '').toLowerCase()}\0${shared._normalizeWorktreePath(root || '')}`;
+    configuredKeys.add(key);
+    if (_initializedProjectStateKeys.has(key)) continue;
     if (!root || !fs.existsSync(root)) continue;
     try {
       shared.initializeProjectState(p);
+      _initializedProjectStateKeys.add(key);
     } catch (e) {
       console.warn(`[dashboard] project state setup failed for "${p.name}": ${e.message}`);
     }
   }
+
+  for (const key of _initializedProjectStateKeys) {
+    if (!configuredKeys.has(key)) _initializedProjectStateKeys.delete(key);
+  }
+}
+
+function _resetInitializedProjectStatesForTesting() {
+  _initializedProjectStateKeys.clear();
 }
 
 function reloadConfig() {
@@ -2308,74 +2326,8 @@ function _parseCopilotMcpListJson(raw) {
   } catch { return []; }
 }
 
-// Read Claude's user-scope MCP servers from `~/.claude.json` directly.
-// Shelling out to `claude mcp list` is unreliable from the dashboard daemon —
-// the CLI's MCP health probes block on a TTY check when the parent has no
-// console (bin/minions.js launches the dashboard with windowsHide:true), and
-// neither exec() nor spawn(..., {detached:true}) reliably sidesteps it.
-// Config-file reads are zero-spawn, instant, and the file is the authoritative
-// source for which servers are registered.
-function _readClaudeUserMcpServers() {
-  try {
-    const data = safeJsonObj(path.join(os.homedir(), '.claude.json'));
-    const servers = data?.mcpServers || {};
-    return Object.entries(servers).map(([name, cfg]) => ({
-      name,
-      source: 'Claude user',
-      command: cfg.command || cfg.url || '',
-      args: Array.isArray(cfg.args) ? cfg.args.join(' ') : (cfg.args || ''),
-    }));
-  } catch { return []; }
-}
-
-// Copilot stores its MCP config at `~/.copilot/mcp-config.json` (may have a
-// UTF-8 BOM — Windows tooling tends to write one).
-function _readCopilotUserMcpServers() {
-  try {
-    const configPath = path.join(os.homedir(), '.copilot', 'mcp-config.json');
-    if (!fs.existsSync(configPath)) return [];
-    let raw = fs.readFileSync(configPath, 'utf8');
-    if (raw.charCodeAt(0) === 0xFEFF) raw = raw.slice(1);
-    const data = JSON.parse(raw);
-    const servers = data?.mcpServers || {};
-    return Object.entries(servers).map(([name, cfg]) => ({
-      name,
-      source: 'Copilot',
-      command: cfg.command || cfg.url || '',
-      args: Array.isArray(cfg.args) ? cfg.args.join(' ') : (cfg.args || ''),
-    }));
-  } catch { return []; }
-}
-
-function _readWorkspaceMcpServers(projects) {
-  const out = [];
-  for (const p of (projects || [])) {
-    if (!p?.localPath) continue;
-    const data = safeJsonObj(path.join(p.localPath, '.mcp.json'));
-    const servers = data.mcpServers || {};
-    for (const [name, cfg] of Object.entries(servers)) {
-      out.push({
-        name,
-        source: `Workspace: ${p.name}`,
-        command: cfg.command || cfg.url || '',
-        args: Array.isArray(cfg.args) ? cfg.args.join(' ') : (cfg.args || ''),
-      });
-    }
-  }
-  return out;
-}
-
-function _dedupeMcpServers(entries) {
-  const seen = new Set();
-  const out = [];
-  for (const e of entries) {
-    const key = `${e.source}::${e.name}`;
-    if (seen.has(key)) continue;
-    seen.add(key);
-    out.push(e);
-  }
-  return out;
-}
+const _readWorkspaceMcpServers = toolsInventory.readWorkspaceMcpServers;
+const _dedupeMcpServers = toolsInventory.dedupeMcpServers;
 
 function getMcpServers() {
   const now = Date.now();
@@ -2383,12 +2335,7 @@ function getMcpServers() {
     return _mcpServersCache;
   }
   try {
-    const entries = [
-      ..._readClaudeUserMcpServers(),
-      ..._readCopilotUserMcpServers(),
-      ..._readWorkspaceMcpServers(PROJECTS),
-    ];
-    _mcpServersCache = _dedupeMcpServers(entries);
+    _mcpServersCache = toolsInventory.getMcpServers(PROJECTS);
   } catch (e) {
     console.error('[mcp-discovery] refresh failed:', e.message?.split('\n')?.[0]);
     if (!_mcpServersCache) _mcpServersCache = [];
@@ -2397,6 +2344,135 @@ function getMcpServers() {
   return _mcpServersCache;
 }
 
