@yemi33/minions 0.1.2441 → 0.1.2443

package/dashboard/js/settings.js

@@ -503,7 +503,7 @@ async function openSettings() {
     '<h3>Polling</h3>' +
     '<div class="settings-pane-sub">Cadence for fetching PR build status, votes, and comments from the platforms. Disabling a provider here turns the matching Auto-fix gates into no-ops. The <em>Pause All Polling</em> kill-switch below overrides both provider toggles and inerts every PR auto-dispatch gate (Auto-fix Builds / Conflicts / Review / etc.) until cleared.</div>' +
     '<div class="settings-stack" style="margin-bottom:16px">' +
-      settingsToggle('🛑 Pause ALL polling', 'set-pollingPaused', !!e.pollingPaused, 'Halts every PR poll, reconciliation, rebase processing, and work-discovery scan on the next tick. Reversible without restart. Use when hitting API rate limits.') +
+      settingsToggle('🛑 Pause ALL polling', 'set-pollingPaused', !!e.pollingPaused, 'Halts every PR status/comment poll AND provider reconciliation (ADO + GitHub + shared-branch) on the next tick, and inerts every PR-derived auto-dispatch gate. Reversible without restart. Use when hitting API rate limits.') +
     '</div>' +
     '<div class="settings-pane-sub" style="margin-bottom:8px">Legacy bundle toggles — granular controls below override these when set.</div>' +
     '<div class="settings-stack" style="margin-bottom:12px">' +
@@ -511,7 +511,7 @@ async function openSettings() {
       settingsToggle('GitHub Polling', 'set-ghPollEnabled', e.ghPollEnabled !== false, 'Legacy bundle macro — when OFF, silences all three GitHub axes (status, comments, reconcile) and GitHub PR dispatch gates are inert when this is off. Per-axis flags below take priority when explicitly set. Keep ON unless you want a one-knob GitHub kill.') +
     '</div>' +
     '<details class="settings-collapsible" style="margin-bottom:12px"><summary>Granular per-poller controls (P-c4d8e1a3)</summary>' +
-    '<div class="settings-pane-sub" style="margin-top:8px">Override individual ADO/GitHub poll axes + the pending-rebase processor. Explicit values here win; if unset, the legacy ADO/GitHub Polling macros above apply; otherwise the default is ON. <strong>Status</strong> + <strong>Comments</strong> still honor the <em>Pause All Polling</em> kill-switch above; <strong>Reconcile</strong> and <strong>Process Pending Rebases</strong> are recovery sweeps and ignore it (by design).</div>' +
+    '<div class="settings-pane-sub" style="margin-top:8px">Override individual ADO/GitHub poll axes + the pending-rebase processor. Explicit values here win; if unset, the legacy ADO/GitHub Polling macros above apply; otherwise the default is ON. <strong>Status</strong>, <strong>Comments</strong> and <strong>Reconcile</strong> all honor the <em>Pause All Polling</em> kill-switch above (reconcile included since W-ms5eljc60090f0d5 — it issues provider API calls); only <strong>Process Pending Rebases</strong> ignores it (by design — it makes no provider poll call).</div>' +
     '<div class="settings-stack" style="margin-top:8px">' +
       settingsToggle('ADO PR Status Poll', 'set-adoPrStatusPollEnabled', e.adoPrStatusPollEnabled !== false, 'Granular: ADO PR build/merge/review status poll (section 2.6). Default ON. When OFF, ADO PR status will not refresh, but reconcile + comments still run (unless their own granular flag is OFF).') +
       settingsToggle('ADO PR Comments Poll', 'set-adoPrCommentsPollEnabled', e.adoPrCommentsPollEnabled !== false, 'Granular: ADO PR human-comments poll (section 2.7). Default ON. When OFF, ADO PR comments will not surface — auto-fix-human-comments still composes against this flag for ADO.') +

package/docs/auto-discovery.md

@@ -28,8 +28,8 @@ tick()
        syncPrdFromPrs()          Backfill PRD item status from active PRs
        checkPlanCompletion()     Mark plans completed when all features are terminal (done/failed/cancelled)
   2.7 pollPrHumanComments()      Poll PR threads for human comments (wall-clock cadence from prPollCommentsEvery × tickInterval, default ≈ 12min)
-       reconcilePrs() (ADO+GH)   Reconciliation sweep (runs regardless of poll flags)
-      reconcileSharedBranchPrs() Backfill the PR store for shared-branch plans whose aggregate remote PR is untracked/under-linked (runs unconditionally, like the other recovery sweeps)
+       reconcilePrs() (ADO+GH)   Reconciliation sweep (honors the pollingPaused master kill-switch + the per-provider *PrReconcileEnabled flags)
+      reconcileSharedBranchPrs() Backfill the PR store for shared-branch plans whose aggregate remote PR is untracked/under-linked (skipped while pollingPaused is ON)
   2.9 stalled-dispatch sweep     Auto-retry failed items blocking pending deps (every 120 ticks)
   3a. pruneStalePrDispatchesAsync() Clear pending PR dispatches whose underlying PRs no longer warrant action
   3.  dispatch existing pending  Spawn agents for items already durable in dispatch.pending (up to maxConcurrent) — runs BEFORE discovery so a slow pre-dispatch validator can't starve already-queued work
@@ -74,7 +74,7 @@ Inside `discoverFromPrs()`, ADO and GitHub projects first resolve their own prov
 
 **`autoReReviewPrs` gates both re-review paths (`P-e8b1c4d2`).** Re-reviews fire from two places: (1) the open-loop **discovery** path in `engine.js:discoverFromPrs` (PR shows `reviewStatus=waiting` after a fix push), and (2) the **closure-loop** in `engine/lifecycle.js:dispatchReReviewForFix` (a fix WI completes whose meta carries `addresses_review_wi`, queuing the next review against the same PR). The `engine.autoReReviewPrs` toggle is read at BOTH sites so flipping it OFF mutes the entire re-review cycle — not just the discovery sweep. Default ON; flip via Dashboard → Settings → Auto-fix & Review Loop, or `engine.autoReReviewPrs: false` in `config.json`.
