@yemi33/minions 0.1.2424 → 0.1.2426

package/engine/pr-resolve.js

@@ -8,8 +8,8 @@
  * Two responsibilities:
  *  1. `normalizePrRef(input)` — accept any GitHub or ADO PR URL OR the canonical
  *     `github:owner/repo#N` / `ado:org/proj/repo#N` id and return a normalized
- *     `{ host, slug, repo, number, ... }` struct. Reuses the existing parsers in
- *     engine/shared.js (`parsePrUrl`, `parseCanonicalPrId`).
+ *     `{ host, slug, repo, number, ... }` struct. URL forms are parsed from the
+ *     validated hostname/path; canonical ids reuse `shared.parseCanonicalPrId`.
  *  2. `fetchPrPayload(refOrInput)` — fetch `{ diff, title, body, comments, author }`
  *     for that PR WITHOUT a configured project or clone, via `gh` (GitHub) and the
  *     ADO REST API (`_apis/git/...`).
@@ -38,6 +38,38 @@ const ADO_API_VERSION = '7.1';
 
 // ── Normalization ───────────────────────────────────────────────────────────
 
+function _parsePrUrl(parsedUrl) {
+  const hostname = parsedUrl.hostname.toLowerCase();
+  let match;
+  if (hostname === 'github.com') {
+    match = parsedUrl.pathname.match(/^\/([^/]+)\/([^/]+)\/pull\/([0-9]+)(?:\/|$)/i);
+    if (!match) return null;
+    return {
+      scope: `github:${decodeURIComponent(match[1])}/${decodeURIComponent(match[2])}`,
+      prNumber: match[3],
+    };
+  }
+  if (hostname === 'dev.azure.com') {
+    match = parsedUrl.pathname.match(/^\/([^/]+)\/([^/]+)\/_git\/([^/]+)\/pullrequest\/([0-9]+)(?:\/|$)/i);
+    if (!match) return null;
+    return {
+      scope: `ado:${decodeURIComponent(match[1])}/${decodeURIComponent(match[2])}/${decodeURIComponent(match[3])}`,
+      prNumber: match[4],
+    };
+  }
+  if (hostname.endsWith('.visualstudio.com')) {
+    const org = hostname.slice(0, -'.visualstudio.com'.length);
+    if (!org || org.includes('.')) return null;
+    match = parsedUrl.pathname.match(/^\/(?:DefaultCollection\/)?([^/]+)\/_git\/([^/]+)\/pullrequest\/([0-9]+)(?:\/|$)/i);
+    if (!match) return null;
+    return {
+      scope: `ado:${org}/${decodeURIComponent(match[1])}/${decodeURIComponent(match[2])}`,
+      prNumber: match[3],
+    };
+  }
+  return null;
+}
+
 /**
  * Turn a `{ scope, prNumber }` pair (as returned by shared.parsePrUrl /
  * parseCanonicalPrId) into a normalized projectless PR ref. Returns null when the
@@ -45,21 +77,37 @@ const ADO_API_VERSION = '7.1';
  */
 function _normalizeFromScope(scope, number) {
   if (!scope || typeof scope !== 'string') return null;
-  const num = Number(number);
-  if (!Number.isInteger(num) || num <= 0) return null;
+  let num;
+  try { num = shared.validatePrNum(number); }
+  catch { return null; }
 
   const sepIdx = scope.indexOf(':');
   if (sepIdx <= 0) return null;
   const host = scope.slice(0, sepIdx).toLowerCase();
   const slug = scope.slice(sepIdx + 1);
-  const segs = slug.split('/').filter(Boolean);
+  const expectedSegments = { github: 2, ado: 3 }[host] || 0;
+  const rawSegments = slug.split('/');
+  if (!expectedSegments || rawSegments.length !== expectedSegments || rawSegments.some(segment => !segment.trim())) {
+    return null;
+  }
+  let normalizedScope;
+  try {
+    [normalizedScope] = shared.validateAdditionalRepoScopes([`${host}:${slug}`]) || [];
+  } catch {
+    return null;
+  }
+  if (!normalizedScope) return null;
+  const normalizedSlug = normalizedScope.slice(host.length + 1);
+  const segs = normalizedSlug.split('/');
+  if (segs.some(segment => segment === '.' || segment === '..')) return null;
 