+const TOOLS_INVENTORY_CACHE_TTL_MS = 30000;
+const TOOLS_INVENTORY_CHILD_TIMEOUT_MS = 30000;
+const TOOLS_INVENTORY_CHILD_WATCHDOG_MS = 35000;
+const TOOLS_INVENTORY_MAX_BYTES = 4 * 1024 * 1024;
+let _toolsInventoryCache = null;
+let _toolsInventoryCacheJson = null;
+let _toolsInventoryCacheEtag = null;
+let _toolsInventoryCacheTs = 0;
+let _toolsInventoryRefreshPromise = null;
+let _toolsInventoryChild = null;
+let _toolsInventoryScanner = _scanToolsInventoryInChild;
+
+function _validateToolsInventoryPayload(payload) {
+  if (!payload || typeof payload !== 'object'
+      || !Array.isArray(payload.skills)
+      || !Array.isArray(payload.commands)
+      || !Array.isArray(payload.mcpServers)) {
+    throw new Error('tools inventory child returned an invalid payload');
+  }
+  return {
+    skills: payload.skills,
+    commands: payload.commands,
+    mcpServers: payload.mcpServers,
+  };
+}
+
+function _scanToolsInventoryInChild() {
+  const childPath = path.join(__dirname, 'engine', 'tools-inventory.js');
+  return new Promise((resolve, reject) => {
+    let settled = false;
+    let watchdog = null;
+    const child = execFile(process.execPath, [childPath], {
+      cwd: MINIONS_DIR,
+      env: { ...process.env, MINIONS_HOME: MINIONS_DIR },
+      encoding: 'utf8',
+      maxBuffer: TOOLS_INVENTORY_MAX_BYTES,
+      timeout: TOOLS_INVENTORY_CHILD_TIMEOUT_MS,
+      windowsHide: true,
+    }, (error, stdout, stderr) => {
+      if (settled) return;
+      settled = true;
+      if (watchdog) clearTimeout(watchdog);
+      if (_toolsInventoryChild === child) _toolsInventoryChild = null;
+      if (error) {
+        const detail = String(stderr || error.message || '').trim().slice(0, 500);
+        reject(new Error(`tools inventory scan failed${detail ? `: ${detail}` : ''}`));
+        return;
+      }
+      try {
+        resolve(_validateToolsInventoryPayload(JSON.parse(stdout)));
+      } catch (parseError) {
+        reject(new Error(`tools inventory scan returned invalid JSON: ${parseError.message}`));
+      }
+    });
+    _toolsInventoryChild = child;
+    watchdog = setTimeout(() => {
+      if (settled) return;
+      settled = true;
+      if (_toolsInventoryChild === child) _toolsInventoryChild = null;
+      try { shared.killImmediate(child); } catch { /* child may already be gone */ }
+      reject(new Error(`tools inventory scan exceeded ${TOOLS_INVENTORY_CHILD_WATCHDOG_MS}ms watchdog`));
+    }, TOOLS_INVENTORY_CHILD_WATCHDOG_MS);
+    watchdog.unref();
+  });
+}
+
+function _terminateToolsInventoryChild() {
+  const child = _toolsInventoryChild;
+  _toolsInventoryChild = null;
+  if (!child) return;
+  try { shared.killImmediate(child); } catch { /* child may already be gone */ }
+}
+
+function _refreshToolsInventory() {
+  const now = Date.now();
+  if (_toolsInventoryCache && now - _toolsInventoryCacheTs < TOOLS_INVENTORY_CACHE_TTL_MS) {
+    return Promise.resolve(_toolsInventoryCache);
+  }
+  if (_toolsInventoryRefreshPromise) return _toolsInventoryRefreshPromise;
+
+  _toolsInventoryRefreshPromise = Promise.resolve()
+    .then(() => _toolsInventoryScanner())
+    .then(payload => {
+      const next = _validateToolsInventoryPayload(payload);
+      const json = JSON.stringify(next);
+      _toolsInventoryCache = next;
+      _toolsInventoryCacheJson = json;
+      _toolsInventoryCacheEtag = `"tools-${crypto.createHash('sha256').update(json).digest('hex')}"`;
+      _toolsInventoryCacheTs = Date.now();
+      return next;
+    })
+    .finally(() => {
+      _toolsInventoryRefreshPromise = null;
+    });
+  return _toolsInventoryRefreshPromise;
+}
+
+async function handleToolsInventory(req, res) {
+  try {
+    await _refreshToolsInventory();
+    res.setHeader('ETag', _toolsInventoryCacheEtag);
+    res.setHeader('Cache-Control', 'private, max-age=0, must-revalidate');
+    if (_ifNoneMatchHasEtag(req?.headers?.['if-none-match'], _toolsInventoryCacheEtag)) {
+      res.statusCode = 304;
+      res.end();
+      return;
+    }
+    res.statusCode = 200;
+    res.setHeader('Content-Type', 'application/json; charset=utf-8');
+    res.end(_toolsInventoryCacheJson);
+  } catch (error) {
+    jsonReply(res, 503, { error: error.message }, req);
+  }
+}
+
+function _setToolsInventoryScannerForTesting(scanner) {
+  _toolsInventoryScanner = typeof scanner === 'function' ? scanner : _scanToolsInventoryInChild;
+}
+
+function _resetToolsInventoryCacheForTesting() {
+  _terminateToolsInventoryChild();
+  _toolsInventoryCache = null;
+  _toolsInventoryCacheJson = null;
+  _toolsInventoryCacheEtag = null;
+  _toolsInventoryCacheTs = 0;
+  _toolsInventoryRefreshPromise = null;
+  _toolsInventoryScanner = _scanToolsInventoryInChild;
+}
+
 function parsePinnedEntries(content) {
   if (!content) return [];
   const entries = [];
@@ -2492,9 +2568,9 @@ function _ifNoneMatchHasEtag(headerValue, currentEtag) {
 // We union them here. Adding a new tracked file means adding ONE line to
 // the appropriate list in queries.js — the dashboard side stays a thin
 // delegate that doesn't need to know about per-source semantics anymore.
-function _mtimeTrackedFiles() {
+async function _mtimeTrackedFiles() {
   const fast = queries.getStatusFastStateMtimePaths(CONFIG);
-  const slow = queries.getStatusSlowStateMtimePaths(CONFIG);
+  const slow = await queries.getStatusSlowStateMtimePathsAsync(CONFIG);
   // Dedup with a Set — many paths (per-project work-items, git refs) appear
   // in both registries since both fast (workItems slice) and slow (PRD
   // progress derived from same data) read them.
@@ -2519,37 +2595,68 @@ function _getCurrentEventVersion() {
   }
 }
 