 
-**Hard-stop kill-switch (`pollingPaused`).** `engine.pollingPaused: true` is a master override that wins over both `adoPollEnabled` and `ghPollEnabled`. When ON, section 2.6/2.7 of the tick cycle skips `pollPrStatus` and `pollPrHumanComments` for both providers, and `discoverFromPrs` forces `pollEnabled=false` for every project so every per-PR auto-dispatch gate (`autoReviewPrs` / `autoFixBuilds` / `autoFixConflicts` / `autoFixReviewFeedback` / `autoFixHumanComments`) becomes inert. Reconciliation (the recovery sweep that follows section 2.7) is intentionally not gated. The engine logs `[engine] PR polling paused — …` once on the transition from unpaused → paused; routine PR poll log lines resume when cleared. Flip via Dashboard → Settings → Polling, or set `engine.pollingPaused: true` in `config.json`. Default OFF — fresh installs behave identically to before this knob existed.
+**Hard-stop kill-switch (`pollingPaused`).** `engine.pollingPaused: true` is a master override that wins over both `adoPollEnabled` and `ghPollEnabled`. When ON, section 2.6/2.7 of the tick cycle skips `pollPrStatus` and `pollPrHumanComments` for both providers, `discoverFromPrs` forces `pollEnabled=false` for every project so every per-PR auto-dispatch gate (`autoReviewPrs` / `autoFixBuilds` / `autoFixConflicts` / `autoFixReviewFeedback` / `autoFixHumanComments`) becomes inert, and — since W-ms5eljc60090f0d5 — the reconcile tail (`reconcilePrs`, `ghReconcilePrs`, `reconcileSharedBranchPrs`) is skipped too. Reconciliation was previously exempt as a "recovery sweep", but those sweeps walk every tracked PR and issue provider API calls, so the documented emergency pause did not actually stop provider network traffic. The per-provider `*PrReconcileEnabled` flags remain independent whenever the master switch is OFF. The engine logs `[engine] PR polling paused — …` once on the transition from unpaused → paused; routine PR poll log lines resume when cleared. Flip via Dashboard → Settings → Polling, `POST /api/engine/polling/pause`, or set `engine.pollingPaused: true` in `config.json`. Default OFF — fresh installs behave identically to before this knob existed.
 
 **Hard-stop kill-switch (`autoFixPaused`).** `engine.autoFixPaused: true` is a narrower master override that wins over every auto-fix dispatch gate. When ON, `discoverFromPrs` forces `autoFixBuilds` / `autoFixConflicts` / `autoFixReviewFeedback` / `autoFixHumanComments` to false for every project, so no fix agent is auto-dispatched against any PR. Review dispatch (`autoReviewPrs` / `autoReReviewPrs`), PR status / human-comment polling, and reconciliation are intentionally not gated — operators can pause a fix-storm during an incident while still seeing fresh review verdicts and build status. The engine logs `[engine] auto-fix paused — …` once on the transition from unpaused → paused; routine discovery resumes when cleared. Flip via Dashboard → Settings → Auto-fix & Review Loop, or set `engine.autoFixPaused: true` in `config.json`. Default OFF — fresh installs behave identically to before this knob existed.