   if (host === 'github') {
-    if (segs.length !== 2) return null;
     const [owner, repo] = segs;
+    try { shared.validateGhSlug(`${owner}/${repo}`); }
+    catch { return null; }
     return {
       host: 'github',
-      scope,
+      scope: normalizedScope,
       slug: `${owner}/${repo}`,
       owner,
       repo,
@@ -68,11 +116,13 @@ function _normalizeFromScope(scope, number) {
     };
   }
   if (host === 'ado') {
-    if (segs.length !== 3) return null;
+    if (!/^[a-z0-9][a-z0-9-]{0,63}$/i.test(segs[0])
+      || segs.some(segment => segment.length > 128
+      || /[\u0000-\u001f\u007f#?\\]/.test(segment))) return null;
     const [org, project, repo] = segs;
     return {
       host: 'ado',
-      scope,
+      scope: normalizedScope,
       slug: `${org}/${project}/${repo}`,
       org,
       project,
@@ -95,9 +145,21 @@ function normalizePrRef(input) {
     return _normalizeFromScope(input.scope || `${input.host}:${input.slug}`, input.number);
   }
   const text = String(input == null ? '' : input).trim();
-  if (!text) return null;
-  // URL forms first, then the canonical `host:scope#N` id form.
-  const parsed = shared.parsePrUrl(text) || shared.parseCanonicalPrId(text);
+  if (!text || text.length > 2048) return null;
+  let parsed = null;
+  try {
+    if (/^https?:\/\//i.test(text)) {
+      const parsedUrl = new URL(text);
+      if (!['http:', 'https:'].includes(parsedUrl.protocol)
+          || parsedUrl.username
+          || parsedUrl.password) return null;
+      parsed = _parsePrUrl(parsedUrl);
+    } else {
+      parsed = shared.parseCanonicalPrId(text);
+    }
+  } catch {
+    return null;
+  }
   if (!parsed) return null;
   return _normalizeFromScope(parsed.scope, parsed.prNumber);
 }
@@ -125,7 +187,7 @@ function resolvePrActionRef(input, PrActionError) {
     : (typeof input === 'string' ? input.trim() : '');
   if (!rawUrl) throw new PrActionError('url required');
   const ref = normalizePrRef(rawUrl);
-  if (!ref) throw new PrActionError(`unrecognized PR reference: ${JSON.stringify(rawUrl.slice(0, 120))}`);
+  if (!ref) throw new PrActionError('unrecognized PR reference');
   return ref;
 }
 

package/engine/prd-store.js

@@ -10,7 +10,7 @@ function _toMs(v) {
 }
 function _bool01(v) { return v ? 1 : 0; }
 
-function _validatePrdFilename(filename) {
+function validatePrdFilename(filename) {
   if (typeof filename !== 'string' || !filename.endsWith('.json')
       || filename.includes('/') || filename.includes('\\') || filename === '.json') {
     throw new TypeError('PRD filename must be a basename ending in .json');
@@ -187,7 +187,7 @@ function _upsertPrd(db, filename, archived, prd, now) {
 }
 
 function writePrd(filename, prd, { archived = false } = {}) {
-  _validatePrdFilename(filename);
+  validatePrdFilename(filename);
   if (!prd || typeof prd !== 'object' || Array.isArray(prd)) {
     throw new TypeError('prd-store.writePrd requires a filename and object');
   }
@@ -201,7 +201,7 @@ function writePrd(filename, prd, { archived = false } = {}) {
 }
 