-// Stat a tracked path with transient-error tolerance. ENOENT (file/dir doesn't
-// exist) is normal — fresh installs, deleted projects, empty PRD dirs all hit
-// this — and maps to 0 so the entry just doesn't bust the cache. EBUSY /
-// EACCES / EPERM are transient on Windows (OneDrive sync, antivirus scan,
-// file replication service); falling through to 0 would produce oscillating
-// mtimes (real, then 0, then real again) that look like a real change on
-// every other poll. Preserving the previous successful mtime on those errors
-// keeps the cache stable across short lock windows.
-function _statMtimeMs(fp, prevSnapshot) {
+const STATUS_MTIME_REFRESH_TTL_MS = 1000;
+let _currentMtimes = {};
+let _currentMtimesTs = 0;
+let _mtimeRefreshPromise = null;
+
+// Async transient-tolerant equivalent of the former statSync hot path. ENOENT
+// maps to 0; lock/access errors preserve the prior value so antivirus or a
+// temporarily unavailable project root cannot oscillate the cache.
+async function _statMtimeMs(fp, prevSnapshot) {
   try {
-    return fs.statSync(fp).mtimeMs;
+    return (await fs.promises.stat(fp)).mtimeMs;
   } catch (e) {
-    if (e && e.code === 'ENOENT') return 0;
+    if (e && (e.code === 'ENOENT' || e.code === 'ENOTDIR')) return 0;
     return prevSnapshot && (fp in prevSnapshot) ? prevSnapshot[fp] : 0;
   }
 }
 
+async function _scanStatusMtimes(paths, previous) {
+  const entries = await Promise.all(paths.map(async fp => [
+    fp,
+    await _statMtimeMs(fp, previous),
+  ]));
+  return Object.fromEntries(entries);
+}
+
+function _refreshStatusMtimes() {
+  if (_mtimeRefreshPromise) return _mtimeRefreshPromise;
+  const previous = _currentMtimes;
+  const hadSnapshot = _currentMtimesTs > 0;
+  _mtimeRefreshPromise = _mtimeTrackedFiles()
+    .then(paths => _scanStatusMtimes(paths, previous))
+    .then(next => {
+      const changed = hadSnapshot && _mtimesChanged(previous, next);
+      _currentMtimes = next;
+      _currentMtimesTs = Date.now();
+      if (changed && (_statusCache || _statusRebuildPromise)) invalidateStatusCache();
+      return next;
+    })
+    .finally(() => {
+      _mtimeRefreshPromise = null;
+    });
+  return _mtimeRefreshPromise;
+}
+
 function _getMtimes() {
-  const result = {};
-  for (const fp of _mtimeTrackedFiles()) {
-    result[fp] = _statMtimeMs(fp, _lastMtimes);
+  if (!_currentMtimesTs || Date.now() - _currentMtimesTs >= STATUS_MTIME_REFRESH_TTL_MS) {
+    _refreshStatusMtimes().catch(error => {
+      console.warn(`[dashboard] status mtime refresh failed: ${error.message}`);
+    });
   }
-  return result;
+  return _currentMtimes;
 }
 
-// Reset per-source caches whose TTL would otherwise survive an mtime-triggered
-// status rebuild and serve stale data.
+function _resetStatusMtimeCacheForTesting() {
+  _currentMtimes = {};
+  _currentMtimesTs = 0;
+  _mtimeRefreshPromise = null;
+}
+
+// Version data remains in /api/status and must reflect package/git mtime
+// changes. Tools inventory has its own child-process cache and endpoint.
 function _invalidateInnerCachesForRebuild() {
-  try { queries.invalidateSkillsCache(); } catch { /* optional */ }
-  _mcpServersCache = null;
-  _mcpServersCacheTs = 0;
   _diskVersionCache = null;
   _diskVersionCacheTs = 0;
 }
@@ -2588,10 +2695,9 @@ function invalidateStatusCache(_opts) {
   _statusPushTimer = setTimeout(() => {
     _statusPushTimer = null;
     if (_statusStreamClients.size === 0) return;
-    const data = getStatusJson();
-    for (const res of _statusStreamClients) {
-      try { res.write('data: ' + data + '\n\n'); } catch { _removeSseClient(_statusStreamClients, res); }
-    }
+    _pushStatusToSseClients(true).catch(error => {
+      console.warn(`[dashboard] status SSE push failed: ${error.message}`);
+    });
   }, 500);
 }
 