 
@@ -84,10 +84,10 @@ Inside `discoverFromPrs()`, ADO and GitHub projects first resolve their own prov
 |------|---------|-------|--------------------------------|
 | `adoPrStatusPollEnabled` | `true` | Section 2.6 (ADO `pollPrStatus`) | Yes — status polls honor the master killswitch |
 | `adoPrCommentsPollEnabled` | `true` | Section 2.7 (ADO `pollPrHumanComments`) | Yes |
-| `adoPrReconcileEnabled` | `true` | Section 2.7 tail (ADO `reconcilePrs`) | No — reconcile is a recovery sweep |
+| `adoPrReconcileEnabled` | `true` | Section 2.7 tail (ADO `reconcilePrs`) | Yes — the master killswitch stops provider reconciliation too (W-ms5eljc60090f0d5) |
 | `ghPrStatusPollEnabled` | `true` | Section 2.6 (GitHub `ghPollPrStatus`) | Yes |
 | `ghPrCommentsPollEnabled` | `true` | Section 2.7 (GitHub `ghPollPrHumanComments`) | Yes |
-| `ghPrReconcileEnabled` | `true` | Section 2.7 tail (GitHub `ghReconcilePrs`) | No — reconcile is a recovery sweep |
+| `ghPrReconcileEnabled` | `true` | Section 2.7 tail (GitHub `ghReconcilePrs`) | Yes — the master killswitch stops provider reconciliation too (W-ms5eljc60090f0d5) |
 | `processPendingRebasesEnabled` | `true` | Section 2.6 tail (`processPendingRebases`) | No — rebase processor has no legacy macro |
 
 Resolution order (`shared.resolvePollFlag(engineCfg, granularKey, legacyMacroKey)`): (1) granular flag explicitly set → wins; (2) legacy macro is `false` → propagates `false` to all three axes of that provider (including reconcile); (3) otherwise → `ENGINE_DEFAULTS[granularKey]` (`true`).

package/docs/copilot-cli-schema.md

@@ -116,12 +116,12 @@ warns when required permission-bypass flags are absent.
 ```powershell
 # Test A: stdin without -p — works.
 "Say only the word: pong" |
-  copilot --output-format json -s --allow-all --no-ask-user --autopilot --log-level error
+  copilot --output-format json -s --allow-all --no-ask-user --autopilot
 # EXIT=0; user.message.data.content = "Say only the word: pong\r\n"; assistant replied "pong".
 
 # Test B: -p "<40_000-char string>" — Windows OS rejects spawn.
 $big = "x" * 40000
-copilot -p $big --output-format json -s --allow-all --no-ask-user --autopilot --log-level error
+copilot -p $big --output-format json -s --allow-all --no-ask-user --autopilot
 # Program 'copilot.exe' failed to run:
 #   The filename or extension is too long.
 #   (CreateProcess ARG_MAX limit, ~32 KB on Windows)
@@ -176,7 +176,7 @@ Empirically confirmed flags for non-interactive Copilot invocations:
 | `--allow-all` | **required** | Equivalent to `--allow-all-tools --allow-all-paths --allow-all-urls`. Without this the CLI prompts for every tool/path use, which deadlocks in stdin/stdout mode. |
 | `--no-ask-user` | **required** | Removes the `ask_user` tool. Without it the agent can stall waiting for human input. |
 | `--autopilot` | for multi-turn agency | Enables `task_complete`-driven multi-turn loop. **Without it** the session ends after one assistant response (see §3.1). |
-| `--log-level error` | recommended | Suppresses INFO/DEBUG diagnostics that aren't part of the JSONL stream. |
+| `--log-level <level>` | **do not emit** | Copilot CLI 1.0.76-1 exits silently with code 1 for explicit non-default levels. Omit the flag and use the CLI default; `--output-format json` still keeps stdout machine-readable. |
 | `--disable-builtin-mcps` | gated by config | Disables `github-mcp-server`. Default-on for Minions (`copilotDisableBuiltinMcps: true`) to prevent split-brain PR creation. |
 | `--no-color` | always emitted | Keeps any incidental CLI rendering free of ANSI color. |
 | `--plain-diff` | always emitted | Keeps incidental diff rendering plain even though normal output is JSONL. |
@@ -499,7 +499,7 @@ Constructed test: created `AGENTS.md` in cwd with content
 
 ```text
 # A) Default behavior — AGENTS.md is loaded
-PS> "Just say hello." | copilot --output-format json -s --allow-all --no-ask-user --autopilot --log-level error
+PS> "Just say hello." | copilot --output-format json -s --allow-all --no-ask-user --autopilot
 {"type":"assistant.message", ..., "content": "Hello. __AGENTS_LOADED__"}      ← marker present
 
 ```
@@ -602,11 +602,11 @@ When implementing `engine/runtimes/copilot.js`:
    - Recognize npm shims returned by PATH and resolve the package's JavaScript
      entry; no separate npm-prefix scan is needed.