 function createPrdUnique(baseFilename, prd) {
-  _validatePrdFilename(baseFilename);
+  validatePrdFilename(baseFilename);
   if (!prd || typeof prd !== 'object' || Array.isArray(prd)) {
     throw new TypeError('prd-store.createPrdUnique requires a PRD object');
   }
@@ -224,7 +224,7 @@ function createPrdUnique(baseFilename, prd) {
 }
 
 function mutatePrd(filename, mutator, { archived = false, defaultValue = {} } = {}) {
-  _validatePrdFilename(filename);
+  validatePrdFilename(filename);
   if (typeof mutator !== 'function') {
     throw new TypeError('prd-store.mutatePrd requires a filename and mutator');
   }
@@ -249,7 +249,7 @@ function mutatePrd(filename, mutator, { archived = false, defaultValue = {} } =
 }
 
 function deletePrd(filename, { archived = false } = {}) {
-  _validatePrdFilename(filename);
+  validatePrdFilename(filename);
   const { getDb, withTransaction } = require('./db');
   const db = getDb();
   const removed = withTransaction(db, () => {
@@ -264,7 +264,7 @@ function deletePrd(filename, { archived = false } = {}) {
 }
 
 function readPrd(filename, { archived = false } = {}) {
-  _validatePrdFilename(filename);
+  validatePrdFilename(filename);
   const row = require('./db').getDb()
     .prepare('SELECT data FROM prds WHERE filename=? AND archived=?')
     .get(filename, archived ? 1 : 0);
@@ -300,6 +300,37 @@ function restorePrdFromArchive(filename) {
   return restored;
 }
 
+// Atomic inverse of restorePrdFromArchive, used only to compensate a failed
+// legacy unarchive after its archived=1 row has already moved into the live
+// bucket. Modern archives remain in place and do not call this helper.
+function movePrdToArchive(filename, replacementPrd) {
+  validatePrdFilename(filename);
+  if (replacementPrd !== undefined
+      && (!replacementPrd || typeof replacementPrd !== 'object' || Array.isArray(replacementPrd))) {
+    throw new TypeError('prd-store.movePrdToArchive replacement must be a PRD object');
+  }
+  const { getDb, withTransaction } = require('./db');
+  const db = getDb();
+  const archived = withTransaction(db, () => {
+    const row = db.prepare('SELECT id, data FROM prds WHERE filename=? AND archived=0').get(filename);
+    if (!row) return null;
+    const prd = replacementPrd === undefined
+      ? _normalizePrdForStorage(JSON.parse(row.data))
+      : _normalizePrdForStorage(structuredClone(replacementPrd));
+    _upsertPrd(db, filename, 1, prd, Date.now());
+    _deletePrdRow(db, row.id);
+    return prd;
+  });
+  if (archived) {
+    require('./db-events').emitStateEvent('prds', {
+      filename,
+      archived: 1,
+      compensated: true,
+    });
+  }
+  return archived;
+}
+
 // Idempotent boot sweep for work items that predate PRD FK stamping.
 // This is set-based, only touches NULL FKs, and prefers live PRDs when a
 // basename exists in both live and archived buckets.
@@ -359,12 +390,14 @@ function listPrdRows() {
 }
 
 module.exports = {
+  validatePrdFilename,
   writePrd,
   createPrdUnique,
   mutatePrd,
   deletePrd,
   readPrd,
   restorePrdFromArchive,
+  movePrdToArchive,
   backfillWorkItemPrdItemIds,
   listPrdRows,
   _upsertPrd, // exported for tests