@@ -2649,12 +2755,10 @@ function _buildStatusSlowState() {
   // /api/schedules, pipelines → /api/pipelines, pinned → /api/pinned.
   // What's left here is genuine "shape of the install" state that has no
   // staleness problem: projects + git status (server-only compute), runtime
-  // capability roll-ups (skills + mcpServers), config-derived autoMode +
-  // initialized + installId, and the version banner.
+  // config-derived autoMode + initialized + installId, and the version banner.
+  // Skills, commands, and MCP servers live on /api/tools because their
+  // filesystem discovery runs in a child process.
   return {
-    skills: getSkills(),
-    commands: getCommands(CONFIG),
-    mcpServers: getMcpServers(),
     projects: PROJECTS.map(p => {
       const status = getProjectGitStatus(p.localPath, p.mainBranch);
       const mainBranch = p.mainBranch || null;
@@ -2831,6 +2935,10 @@ function refreshStatusAsync() {
   if (_statusRebuildPromise) return _statusRebuildPromise;
 
   _statusRebuildPromise = (async () => {
+    // A cache hit can otherwise complete synchronously before the assignment
+    // above stores the Promise, so the finally block clears null and the outer
+    // assignment then resurrects an already-resolved single-flight forever.
+    await Promise.resolve();
     const profile = _statusTimingActive();
     const tOverall = profile ? process.hrtime.bigint() : null;
     let fastBuildMs = 0;
@@ -2914,6 +3022,18 @@ function refreshStatusAsync() {
   return _statusRebuildPromise;
 }
 
+async function _ensureStatusCache() {
+  if (_statusCache) return _statusCache;
+  // A request can inherit an older single-flight rebuild and then race both a
+  // worktree-count and mtime refresh. Allow several cooperative retries rather
+  // than falling back to the synchronous builder or returning a transient 500.
+  for (let attempt = 0; attempt < 5 && !_statusCache; attempt++) {
+    await refreshStatusAsync();
+  }
+  if (!_statusCache) throw new Error('status cache invalidated during rebuild; retry');
+  return _statusCache;
+}
+
 // Test seams (W-mpehsyhv0017085a) — exported via module.exports so the unit
 // stress test can drive the rebuild deterministically without standing up an
 // http server. None of these are referenced by production code paths.
@@ -2935,9 +3055,9 @@ function _resetStatusCacheForTesting() {
   _lastEventVersion = -1;
 }
 
-/** Return cached JSON string of status — single stringify, reused by SSE and /api/status */
+/** Serialize the current cache once. Callers must refresh asynchronously first. */
 function getStatusJson() {
-  getStatus(); // ensure _statusCache is fresh
+  if (!_statusCache) throw new Error('status cache is not ready');
   if (!_statusCacheJson) {
     const profile = _statusTimingActive();
     const tStringify = profile ? process.hrtime.bigint() : null;
@@ -3361,17 +3481,9 @@ async function _handleStatusRequest(req, res) {
     if (_statusCache) {
       Promise.resolve().then(refreshStatusAsync).catch(() => { /* next poll + SSE push retry */ });
     } else {
-      // Cold start or post-hard-invalidation: nothing to serve → await one
-      // rebuild. refreshStatusAsync yields the event loop mid-rebuild so CC
-      // SSE heartbeats keep flowing during a slow build.
-      try { await refreshStatusAsync(); } catch { /* fall through — getStatusJson will sync-rebuild */ }
-      // Race-guard fallback: if refresh discarded its result because
-      // invalidateStatusCache() fired mid-rebuild, _statusCache is still null.
-      // Trigger a synchronous rebuild here so the ETag we compute reflects
-      // freshly-built post-invalidate state, not the stale pre-invalidate one.
-      if (!_statusCache) {
-        try { getStatus(); } catch { /* getStatusJson below will retry */ }
-      }
+      // Cold start or post-hard-invalidation: retry an invalidation-raced
+      // rebuild asynchronously. Never fall back to the synchronous builder.
+      await _ensureStatusCache();
     }
 
     // ETag = monotonic cache version. Bumped on every successful rebuild and
@@ -3405,15 +3517,24 @@ async function _handleStatusRequest(req, res) {
   }
 }
 
-// Periodic push for engine-driven SQL state changes that bypass invalidateStatusCache.
-setInterval(() => {
+async function _pushStatusToSseClients(force = false) {
   if (_statusStreamClients.size === 0) return;
+  await refreshStatusAsync();
+  await _ensureStatusCache();
   const data = getStatusJson();
-  if (data === _lastStatusPushRef) return; // O(1) reference comparison — new string ref means content changed
+  if (!force && data === _lastStatusPushRef) return;
   _lastStatusPushRef = data;
   for (const res of _statusStreamClients) {
     try { res.write('data: ' + data + '\n\n'); } catch { _removeSseClient(_statusStreamClients, res); }
   }
+}
+
+// Periodic push for engine-driven SQL state changes that bypass invalidateStatusCache.
+setInterval(() => {
+  if (_statusStreamClients.size === 0) return;
+  _pushStatusToSseClients().catch(error => {
+    console.warn(`[dashboard] periodic status SSE push failed: ${error.message}`);
+  });
 }, 10000).unref();
 