 3. `buildArgs(opts)` always emits:
-   `--output-format json -s --no-color --plain-diff --allow-all --no-ask-user --autopilot --log-level error`
+   `--output-format json -s --no-color --plain-diff --allow-all --no-ask-user --autopilot`
    plus the conditional flags from §3, plus `--disable-builtin-mcps` per
    `opts.disableBuiltinMcps`,
    plus `--attachment <path>` (repeatable) for each image in `opts.images` (§10a).
-   **Never** emit `--verbose`.
+   **Never** emit `--verbose` or `--log-level`.
 4. `buildPrompt()` injects `<system>...</system>\n\n` when sysprompt is
    non-empty on a fresh call; a resumed call (`opts.sessionId`) passes through
    only the new user prompt (§2).

package/docs/pr-auto-fix-dispatch.md

@@ -36,10 +36,10 @@ There are two independent operator-facing master flags:
 
 | Flag             | Default | Effect                                                                                                                                                                                                                                                                                          |
 |------------------|---------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| `pollingPaused`  | `false` | Skips `pollPrStatus` + `pollPrHumanComments` for both providers. Forces `pollEnabled=false` in `discoverFromPrs` so every per-PR auto-dispatch gate (`autoReviewPrs` / `autoFixBuilds` / …) becomes inert. Reconciliation (recovery sweep) intentionally still runs. Default OFF — fresh installs behave identically. |
+| `pollingPaused`  | `false` | Skips `pollPrStatus` + `pollPrHumanComments` for both providers, plus the reconcile tail (`reconcilePrs` / `ghReconcilePrs` / `reconcileSharedBranchPrs`) — the master switch stops ALL provider network polling (W-ms5eljc60090f0d5). Forces `pollEnabled=false` in `discoverFromPrs` so every per-PR auto-dispatch gate (`autoReviewPrs` / `autoFixBuilds` / …) becomes inert. Default OFF — fresh installs behave identically. |
 | `autoFixPaused`  | `false` | Narrower: forces `autoFixBuilds` / `autoFixConflicts` / `autoFixReviewFeedback` / `autoFixHumanComments` to `false` for every project. Review dispatch, polling, and reconciliation are intentionally not gated, so operators can stop a fix-storm while still seeing fresh verdicts and build status. Default OFF. |
 
-These compose: setting `pollingPaused: true` plus `autoFixPaused: true` halts *all* automated PR work (review + fix + polling). Setting only `autoFixPaused: true` halts only auto-fix dispatch. Setting only `pollingPaused: true` halts polling and effectively halts dispatch (because the per-PR gates rely on cached poll state), but leaves reconciliation running and lets manual `/api/pull-requests/observe` or operator-driven dispatch still proceed.
+These compose: setting `pollingPaused: true` plus `autoFixPaused: true` halts *all* automated PR work (review + fix + polling). Setting only `autoFixPaused: true` halts only auto-fix dispatch. Setting only `pollingPaused: true` halts polling *and reconciliation* (all provider network traffic) and effectively halts dispatch (because the per-PR gates rely on cached poll state), while still letting manual `/api/pull-requests/observe` or operator-driven dispatch proceed.
 
 Flip via Dashboard → Settings → Polling (`pollingPaused`) / Auto-fix & Review Loop (`autoFixPaused`), or set `engine.<flag>: true` in `config.json`.
 

package/engine/ado.js

@@ -774,6 +774,43 @@ function _hasPendingReReviewWi(pr) {
 
 let _adoTokenCache = { token: null, expiresAt: 0 };
 
+// W-ms5eljc60090f0d5 — Single-flight guard for token acquisition. `forEachActivePr`
+// runs up to five requests concurrently and `adoFetch` re-acquires on every HTML
+// (auth-redirect) body, so without this latch one expired token produced one
+// `az`/`azureauth` shell-out PER in-flight request (a refresh stampede that
+// degrades the whole engine host). Concurrent callers awaiting the same missing
+// token share this promise; it is cleared on BOTH success and failure so a
+// rejected acquisition can never wedge the latch permanently.
+let _adoTokenInflight = null;
+
+// Test seam for the acquisition shell-out. Production callers leave this null and
+// get `acquireAdoToken`; tests set it so `adoFetch`'s internal `getAdoToken()`
+// call (which takes no opts) can be exercised without spawning az/azureauth.
+let _adoTokenAcquireOverride = null;
+function _setAdoTokenAcquirerForTest(fn) { _adoTokenAcquireOverride = (typeof fn === 'function') ? fn : null; }
+
+/**
+ * Generation-safe cache invalidation. An ADO response only proves that the token
+ * IT used is dead — a slower request still carrying a superseded token must not
+ * evict the token a concurrent refresh already installed, or every late response
+ * re-opens the stampede window. Returns true only when the cache was actually
+ * cleared.