package/engine/preflight.js

@@ -353,12 +353,17 @@ const _FEATURE_FLAG_DEFAULTS = {
  *   2. `CC overrides` — only when `ccCli` or `ccModel` is set
  *   3. `Active fleet flags` — only when any feature flag deviates from default
  */
-function _fleetSummaryResults(config) {
+function _fleetSummaryResults(config, { dispatch } = {}) {
   const results = [];
   if (!config || typeof config !== 'object') return results;
   const engine = config.engine || {};
   const defaultCli = engine.defaultCli ? String(engine.defaultCli) : 'copilot';
-  const defaultModel = engine.defaultModel ? String(engine.defaultModel) : '(runtime default)';
+  const display = require('./queries').resolveRuntimeModelDisplay({
+    runtime: defaultCli,
+    configuredModel: engine.defaultModel,
+    dispatch,
+  });
+  const defaultModel = display.model || '(runtime model not observed yet)';
   results.push({ name: 'Fleet', ok: true, message: `defaultCli=${defaultCli}  defaultModel=${defaultModel}` });
 
   const ccBits = [];

package/engine/process-utils.js

@@ -24,12 +24,7 @@ const { execSync: _execSync, execFile: _execFile } = require('child_process');
 function isPidAlive(pid) {
   if (!Number.isFinite(pid) || pid <= 0) return false;
   try { process.kill(pid, 0); return true; }
-  catch (err) {
-    // Signal 0 returning EPERM means the process exists but this caller cannot
-    // inspect it. Treating that as dead lets lock recovery delete a live
-    // holder's lock and breaks cross-process mutual exclusion.
-    return err && err.code === 'EPERM';
-  }
+  catch { return false; }
 }
 
 // ─── Cross-Platform Process Kill Helpers ─────────────────────────────────────
@@ -52,12 +47,13 @@ function unixChildPids(pid) {
 }
 
 function killUnixProcessTree(pid, signal, seen = new Set()) {
-  if (!Number.isInteger(pid) || pid <= 0 || seen.has(pid)) return;
+  if (!Number.isInteger(pid) || pid <= 0 || seen.has(pid)) return false;
   seen.add(pid);
   for (const childPid of unixChildPids(pid)) {
     killUnixProcessTree(childPid, signal, seen);
   }
-  try { process.kill(pid, signal); } catch { /* process may be dead */ }
+  try { process.kill(pid, signal); return true; }
+  catch { return false; }
 }
 
 function unrefTimer(timer) {
@@ -83,12 +79,16 @@ function killGracefully(proc, graceMs = 5000) {
 
 function killImmediate(proc) {
   const pid = normalizeKillPid(proc);
-  if (!pid) return;
+  if (!pid) return false;
   if (process.platform === 'win32') {
-    try { _execSync(`taskkill /PID ${pid} /F /T`, { stdio: 'pipe', timeout: 3000, windowsHide: true }); } catch { /* process may be dead */ }
-  } else {
-    killUnixProcessTree(pid, 'SIGKILL');
+    try {
+      _execSync(`taskkill /PID ${pid} /F /T`, { stdio: 'pipe', timeout: 3000, windowsHide: true });
+      return true;
+    } catch {
+      return false;
+    }
   }
+  return killUnixProcessTree(pid, 'SIGKILL');
 }
 
 // Decide whether a Windows `tasklist /FI "PID eq <pid>" /NH` output proves the
@@ -289,7 +289,7 @@ function _winListProcesses() {
   if (ps && ps.length) return ps;
   try {
     const out = _execSync(
-      'wmic process get Name,ParentProcessId,ProcessId,CommandLine /format:csv',
+      'wmic process get CreationDate,Name,ParentProcessId,ProcessId /format:csv',
       { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'], timeout: 4000, windowsHide: true, maxBuffer: 4 * 1024 * 1024 }
     );
     return _parseWmicCsv(out);
@@ -299,10 +299,15 @@ function _winListProcesses() {
 function _unixListProcesses() {
   try {
     const out = _execSync(
-      'ps -A -o pid=,ppid=,comm=',
-      { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'], timeout: 5000 }
+      'ps -A -o pid=,ppid=,lstart=,comm=',
+      {
+        encoding: 'utf8',
+        stdio: ['ignore', 'pipe', 'ignore'],
+        timeout: 5000,
+        env: { ...process.env, LC_ALL: 'C', LANG: 'C' },
+      }
     );
-    return _parseUnixProcesses(out);
+    return _parseUnixProcessesWithStart(out);
   } catch { return []; }
 }
 