 
@@ -13401,10 +13522,22 @@ What would you like to discuss or change? When you're happy, say "approve" and I
       });
       return jsonReply(res, 200, { ok: true }, req);
     }},
-    { method: 'GET', path: '/api/status-stream', desc: 'SSE stream of real-time status updates', handler: (req, res) => {
-      res.writeHead(200, { 'Content-Type': 'text/event-stream', 'Cache-Control': 'no-cache', 'Connection': 'keep-alive' });
-      res.write('data: ' + getStatusJson() + '\n\n');
-      _trackSseClient(_statusStreamClients, req, res);
+    { method: 'GET', path: '/api/tools', desc: 'Skills, commands, and MCP inventory scanned outside the dashboard event loop', handler: handleToolsInventory },
+    { method: 'GET', path: '/api/status-stream', desc: 'SSE stream of real-time status updates', handler: async (req, res) => {
+      try {
+        try {
+          await refreshStatusAsync();
+        } catch (error) {
+          if (!_statusCache) throw error;
+        }
+        await _ensureStatusCache();
+        const data = getStatusJson();
+        res.writeHead(200, { 'Content-Type': 'text/event-stream', 'Cache-Control': 'no-cache', 'Connection': 'keep-alive' });
+        res.write('data: ' + data + '\n\n');
+        _trackSseClient(_statusStreamClients, req, res);
+      } catch (error) {
+        jsonReply(res, 503, { error: error.message }, req);
+      }
     }},
     { method: 'GET', path: '/api/health', desc: 'Lightweight health check for monitoring', handler: handleHealth },
     { method: 'GET', path: '/api/keep-processes', desc: 'List all active agents/<id>/keep-pids.json entries (W-mp68q6ke0010de68)', handler: handleKeepProcessesList },
@@ -14909,10 +15042,10 @@ module.exports = {
   refreshStatusAsync,
   handleStatus: _handleStatusRequest,
   invalidateStatusCache,
+  _ensureStatusCache, getStatusJson, _pushStatusToSseClients, // exported for testing
   // exported for testing — see test/unit/status-snapshot-budget.test.js (P-f2a3b4c5).
-  // The slim snapshot builder is the synchronous assembler used by getStatusJson()
-  // and refreshStatusAsync(); the budget test calls it directly to measure byte
-  // size and rebuild-time without standing up an HTTP server.
+  // The budget test calls the synchronous builder directly to measure byte size
+  // and rebuild time; production request/SSE paths use refreshStatusAsync().
   getStatus,
   // Raw state-file passthrough — exported for direct unit testing.
   handleStateRead,
@@ -14927,6 +15060,9 @@ module.exports = {
   _setStatusRefreshHook,
   _resetStatusCacheForTesting,
   _ifNoneMatchHasEtag,
+  _scanStatusMtimes, _refreshStatusMtimes, _resetStatusMtimeCacheForTesting, // exported for testing
+  handleToolsInventory, _refreshToolsInventory, _setToolsInventoryScannerForTesting, _resetToolsInventoryCacheForTesting, // exported for testing
+  _ensureConfiguredProjectStateFiles: ensureConfiguredProjectStateFiles, _resetInitializedProjectStatesForTesting, // exported for testing
   _countWorktrees, _refreshWorktreeCount, _scanWorktreeCount, _resetWorktreeCountCacheForTesting, // exported for testing
   // W-status-swr — exported for direct unit tests of the subprocess-free git
   // HEAD parser and the prefix-tolerant short-SHA comparison. No production
@@ -14999,6 +15135,9 @@ if (require.main === module) {
       .catch(error => {
         console.warn(`[boot] worktree count pre-warm failed: ${error && error.message}`);
       });
+    _refreshStatusMtimes().catch(error => {
+      console.warn(`[boot] status mtime pre-warm failed: ${error && error.message}`);
+    });
     try {
       await warmProjectGitStatusCache();
       const ms = Date.now() - _warmStartedAt;
@@ -15124,7 +15263,9 @@ if (require.main === module) {
     // and stalls the freshly-reloaded page in a spinner. Warming on listen
     // means the first request hits the cached buffer.
     setImmediate(() => {
-      try { getStatusJson(); } catch { /* warm-up is best-effort */ }
+      refreshStatusAsync()
+        .then(() => getStatusJson())
+        .catch(error => console.warn(`[boot] status cache warm-up failed: ${error.message}`));
     });
 