+ */
+function _invalidateAdoTokenIfCurrent(usedToken) {
+  const used = typeof usedToken === 'string' ? usedToken : '';
+  if (!used) return false;                                  // request had no token to invalidate
+  if (!_adoTokenCache.token) return false;                  // already cleared by a sibling response
+  if (_adoTokenCache.token !== used) return false;          // a NEWER token is cached — leave it alone
+  _adoTokenCache = { token: null, expiresAt: 0 };
+  return true;
+}
+
+/** Read-only cache peek — exported for testing only. */
+function _peekAdoTokenCacheForTest() { return { ..._adoTokenCache }; }
+
+/** Read-only in-flight peek — exported for testing only. */
+function _getAdoTokenInflightForTest() { return _adoTokenInflight; }
+
 // ── ADO token acquisition backoff + health (W-mqidhwcc000m897e) ──────────────
 // Graduated backoff replaces the old flat 10-min blackout: a single transient
 // blip (broker hiccup, az cold-start, network) now backs off 30s and doubles
@@ -965,13 +1002,30 @@ function isAdoAuthError(err) {
 
 async function getAdoToken(opts = {}) {
   // _acquire is a test seam — production callers pass no args (unchanged).
-  const acquire = opts._acquire || acquireAdoToken;
+  const acquire = opts._acquire || _adoTokenAcquireOverride || acquireAdoToken;
   if (_adoTokenCache.token && Date.now() < _adoTokenCache.expiresAt) {
     return _adoTokenCache.token;
   }
+  // Single-flight: an acquisition is already running, so join it instead of
+  // spawning a second `az`/`azureauth` process. Checked BEFORE the backoff gate
+  // because the in-flight attempt has not recorded a failure yet.
+  if (_adoTokenInflight) return _adoTokenInflight;
   // Graduated backoff — skip acquisition (return null) while backing off so a
   // transient blip doesn't blackout polling/reconciliation for the full cap.
   if (_adoTokenBackoff.isBackingOff()) return null;
+  // NOTE: everything from the cache read to this assignment is synchronous, so
+  // concurrent callers cannot interleave and both start an acquisition.
+  const inflight = _acquireAdoTokenOnce(acquire);
+  _adoTokenInflight = inflight;
+  // Clear on BOTH settle paths. `_acquireAdoTokenOnce` swallows its own errors,
+  // but the identity check keeps a late clear from clobbering a newer attempt.
+  const clear = () => { if (_adoTokenInflight === inflight) _adoTokenInflight = null; };
+  inflight.then(clear, clear);
+  return inflight;
+}
+
+/** One acquisition attempt. Never rejects — resolves to a token string or null. */
+async function _acquireAdoTokenOnce(acquire) {
   try {
     const { token } = await acquire({ execAsync, timeout: 15000 });
     _adoTokenCache = { token, expiresAt: Date.now() + 30 * 60 * 1000 };
@@ -1025,10 +1079,15 @@ async function adoFetch(url, token, opts = {}) {
   if (!res.ok) throw new Error(`ADO API ${method} ${res.status}: ${res.statusText}`);
   const text = await res.text();
   if (!text || text.trimStart().startsWith('<')) {
-    _adoTokenCache = { token: null, expiresAt: 0 };
+    // Generation-safe: only evict the cache when THIS request's token is still
+    // the cached one. A late response carrying a superseded token must not wipe
+    // the token a concurrent refresh already installed. Combined with the
+    // single-flight latch in getAdoToken, N concurrent HTML responses on one
+    // stale token cost exactly ONE acquisition, not N.
+    _invalidateAdoTokenIfCurrent(token);
     if (_retryCount < MAX_RETRIES) {
       const freshToken = await getAdoToken();
-      if (freshToken) {
+      if (freshToken && freshToken !== token) {
         log('info', 'ADO token expired mid-session — refreshed and retrying');
         return adoFetch(url, freshToken, { ...opts, _retryCount: _retryCount + 1 });
       }
@@ -2889,6 +2948,7 @@ function _setAdoThrottleForTest(state, orgBase = 'dev.azure.com/__test__') {
  *  Lets tests exercise functions that call getAdoToken() without invoking azureauth.