@@ -345,6 +350,28 @@ function _parseUnixProcessesWithStart(out) {
   }).filter(Boolean);
 }
 
+function getProcessIdentity(pid, opts = {}) {
+  const value = Number(pid);
+  if (!Number.isInteger(value) || value <= 0) return null;
+  const processes = Array.isArray(opts.processes) ? opts.processes : listAllProcesses();
+  const match = processes.find(entry => Number(entry && entry.pid) === value);
+  const startedAt = Number(match && match.startedAt);
+  return startedAt > 0 ? { pid: value, startedAt } : null;
+}
+
+function isProcessIdentityCompatible(identity, recordedAtMs, skewMs = 1000) {
+  return !!identity
+    && Number.isFinite(recordedAtMs)
+    && identity.startedAt <= recordedAtMs + skewMs;
+}
+
+function isSameProcessIdentity(left, right) {
+  return !!left
+    && !!right
+    && left.pid === right.pid
+    && left.startedAt === right.startedAt;
+}
+
 async function _applyLinuxStartTicks(processes) {
   if (process.platform !== 'linux') return processes;
   await Promise.all(processes.map(async (entry) => {
@@ -408,12 +435,13 @@ async function listAllProcessesAsync() {
 }
 
 // W-mq6f2fe0000557fa — orphan-worktree GC: identify OS processes whose cwd
-// is at or inside `dir`. Cross-platform with a fail-open contract: on any
-// error or timeout we return [] (the caller continues with its existing
-// escalation path and an unenriched note).
+// is at or inside `dir`. Cross-platform and fail-open by default; callers that
+// gate deletion may pass `throwOnFailure:true` to fail closed instead.
 //
-// Return shape: [{ pid, cmdline, startedAt, ageMs }, ...]
+// Return shape: [{ pid, cwd, cmdline, startedAt, ageMs }, ...]
 //   - pid: numeric OS pid
+//   - cwd: matched current working directory when available (the legacy
+//          Windows command-line heuristic omits it)
 //   - cmdline: full command line as a single string (best-effort; possibly truncated)
 //   - startedAt: ms-since-epoch process start time (0 when unknown)
 //   - ageMs: Date.now() - startedAt (0 when startedAt is 0)
@@ -451,10 +479,13 @@ function findProcessesWithCwdInside(dir, opts = {}) {
     }
 
     if (process.platform === 'linux') {
-      return _findLinuxProcessesWithCwdInside(resolved, timeoutMs, now);
+      return _findLinuxProcessesWithCwdInside(resolved, timeoutMs, now, !!opts.throwOnFailure);
     }
-    return _findMacProcessesWithCwdInside(resolved, timeoutMs, now);
-  } catch { return []; }
+    return _findMacProcessesWithCwdInside(resolved, timeoutMs, now, !!opts.throwOnFailure);
+  } catch (err) {
+    if (opts.throwOnFailure) throw err;
+    return [];
+  }
 }
 
 async function findProcessesWithCwdInsideAsync(dir, opts = {}) {
@@ -529,11 +560,14 @@ function _findWindowsProcessesWithCwdInside(resolved, timeoutMs, now) {
   return out;
 }
 