     // ─── Engine Watchdog ─────────────────────────────────────────────────────
@@ -15214,6 +15355,7 @@ if (require.main === module) {
   function _gracefulShutdown() {
     try { flushPendingDocSessions(); } catch {}
     try { shared.clearDashboardPortFile(MINIONS_DIR); } catch {}
+    _terminateToolsInventoryChild();
     // P-c3d4e5f6 — stop the diagnostics-memory sampler cleanly so the
     // setInterval handle doesn't keep the event loop alive on SIGTERM.
     if (_memorySamplerStop) {

package/engine/queries.js

@@ -1219,7 +1219,7 @@ let _skillIndexCache = null;
 let _skillIndexCacheTs = 0;
 let _skillIndexCacheKey = null;
 // Top-level cache for getSkills (the read+parse + meta-build path layered on
-// top of collectSkillFiles). Without this, every /api/status slow-state
+// top of collectSkillFiles). Without this, every /api/tools inventory scan
 // rebuild re-read and re-parsed all ~80 SKILL.md files (~29ms warm even
 // though collectSkillFiles itself was cached) because getSkills did the
 // I/O on the cached file list. Shares the same 30s TTL + cacheKey so an
@@ -1465,8 +1465,8 @@ const SKILL_SOURCE_BY_SCOPE = {
 };
 
 function getSkills(config) {
-  // Cache the entire read+parse round, not just the file list. /api/status
-  // slow-state calls getSkills on every rebuild and re-reading 80+ SKILL.md
+  // Cache the entire read+parse round, not just the file list. /api/tools
+  // historically called getSkills on every rebuild; re-reading 80+ SKILL.md
   // files + re-parsing their YAML frontmatter cost ~29ms each time (the
   // single biggest hot-path offender after getPrdInfo cold). 30s TTL +
   // shared cacheKey with collectSkillFiles so invalidateSkillsCache() still
@@ -1631,8 +1631,8 @@ function _commandTitle(content, fallback) {
 }
 
 // Dashboard-facing wrapper over `collectCommandFiles`. Returns a normalized
-// per-entry shape the tools.html "Slash commands" panel + `/api/status`
-// slow-state slice render directly. Includes the resolved title (from YAML
+// per-entry shape the tools.html "Slash commands" panel + `/api/tools`
+// response renders directly. Includes the resolved title (from YAML
 // `description:` frontmatter or first `# heading`) and a `dir`-with-forward-
 // slashes copy so the renderer can build display strings without re-walking
 // the file on the client. Sort matches getCommandIndex (project → plugin →
@@ -2838,6 +2838,31 @@ function _resolveCommonGitDir(gitDir) {
   return path.isAbsolute(raw) ? raw : path.resolve(gitDir, raw);
 }
 
+async function _resolveGitDirAsync(localPath) {
+  if (!localPath) return null;
+  const gitPath = path.join(localPath, '.git');
+  let stat;
+  try { stat = await fs.promises.stat(gitPath); }
+  catch { return null; }
+  if (stat.isDirectory()) return gitPath;
+  if (!stat.isFile()) return null;
+  let raw;
+  try { raw = (await fs.promises.readFile(gitPath, 'utf8')).slice(0, 4096); }
+  catch { return null; }
+  const match = /^gitdir:\s*(.+?)\s*$/m.exec(raw);
+  if (!match) return null;
+  return path.isAbsolute(match[1]) ? match[1] : path.resolve(localPath, match[1]);
+}
+
+async function _resolveCommonGitDirAsync(gitDir) {
+  if (!gitDir) return null;
+  let raw;
+  try { raw = (await fs.promises.readFile(path.join(gitDir, 'commondir'), 'utf8')).trim(); }
+  catch { return gitDir; }
+  if (!raw) return gitDir;
+  return path.isAbsolute(raw) ? raw : path.resolve(gitDir, raw);
+}
+
 // Enumerate the per-project git ref files we watch for cache-busting, split
 // into two groups (W-mrb6qnuc000785b2):
 //   identityFiles — HEAD + logs/HEAD, resolved against the PER-WORKTREE
@@ -3084,6 +3109,8 @@ let _fastMtimePathsCache = null;
 let _fastMtimePathsCacheKey = null;
 let _slowMtimePathsCache = null;
 let _slowMtimePathsCacheKey = null;
+let _slowMtimePathsAsyncCache = null;
+let _slowMtimePathsAsyncCacheKey = null;
 function _mtimePathsCacheKey(config) {
   const projects = getProjects(config).map(p => (p.name || '') + '|' + (p.localPath || ''));
   return projects.join(';');
@@ -3102,26 +3129,10 @@ function getStatusFastStateMtimePaths(config) {
 /**
  * Slow-state mtime tracker — symmetric with the fast-state registry above.
  *
- * Slow-state mtime tracking covers only intentionally file-backed inputs such
- * as config, skills, MCP settings, and project git metadata.
- *
- * Skill and MCP source paths (W-mphfdgwv000bf549):
- *   - Skill discovery roots (`~/.claude/skills`, `~/.copilot/skills`,
- *     `~/.agents/skills`, `<project>/.claude/skills`, `<project>/.github/skills`,
- *     `<project>/.agents/skills`) plus plugin registries are tracked here
- *     because manual `SKILL.md` drops bypass the agent-close
- *     `invalidateStatusCache({includeSlow:true})` path that previously
- *     covered the agent-extraction case. Directory mtime advances reliably
- *     on Windows NTFS when a subdirectory is added/removed (verified via
- *     INBOX_DIR). Tracking the user-home dirs means non-Minions skill
- *     installs on this machine also bust the fleet's slow-state — but skill
- *     dirs only mutate on rare events (install / manual edit), not on every
- *     CLI command, so the steady-state noise is negligible.
- *   - MCP config files (`~/.claude.json`, `~/.copilot/mcp-config.json`,
- *     `<project>/.mcp.json`) feed `getMcpServers()`. `~/.claude.json`
- *     stores more than `mcpServers`, but it only flips on intentional
- *     Claude CLI mutations (mcp add/remove, settings edits), not on every
- *     prompt, so whole-file tracking is acceptable.
+ * Slow-state mtime tracking covers only file-backed inputs that remain in
+ * /api/status: config, install/version files, and project git metadata.
+ * Skills, commands, and MCP settings are discovered by the isolated
+ * /api/tools child process and no longer invalidate the global status cache.
  *
  * Per-project `.git/logs/HEAD` + `.git/FETCH_HEAD` ARE tracked here in
  * addition to the fast-state tracker. The project payload (`projects:`
@@ -3142,21 +3153,14 @@ function getStatusFastStateMtimePaths(config) {
  * gitdir, not the per-worktree subdir, so tracking the per-worktree
  * path would silently miss every fetch).
  *
- * NOTE: Detecting a change here busts the dashboard's slow-state cache, but
- * the inner per-source caches (`queries._skillsCache` 30 s, dashboard's
- * `_mcpServersCache` 5 min) survive across `_buildStatusSlowState()` calls.
- * dashboard.js calls `queries.invalidateSkillsCache()` and resets
- * `_mcpServersCache` whenever this tracker fires, so the rebuild reads
- * fresh disk state. Keep that invalidation wired up if you add new sources.
  */
 function getStatusSlowStateMtimePaths(config) {
   config = config || getConfig();
   const cacheKey = _mtimePathsCacheKey(config);
   if (_slowMtimePathsCache && _slowMtimePathsCacheKey === cacheKey) return _slowMtimePathsCache;
   const projects = getProjects(config);
-  const homeDir = os.homedir();
-  // Issue #2949 — slow-state now contains ONLY skills, mcpServers, projects,
-  // autoMode, initialized, installId, version. PRD/PRDProgress/verifyGuides/
+  // Issue #2949 — slow-state now contains ONLY projects, autoMode,
+  // initialized, installId, and version. PRD/PRDProgress/verifyGuides/
   // archivedPrds/schedules/pipelines/pinned/work-items all moved to dedicated
   // /api/<x> endpoints which carry their own ETags; tracking their backing
   // files here would bust the /api/status outer cache for slices that aren't
@@ -3171,40 +3175,6 @@ function getStatusSlowStateMtimePaths(config) {
   files.push(path.join(MINIONS_DIR, '.install-id'));
   files.push(path.join(MINIONS_DIR, 'package.json'));
 