  *  Pass null to force getAdoToken() to return null synchronously (no exec). */
 function _setAdoTokenForTest(token) {
+  _adoTokenInflight = null;
   if (token == null) {
     // Clear cache AND open a long backoff window so getAdoToken short-circuits
     // to null without spawning azureauth — otherwise tests would hang on the
@@ -2907,6 +2967,8 @@ function _setAdoTokenForTest(token) {
 /** Reset all token backoff + health + dedup state — exported for testing only. */
 function _resetAdoTokenForTest() {
   _adoTokenCache = { token: null, expiresAt: 0 };
+  _adoTokenInflight = null;
+  _adoTokenAcquireOverride = null;
   _adoTokenBackoff._reset();
   _adoTokenHealth = { lastSuccessAt: 0, lastFailureReason: null, classification: null };
   _adoTokenAuthNoteSent = false;
@@ -3099,6 +3161,11 @@ module.exports = {
   _resetAdoTokenForTest, // exported for testing
   _setAdoTokenBackoffForTest, // exported for testing
   _setAdoTokenAuthNoteWriterForTest, // exported for testing
+  // W-ms5eljc60090f0d5 — single-flight acquisition + generation-safe invalidation
+  _invalidateAdoTokenIfCurrent, // exported for testing
+  _setAdoTokenAcquirerForTest, // exported for testing
+  _peekAdoTokenCacheForTest, // exported for testing
+  _getAdoTokenInflightForTest, // exported for testing
   isAdoThrottled,
   getAdoThrottleState,
   fetchAdoPrMetadata,

package/engine/runtimes/copilot.js

@@ -434,12 +434,15 @@ function _mapEffort(level) {
 //
 // Always-on baseline (per docs/copilot-cli-schema.md §3 and the PRD spec):
 //   --output-format json -s --no-color --plain-diff --autopilot
-//   --allow-all --no-ask-user --log-level error
+//   --allow-all --no-ask-user
 //
 // Conditional flags only emitted when their corresponding opt is set/truthy.
 // Copilot has no --verbose flag — never emit it. The `bare` / `maxBudget` /
 // `fallbackModel` opts are silently ignored (their capability flags are false
 // so engine code shouldn't pass them, but we tolerate them gracefully).
+// Do not emit --log-level: Copilot CLI 1.0.76-1 exits silently with code 1
+// when given an explicit non-default level. Omitting it preserves the CLI's
+// compatible default while --output-format json keeps stdout machine-readable.
 
 // Map MIME type to file extension for --attachment temp file naming.
 const _MIME_EXT = {
@@ -475,7 +478,6 @@ function buildArgs(opts = {}) {
     '--autopilot',
     '--allow-all',
     '--no-ask-user',
-    '--log-level', 'error',
   ];
 
   if (Array.isArray(addDirs)) {

package/engine/shared.js

@@ -3201,8 +3201,12 @@ const ENGINE_DEFAULTS = {
   // autoReviewPrs / autoFixReviewFeedback / autoFixHumanComments) all
   // become inert. Default false so a fresh install behaves identically to
   // before this knob existed. Flip via Dashboard → Settings → Polling, or
-  // set `engine.pollingPaused: true` in config.json. Reconciliation still
-  // runs (it's a recovery sweep, not a convenience poll) — see section 2.7.
+  // set `engine.pollingPaused: true` in config.json. W-ms5eljc60090f0d5: the
+  // section 2.7 reconcile tail (reconcilePrs / ghReconcilePrs /
+  // reconcileSharedBranchPrs) is suppressed too — those sweeps walk every
+  // tracked PR and issue provider API calls, so an emergency pause that left
+  // them running did not actually stop provider network traffic. The
+  // per-provider *PrReconcileEnabled flags stay independent while this is off.
   pollingPaused: false, // hard-stop kill-switch / master override (see comment above)
   autoReReviewPrs: true, // auto-dispatch review agents after a PR fix is pushed
   autoFixReviewFeedback: true, // auto-dispatch fix agents for minions review changes-requested verdicts

package/engine.js

@@ -12158,13 +12158,69 @@ const TICK_TIMEOUT_MS = 300000; // 5 min — force-release tick lock if stuck
 // the entire tick loop indefinitely. The outer TICK_TIMEOUT_MS guard only
 // rescues the tick lock; withTickTimeout surfaces the hung operation as an
 // error on that tick so subsequent phases can still run.
-function withTickTimeout(fn, label, ms) {
+//
+// W-ms5eljc60090f0d5 — Promise.race does NOT cancel `fn()`. A phase that blew
+// its deadline keeps running, so a later tick used to launch a SECOND copy of
+// the same phase on top of it (two concurrent pollPrStatus sweeps re-issuing
+// the same provider requests, doubling token/API pressure). `_phaseInFlight`
+// tracks the real underlying promise per label and makes the next invocation
+// of a still-running phase a fast rejection (`tick-phase-busy: …`) instead of
+// an overlapping run. Every call site already catches and logs, so the tick
+// keeps making progress and pending dispatches are still reached.
+//
+// Escape hatch: a promise that NEVER settles would otherwise silence its label
+// forever (fatal for `discoverWork`). Once a slot is older than
+// TICK_PHASE_ABANDON_MS the guard abandons tracking of the wedged run, logs
+// loudly, and lets a fresh invocation through — bounding the pathological
+// overlap to once per abandon-window instead of once per 10s tick.