-function _findLinuxProcessesWithCwdInside(resolved, _timeoutMs, now) {
+function _findLinuxProcessesWithCwdInside(resolved, _timeoutMs, now, throwOnFailure = false) {
   // /proc walk: scan numeric entries, readlink cwd, keep matches.
   let entries;
   try { entries = fs.readdirSync('/proc'); }
-  catch { return []; }
+  catch (err) {
+    if (throwOnFailure) throw err;
+    return [];
+  }
   const prefix = resolved + path.sep;
   const out = [];
   for (const e of entries) {
@@ -556,6 +590,7 @@ function _findLinuxProcessesWithCwdInside(resolved, _timeoutMs, now) {
     } catch { /* stat can fail on race */ }
     out.push({
       pid,
+      cwd,
       cmdline,
       startedAt,
       ageMs: startedAt > 0 ? Math.max(0, now - startedAt) : 0,
@@ -564,7 +599,7 @@ function _findLinuxProcessesWithCwdInside(resolved, _timeoutMs, now) {
   return out;
 }
 
-function _findMacProcessesWithCwdInside(resolved, timeoutMs, now) {
+function _findMacProcessesWithCwdInside(resolved, timeoutMs, now, throwOnFailure = false) {
   // `lsof -a -d cwd -F pn` emits PID then cwd path. Filter for dir matches,
   // then run a single `ps` pass to enrich cmdline + start time.
   let raw;
@@ -572,10 +607,15 @@ function _findMacProcessesWithCwdInside(resolved, timeoutMs, now) {
     raw = _execSync('lsof -a -d cwd -F pn 2>/dev/null', {
       encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'], timeout: timeoutMs, maxBuffer: 4 * 1024 * 1024,
     });
-  } catch { return []; }
+  } catch (err) {
+    // lsof exits 1 when no process matches; that is a successful empty probe.
+    if (err?.status === 1 && !String(err.stdout || '').trim()) return [];
+    if (throwOnFailure) throw err;
+    return [];
+  }
   if (!raw) return [];
   const prefix = resolved + path.sep;
-  const pids = new Set();
+  const pids = new Map();
   let currentPid = null;
   for (const line of String(raw).split(/\r?\n/)) {
     if (!line) continue;
@@ -585,12 +625,12 @@ function _findMacProcessesWithCwdInside(resolved, timeoutMs, now) {
       const n = Number(val);
       currentPid = Number.isInteger(n) && n > 0 ? n : null;
     } else if (tag === 'n' && currentPid != null) {
-      if (val === resolved || val.startsWith(prefix)) pids.add(currentPid);
+      if (val === resolved || val.startsWith(prefix)) pids.set(currentPid, val);
     }
   }
   if (pids.size === 0) return [];
   const out = [];
-  for (const pid of pids) {
+  for (const [pid, cwd] of pids) {
     let line;
     try {
       line = String(_execSync(`ps -p ${pid} -o lstart=,command=`, {
@@ -608,6 +648,7 @@ function _findMacProcessesWithCwdInside(resolved, timeoutMs, now) {
     }
     out.push({
       pid,
+      cwd,
       cmdline,
       startedAt,
       ageMs: startedAt > 0 ? Math.max(0, now - startedAt) : 0,
@@ -725,7 +766,10 @@ function findProcessCwdHolders(worktreePath, opts = {}) {
       `powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -File "${scriptPath}"`,
       { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'], timeout: timeoutMs, windowsHide: true, maxBuffer: 4 * 1024 * 1024 }
     );
-  } catch { raw = ''; /* ETIMEDOUT / spawn fail / write fail → reap nothing */ }
+  } catch (err) {
+    if (opts.throwOnFailure) throw err;
+    raw = ''; // ETIMEDOUT / spawn fail / write fail -> reap nothing
+  }
   finally {
     if (scriptPath) { try { fs.unlinkSync(scriptPath); } catch { /* best-effort */ } }
   }
@@ -861,8 +905,12 @@ module.exports = {
   _psListProcesses,
   _winListProcesses,
   _unixListProcesses,
+  _parseUnixProcessesWithStart, // exported for testing
   listAllProcesses,
   listAllProcessesAsync,
+  getProcessIdentity,
+  isProcessIdentityCompatible,
+  isSameProcessIdentity,
   findProcessesWithCwdInside,
   findProcessesWithCwdInsideAsync,
   _findWindowsProcessesWithCwdInside,