-  // Skill discovery roots (surfaced by _buildStatusSlowState → getSkills).
-  // Mirrors collectSkillFiles' source enumeration so adding a new runtime
-  // adapter automatically extends the tracker. ENOENT is tolerated by
-  // dashboard._statMtimeMs (returns 0), so absent dirs cost nothing.
-  try {
-    const { listRuntimes, resolveRuntime } = require('./runtimes');
-    for (const runtimeName of listRuntimes()) {
-      const runtime = resolveRuntime(runtimeName);
-      if (typeof runtime.getSkillRoots !== 'function') continue;
-      for (const root of runtime.getSkillRoots({ homeDir })) {
-        if (root && root.dir) files.push(root.dir);
-      }
-      for (const project of projects) {
-        if (!project || !project.localPath) continue;
-        for (const root of runtime.getSkillRoots({ homeDir, project })) {
-          if (root && root.dir) files.push(root.dir);
-        }
-      }
-    }
-  } catch { /* runtime registry optional in partial installs */ }
-
-  // Plugin skill registries (also feed collectSkillFiles).
-  files.push(path.join(homeDir, '.claude', 'plugins', 'installed_plugins.json'));
-  files.push(path.join(homeDir, '.copilot', 'installed-plugins'));
-
-  // MCP server config files (surfaced by _buildStatusSlowState → getMcpServers).
-  files.push(path.join(homeDir, '.claude.json'));
-  files.push(path.join(homeDir, '.copilot', 'mcp-config.json'));
-  for (const project of projects) {
-    if (project && project.localPath) {
-      files.push(path.join(project.localPath, '.mcp.json'));
-    }
-  }
-
   // Per-project git refs — see the "Per-project .git/logs/HEAD" note in
   // the header. Same pair the fast-state tracker watches; `logs/HEAD` is
   // per-worktree (resolved via `_resolveGitDir`) while `FETCH_HEAD` lives
@@ -3230,6 +3200,34 @@ function getStatusSlowStateMtimePaths(config) {
   return files;
 }
 