+const _phaseInFlight = new Map(); // label -> { promise, startedAt }
+
+/** How long a still-running phase may hold its slot before the guard gives up on
+ *  it. Deliberately generous (>= the outer tick-lock force-release window) so it
+ *  only ever fires for genuinely wedged work, never for a merely slow sweep. */
+const TICK_PHASE_ABANDON_MS = 300000; // 5 min
+
+/** True while `label`'s previous invocation is still running (even if it already
+ *  blew its tickOpTimeoutMs deadline). Exported for testing. */
+function isTickPhaseInFlight(label) { return _phaseInFlight.has(label); }
+
+/** Drop all phase-in-flight tracking — exported for testing only. */
+function _resetTickPhasesForTest() { _phaseInFlight.clear(); }
+
+function withTickTimeout(fn, label, ms, opts = {}) {
+  // abandonMs is a test seam — production callers pass no opts.
+  const abandonMs = Number.isFinite(opts.abandonMs) ? opts.abandonMs : TICK_PHASE_ABANDON_MS;
+  const existing = _phaseInFlight.get(label);
+  if (existing) {
+    const ageMs = Date.now() - existing.startedAt;
+    if (ageMs < abandonMs) {
+      return Promise.reject(new Error(`tick-phase-busy: ${label} skipped — a previous invocation is still running (${ageMs}ms)`));
+    }
+    // Wedged past the abandon window: stop waiting on it. The release handler
+    // below is identity-checked, so the abandoned run can never clear the
+    // successor's slot when (if ever) it finally settles.
+    log('warn', `[tick] abandoning wedged phase ${label} after ${ageMs}ms — starting a fresh invocation`);
+    _phaseInFlight.delete(label);
+  }
+  let started;
+  try {
+    started = Promise.resolve(fn());
+  } catch (e) {
+    return Promise.reject(e);
+  }
+  const entry = { promise: started, startedAt: Date.now() };
+  _phaseInFlight.set(label, entry);
+  // Release the slot only when the UNDERLYING work truly settles — not when the
+  // race below rejects. Identity check so a stale settle can't clear a successor.
+  const release = () => { if (_phaseInFlight.get(label) === entry) _phaseInFlight.delete(label); };
+  started.then(release, release);
+  let timer = null;
   return Promise.race([
-    fn(),
-    new Promise((_, reject) =>
-      setTimeout(() => reject(new Error(`tick-timeout: ${label} exceeded ${ms}ms`)), ms)
-    ),
-  ]);
+    started,
+    new Promise((_, reject) => {
+      timer = setTimeout(() => reject(new Error(`tick-timeout: ${label} exceeded ${ms}ms`)), ms);
+    }),
+  ]).finally(() => { if (timer) clearTimeout(timer); });
 }
 
 // P-c2e5a1d9-a — Generation counter that is incremented on every tick start
@@ -12496,9 +12552,14 @@ async function tickInner() {
   // P-a1f3c2d4: engine.pollingPaused is a hard-stop master switch — it overrides
   // both per-provider toggles. When ON, adoPollEnabled and ghPollEnabled are
   // forced to false so the status-poll and human-comment-poll gates below
-  // short-circuit without editing every per-call gate. Reconciliation (the
-  // final block below) is NOT gated — it's a recovery sweep, not a
-  // convenience poll. The same gate is mirrored inside discoverFromPrs.
+  // short-circuit without editing every per-call gate. The same gate is mirrored
+  // inside discoverFromPrs.
+  // W-ms5eljc60090f0d5: reconciliation is now gated too. It was previously exempt
+  // ("recovery sweep, not a convenience poll"), but reconcilePrs / ghReconcilePrs
+  // walk every tracked PR and issue provider API calls, so the documented
+  // emergency stop (POST /api/engine/polling/pause) did not actually stop
+  // provider network traffic. The per-provider *PrReconcileEnabled flags stay
+  // independent whenever the master switch is OFF.