+async function getStatusSlowStateMtimePathsAsync(config) {
+  config = config || getConfig();
+  const cacheKey = _mtimePathsCacheKey(config);
+  if (_slowMtimePathsAsyncCache && _slowMtimePathsAsyncCacheKey === cacheKey) {
+    return _slowMtimePathsAsyncCache;
+  }
+  const files = [
+    CONFIG_PATH,
+    path.join(MINIONS_DIR, '.install-id'),
+    path.join(MINIONS_DIR, 'package.json'),
+  ];
+  const projectPaths = await Promise.all(getProjects(config).map(async project => {
+    if (!project?.localPath) return [];
+    const gitDir = await _resolveGitDirAsync(project.localPath)
+      || path.join(project.localPath, '.git');
+    const commonGitDir = await _resolveCommonGitDirAsync(gitDir);
+    return [
+      path.join(gitDir, 'HEAD'),
+      path.join(gitDir, 'logs', 'HEAD'),
+      path.join(commonGitDir, 'FETCH_HEAD'),
+    ];
+  }));
+  for (const paths of projectPaths) files.push(...paths);
+  _slowMtimePathsAsyncCache = files;
+  _slowMtimePathsAsyncCacheKey = cacheKey;
+  return files;
+}
+
 // ── Exports ─────────────────────────────────────────────────────────────────
 
 module.exports = {
@@ -3255,6 +3253,7 @@ module.exports = {
   // W-mpftp7na000td0f4 — engine→dashboard cache-invalidation registry
   getStatusFastStateMtimePaths,
   getStatusSlowStateMtimePaths,
+  getStatusSlowStateMtimePathsAsync,
 
   // Core state
   getConfig, getControl, getDispatch, getDispatchQueue, getDispatchCompletionReport, invalidateDispatchCache,

package/engine/tools-inventory.js

@@ -0,0 +1,104 @@
+'use strict';
+
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const shared = require('./shared');
+const queries = require('./queries');
+
+function readClaudeUserMcpServers(homeDir = os.homedir()) {
+  try {
+    const data = shared.safeJsonObj(path.join(homeDir, '.claude.json'));
+    const servers = data?.mcpServers || {};
+    return Object.entries(servers).map(([name, cfg]) => ({
+      name,
+      source: 'Claude user',
+      command: cfg.command || cfg.url || '',
+      args: Array.isArray(cfg.args) ? cfg.args.join(' ') : (cfg.args || ''),
+    }));
+  } catch {
+    return [];
+  }
+}
+
+function readCopilotUserMcpServers(homeDir = os.homedir()) {
+  try {
+    const configPath = path.join(homeDir, '.copilot', 'mcp-config.json');
+    if (!fs.existsSync(configPath)) return [];
+    let raw = fs.readFileSync(configPath, 'utf8');
+    if (raw.charCodeAt(0) === 0xFEFF) raw = raw.slice(1);
+    const data = JSON.parse(raw);
+    const servers = data?.mcpServers || {};
+    return Object.entries(servers).map(([name, cfg]) => ({
+      name,
+      source: 'Copilot',
+      command: cfg.command || cfg.url || '',
+      args: Array.isArray(cfg.args) ? cfg.args.join(' ') : (cfg.args || ''),
+    }));
+  } catch {
+    return [];
+  }
+}
+
+function readWorkspaceMcpServers(projects) {
+  const out = [];
+  for (const project of projects || []) {
+    if (!project?.localPath) continue;
+    const data = shared.safeJsonObj(path.join(project.localPath, '.mcp.json'));
+    for (const [name, cfg] of Object.entries(data.mcpServers || {})) {
+      out.push({
+        name,
+        source: `Workspace: ${project.name}`,
+        command: cfg.command || cfg.url || '',
+        args: Array.isArray(cfg.args) ? cfg.args.join(' ') : (cfg.args || ''),
+      });
+    }
+  }
+  return out;
+}
+
+function dedupeMcpServers(entries) {
+  const seen = new Set();
+  const out = [];
+  for (const entry of entries) {
+    const key = `${entry.source}::${entry.name}`;
+    if (seen.has(key)) continue;
+    seen.add(key);
+    out.push(entry);
+  }
+  return out;
+}
+
+function getMcpServers(projects, homeDir = os.homedir()) {
+  return dedupeMcpServers([
+    ...readClaudeUserMcpServers(homeDir),
+    ...readCopilotUserMcpServers(homeDir),
+    ...readWorkspaceMcpServers(projects),
+  ]);
+}
+
+function buildToolsInventory(config = queries.getConfig()) {
+  return {
+    skills: queries.getSkills(config),
+    commands: queries.getCommands(config),
+    mcpServers: getMcpServers(shared.getProjects(config)),
+  };
+}
+
+if (require.main === module) {
+  try {
+    process.stdout.write(JSON.stringify(buildToolsInventory()));
+  } catch (error) {
+    process.stderr.write(`tools-inventory: ${error.message}\n`);
+    process.exitCode = 1;
+  }
+}
+
+module.exports = {
+  buildToolsInventory,
+  getMcpServers,
+  readClaudeUserMcpServers,
+  readCopilotUserMcpServers,
+  readWorkspaceMcpServers,
+  dedupeMcpServers,
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yemi33/minions",
-  "version": "0.1.2402",
+  "version": "0.1.2403",
   "description": "Multi-agent AI dev team that runs from ~/.minions/ — five autonomous agents share a single engine, dashboard, and knowledge base",
   "bin": {
     "minions": "bin/minions.js"