   const pollingPaused = config.engine?.pollingPaused === true;
   if (pollingPaused && _shouldLogPollingPausedOnce()) {
     log('info', '[engine] PR polling paused — engine.pollingPaused=true overrides adoPollEnabled/ghPollEnabled');
@@ -12519,8 +12580,8 @@ async function tickInner() {
   const ghStatusPollEnabled = !pollingPaused && resolvePollFlag(config.engine, 'ghPrStatusPollEnabled', 'ghPollEnabled');
   const adoCommentsPollEnabled = !pollingPaused && resolvePollFlag(config.engine, 'adoPrCommentsPollEnabled', 'adoPollEnabled');
   const ghCommentsPollEnabled = !pollingPaused && resolvePollFlag(config.engine, 'ghPrCommentsPollEnabled', 'ghPollEnabled');
-  const adoReconcileEnabled = resolvePollFlag(config.engine, 'adoPrReconcileEnabled', 'adoPollEnabled');
-  const ghReconcileEnabled = resolvePollFlag(config.engine, 'ghPrReconcileEnabled', 'ghPollEnabled');
+  const adoReconcileEnabled = !pollingPaused && resolvePollFlag(config.engine, 'adoPrReconcileEnabled', 'adoPollEnabled');
+  const ghReconcileEnabled = !pollingPaused && resolvePollFlag(config.engine, 'ghPrReconcileEnabled', 'ghPollEnabled');
   const rebaseProcessorEnabled = resolvePollFlag(config.engine, 'processPendingRebasesEnabled', null);
   const prPollStatusEvery = Math.max(
     1,
@@ -12619,11 +12680,13 @@ async function tickInner() {
     }
     if (commentPolls.length) await Promise.allSettled(commentPolls);
     if (_isTickStale(myGeneration)) return;
-    // P-c4d8e1a3: reconcile gated by *PrReconcileEnabled (default true) — ungated
-    // by ADO/GH throttle trackers (recovery-sweep contract intact). Legacy
-    // adoPollEnabled/ghPollEnabled=false now also silences reconcile via
-    // resolvePollFlag's legacy-macro fallback (documented breaking change).
-    // ADO and GitHub reconciliation are independent and run in parallel.
+    // P-c4d8e1a3: legacy adoPollEnabled/ghPollEnabled=false also silences
+    // reconcile via resolvePollFlag's legacy-macro fallback (documented
+    // breaking change). ADO and GitHub reconcilers are independent and run in
+    // parallel; both are gated by *PrReconcileEnabled (default true) and by the
+    // engine.pollingPaused master kill-switch (W-ms5eljc60090f0d5, so "pause
+    // polling" means zero provider network traffic), but stay ungated by the
+    // ADO/GH throttle trackers (recovery-sweep contract intact).
     const reconcilePolls = [];
     if (adoReconcileEnabled) {
       reconcilePolls.push(withTickTimeout(() => reconcilePrs(config), 'reconcilePrs', tickOpTimeoutMs).catch(err => { log('warn', `ADO PR reconciliation error: ${err?.message || err}${err?.stack ? ' | ' + err.stack.split('\n')[1]?.trim() : ''}`); }));
@@ -12662,12 +12725,16 @@ async function tickInner() {
     // but is untracked / under-linked, so the dashboard renders the single
     // aggregate PR instead of N phantom per-item rows. Host-agnostic and fully
     // self-guarding (per-PRD/per-project try/catch, never creates a remote PR),
-    // so it runs unconditionally in the reconcile phase like the other recovery
-    // sweeps — independent of the ADO/GitHub poll + throttle gates.
-    try {
-      await withTickTimeout(() => reconcileSharedBranchPrs(config), 'reconcileSharedBranchPrs', tickOpTimeoutMs);
-    } catch (err) {
-      log('warn', `[shared-branch-reconcile] sweep error: ${err?.message || err}`);
+    // so it runs independently of the ADO/GitHub per-provider poll + throttle
+    // gates. W-ms5eljc60090f0d5: it DOES query the remote for an open PR, so the
+    // pollingPaused master kill-switch suppresses it too — "pause polling" must
+    // mean zero provider network traffic.
+    if (!pollingPaused) {
+      try {
+        await withTickTimeout(() => reconcileSharedBranchPrs(config), 'reconcileSharedBranchPrs', tickOpTimeoutMs);
+      } catch (err) {
+        log('warn', `[shared-branch-reconcile] sweep error: ${err?.message || err}`);
+      }
     }
     if (_isTickStale(myGeneration)) return;
   }
@@ -13618,6 +13685,8 @@ module.exports = {
   _isTickStale,
   // #421 — exported for testing the per-tick hard timeout path
   _resolveTickHardTimeoutMs,
+  // W-ms5eljc60090f0d5 — exported for testing the phase-in-flight re-entry guard
+  withTickTimeout, isTickPhaseInFlight, _resetTickPhasesForTest,
   _runScheduleBootstrapOnce, // exported for testing
   get _scheduleBootstrapDone() { return _scheduleBootstrapDone; },
   set _scheduleBootstrapDone(v) { _scheduleBootstrapDone = v; },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yemi33/minions",
-  "version": "0.1.2441",
+  "version": "0.1.2443",
   "description": "Multi-agent AI dev team that runs from ~/.minions/ — five autonomous agents share a single engine, dashboard, and knowledge base",
   "bin": {
     "minions": "bin/minions.js"